diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml
index 7011f86..65fa28e 100644
--- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml
+++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml
@@ -172,6 +172,13 @@
 
               ProxyPreserveHost On
 
+              # Required: without this, mod_proxy refuses to initiate TLS to
+              # the backend at all (AH01961/AH00961 "failed to enable ssl
+              # support"), even though SSLEngine on above enables TLS for the
+              # *client-facing* side of the connection. SSLEngine on does not
+              # imply SSLProxyEngine on - they control opposite directions.
+              SSLProxyEngine On
+
               # cert is issued for collaboraonline.example.com and we proxy to localhost
               SSLProxyVerify None
               SSLProxyCheckPeerCN Off