diff --git a/modules/nginx.nix b/modules/nginx.nix
index 03b2934..09c93a5 100644
--- a/modules/nginx.nix
+++ b/modules/nginx.nix
@@ -35,9 +35,12 @@ in
       '';
     })
     (lib.mkIf cfg.privacy.enable {
-      services.nginx.commonHttpConfig = ''
-        access_log off;
-      '';
+      services.nginx = {
+        logError = "stderr crit"; # error (the default severity) logs potential PII (IP addresses) on 404 errors
+        commonHttpConfig = ''
+          access_log off;
+        '';
+      };
     })
     (lib.mkIf cfg.recommended.enable {
       services.nginx = {