diff --git a/apps/api/app/controllers/application_controller.rb b/apps/api/app/controllers/application_controller.rb
index 0491b0a..1c07694 100644
--- a/apps/api/app/controllers/application_controller.rb
+++ b/apps/api/app/controllers/application_controller.rb
@@ -1,3 +1,3 @@
 class ApplicationController < ActionController::Base
-  protect_from_forgery with: :null_session
+  protect_from_forgery with: :exception
 end
diff --git a/apps/api/config/application.rb b/apps/api/config/application.rb
index 46313da..0eee024 100644
--- a/apps/api/config/application.rb
+++ b/apps/api/config/application.rb
@@ -22,6 +22,12 @@ module Api
     config.hosts << ENV["WEBAPP_TECHNICAL_DOMAIN"] if ENV["WEBAPP_TECHNICAL_DOMAIN"].present?
     config.hosts << "teletypegames.org"
 
+    # Trust Traefik and other Docker-internal proxies so Rails correctly reads
+    # X-Forwarded-Proto: https — required for CSRF origin check behind SSL termination
+    config.action_dispatch.trusted_proxies =
+      ActionDispatch::RemoteIp::TRUSTED_PROXIES +
+      [IPAddr.new("172.16.0.0/12"), IPAddr.new("10.0.0.0/8"), IPAddr.new("192.168.0.0/16")]
+
     config.autoload_lib(ignore: %w[assets tasks])
   end
 end