diff --git a/runbot/models/build.py b/runbot/models/build.py
index cef33625..a3f156f9 100644
--- a/runbot/models/build.py
+++ b/runbot/models/build.py
@@ -925,7 +925,7 @@ class BuildResult(models.Model):
         msg = ''
         try:
             with local_pgadmin_cursor() as local_cr:
-                query = 'SELECT pg_terminate_backend({}) FROM pg_stat_activity WHERE datname=pid'
+                query = 'SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname=%s'
                 local_cr.execute(query, [dbname])
                 local_cr.execute('DROP DATABASE IF EXISTS "%s"' % dbname)
         except Exception as e:
diff --git a/runbot/templates/nginx.xml b/runbot/templates/nginx.xml
index c4044622..c1c43a7e 100644
--- a/runbot/templates/nginx.xml
+++ b/runbot/templates/nginx.xml
@@ -55,6 +55,26 @@ server {
 <t id="root_anchor"/>
 
 <t t-foreach="builds" t-as="build">
+server {
+    listen 8080;
+    server_name ~^<t t-out="re_escape(build.dest)"/>(-[a-z0-9_]+)?-<t t-esc="build._get_run_token()[0]"/>(-[a-z0-9_]+)\.<t t-esc="re_escape(build.host)"/>$;
+    set $host_cleaned <t t-out="build.dest"/>$1.<t t-esc="build.host"/>;
+    proxy_set_header X-Forwarded-Proto $real_scheme;
+    proxy_set_header X-Forwarded-Host $host_cleaned;
+    proxy_set_header Host $host_cleaned;
+    location / { proxy_pass http://127.0.0.1:<t t-esc="build.port"/>; }
+    location /longpolling { proxy_pass http://127.0.0.1:<t t-esc="build.port + 1"/>; }
+    location /websocket {
+      proxy_pass http://127.0.0.1:<t t-esc="build.port + 1"/>;
+      proxy_set_header X-Forwarded-Host $host_cleaned;
+      proxy_set_header X-Forwarded-Proto $real_scheme;
+      proxy_set_header Host $host_cleaned;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "Upgrade";
+    }
+    <t id="build_anchor_authenticated"/>
+}
+
 server {
     listen 8080;
     server_name ~^<t t-out="re_escape(build.dest)"/>(-[a-z0-9_]+)?\.<t t-esc="re_escape(build.host)"/>$;
@@ -70,22 +90,6 @@ server {
     }
     <t id="build_anchor"/>
 }
-
-server {
-    listen 8080;
-    server_name ~^<t t-out="re_escape(build.dest)"/>(-[a-z0-9_]+)?-<t t-esc="build._get_run_token()[0]"/>(-[a-z0-9_]{4})\.<t t-esc="re_escape(build.host)"/>$;
-    location / { proxy_pass http://127.0.0.1:<t t-esc="build.port"/>; }
-    location /longpolling { proxy_pass http://127.0.0.1:<t t-esc="build.port + 1"/>; }
-    location /websocket {
-      proxy_pass http://127.0.0.1:<t t-esc="build.port + 1"/>;
-      proxy_set_header X-Forwarded-Host $host;
-      proxy_set_header X-Forwarded-Proto $real_scheme;
-      proxy_set_header Host $host;
-      proxy_set_header Upgrade $http_upgrade;
-      proxy_set_header Connection "Upgrade";
-    }
-    <t id="build_anchor_authenticated"/>
-}
 </t>
 server {
     listen 8080;