diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5f4acebb..96b28205 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## v1.7.82-alpha (2026-05-22)
+
+- Saleor storefront proxying now forwards `X-Forwarded-Host`, fixing Next.js Server Actions requests that compared the browser origin with the internal `storefront-app:3000` upstream host.
+- Saleor storefront media now routes `/thumbnail/` and `/media/` through the same `9011` proxy to the Saleor API, fixing product image optimizer failures caused by `localhost:8000` media URLs.
+- The Saleor storefront container receives an explicit internal media origin so rewritten media URLs resolve inside the Podman network without exposing private API ports to browsers.
+- Validation passed with `cargo fmt --all --check --manifest-path core/Cargo.toml`, `cargo check -p archipelago --manifest-path core/Cargo.toml`, and live checks on `100.114.134.21` for storefront HTML, static assets, GraphQL, media redirects, and optimized product images.
+
 ## v1.7.81-alpha (2026-05-21)
 
 - Saleor storefront installs now use the prebuilt registry image instead of building the Next.js app on-device, avoiding Podman build failures during stack installation.
diff --git a/core/archipelago/src/api/rpc/package/stacks.rs b/core/archipelago/src/api/rpc/package/stacks.rs
index f81ade17..77211240 100644
--- a/core/archipelago/src/api/rpc/package/stacks.rs
+++ b/core/archipelago/src/api/rpc/package/stacks.rs
@@ -581,6 +581,8 @@ fn saleor_storefront_app_command() -> tokio::process::Command {
         "-e",
         "NEXT_PUBLIC_SALEOR_API_URL=http://api:8000/graphql/",
         "-e",
+        "NEXT_PUBLIC_SALEOR_MEDIA_URL=http://api:8000/",
+        "-e",
         "NEXT_PUBLIC_STOREFRONT_URL=http://localhost:9011",
         "-e",
         "NEXT_PUBLIC_DEFAULT_CHANNEL=default-channel",
@@ -2300,6 +2302,7 @@ server {
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Host $host;
     proxy_set_header X-Forwarded-Proto $scheme;
 
     location ^~ /graphql/ {
@@ -2309,6 +2312,20 @@ server {
         proxy_set_header Origin "";
     }
 
+    location ^~ /thumbnail/ {
+        set $saleor_media http://api:8000$request_uri;
+        proxy_pass $saleor_media;
+        proxy_set_header Host api;
+        proxy_set_header Origin "";
+    }
+
+    location ^~ /media/ {
+        set $saleor_media http://api:8000$request_uri;
+        proxy_pass $saleor_media;
+        proxy_set_header Host api;
+        proxy_set_header Origin "";
+    }
+
     location / {
         set $saleor_storefront_app http://storefront-app:3000;
         proxy_pass $saleor_storefront_app;