diff --git a/roles/nginx/defaults/main.yml b/roles/nginx/defaults/main.yml
index 029c09f..0ca35bd 100644
--- a/roles/nginx/defaults/main.yml
+++ b/roles/nginx/defaults/main.yml
@@ -16,10 +16,6 @@ nginx_ssl_buffer_size: 1400
 nginx_ssl_dhparam: /etc/ssl/certs/dhparam.pem
 nginx_ssl_protocols: 'TLSv1 TLSv1.1 TLSv1.2'
 
-# Enable HTTP Strict Transport Security?
-# True on production, False on development!
-nginx_enable_hsts: True
-
 # TLS key directory
 tls_key_dir: /etc/ssl/private
 
diff --git a/roles/nginx/templates/https.j2 b/roles/nginx/templates/https.j2
index a04889c..4f47ef3 100644
--- a/roles/nginx/templates/https.j2
+++ b/roles/nginx/templates/https.j2
@@ -1,4 +1,6 @@
 {% set domain_name      = item.nginx_domain_name %}
+{# assume HSTS is off unless a vhost explicitly sets it to "yes" #}
+{% set enable_hsts      = item.nginx_enable_hsts | default("no") %}
 
     # concatenated key + cert
     # See: http://nginx.org/en/docs/http/configuring_https_servers.html
@@ -28,7 +30,7 @@
     # of such infrastructure, consider turning off session tickets:
     ssl_session_tickets off;
 
-    {% if nginx_enable_hsts == True %}
+    {% if enable_hsts == "yes" %}
     # Enable this if you want HSTS (recommended, but be careful)
     # Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store
     # See: https://hstspreload.appspot.com/