diff --git a/data/etc/apache2/conf-available/freedombox.conf b/data/etc/apache2/conf-available/freedombox.conf
index a2feaf114..9a484e8e2 100644
--- a/data/etc/apache2/conf-available/freedombox.conf
+++ b/data/etc/apache2/conf-available/freedombox.conf
@@ -34,7 +34,9 @@
 ##
 ## Enable HSTS, even for subdomains.
 ##
-Header set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
+<If "%{HTTP_HOST} !~ /^.*\.onion$/i">
+    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
+</If>
 
 ##
 ## Redirect traffic on home to /plinth as part of turning the machine