diff --git a/apps/api/config/application.rb b/apps/api/config/application.rb
index e898c47..fe098eb 100644
--- a/apps/api/config/application.rb
+++ b/apps/api/config/application.rb
@@ -24,9 +24,12 @@ module Api
 
     config.action_controller.forgery_protection_origin_check = false
 
+    # nginx → Traefik → Rails proxy chain: trust Docker + loopback ranges
+    # so request.remote_ip reads the real client IP from X-Forwarded-For
     config.action_dispatch.trusted_proxies = ActionDispatch::RemoteIp::TRUSTED_PROXIES + [
       IPAddr.new("172.16.0.0/12"),
-      IPAddr.new("10.0.0.0/8")
+      IPAddr.new("10.0.0.0/8"),
+      IPAddr.new("192.168.0.0/16")
     ]
 
     config.autoload_lib(ignore: %w[assets tasks])