diff --git a/deploy.nix b/deploy.nix
index d0b6be2..6528e44 100644
--- a/deploy.nix
+++ b/deploy.nix
@@ -17,7 +17,7 @@
 
           # privacy-aware log format
           log_format custom '$remote_addr_anon - - [$time_local] "$request" $status $body_bytes_sent "-" "$http_user_agent"';
-          access_log /var/log/nginx/access.log custom;
+          access_log off;
 
           map $remote_addr $remote_addr_anon {
             ~(?P<ip>\d+\.\d+)\.     $ip.0.0;
@@ -38,6 +38,13 @@
             enableACME = true;
             forceSSL = true;
             root = "/var/www/";
+
+            # only log page views, rss feed access, media file download and embed views
+            extraConfig = ''
+              location ~ index\.html|rss\.xml|\.(opus|m4a|ogg|mp3|\.podlove.json)$ {
+                access_log /var/log/nginx/access.log custom;
+              }
+            '';
           };
 
           "www.${config.deployment.targetHost}" = {