diff --git a/changelog.d/20391.doc b/changelog.d/20391.doc
new file mode 100644
index 0000000000..f47209ea33
--- /dev/null
+++ b/changelog.d/20391.doc
@@ -0,0 +1 @@
+Remove `$server_port` from the `Host` header in the nginx reverse proxy example, as it can cause an SSO redirect loop.
diff --git a/docs/reverse_proxy.md b/docs/reverse_proxy.md
index fc38c06335..26b96f34b2 100644
--- a/docs/reverse_proxy.md
+++ b/docs/reverse_proxy.md
@@ -76,7 +76,9 @@ server {
         proxy_pass http://localhost:8008;
         proxy_set_header X-Forwarded-For $remote_addr;
         proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Host $host:$server_port;
+        # If clients reach Synapse on a non-default port, use `$http_host` instead
+        # so the port is kept, and include that port in `public_baseurl`.
+        proxy_set_header Host $host;
 
         # Nginx by default only allows file uploads up to 1M in size
         # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml