diff --git a/.env.production.example b/.env.production.example
index 57c84d36..61d9d1ad 100644
--- a/.env.production.example
+++ b/.env.production.example
@@ -14,6 +14,14 @@ APP_LOCALE=en
 APP_FALLBACK_LOCALE=en
 APP_FAKER_LOCALE=en_US
 
+# Trusted Proxies
+# Comma-separated proxy IPs/CIDRs Laravel trusts for X-Forwarded-* headers (no spaces).
+# Required when running behind a reverse proxy (Coolify/Traefik, nginx, Cloudflare):
+# without it the app cannot see the real client IP (rate limiting breaks and becomes
+# spoofable) nor detect HTTPS (redirect loops). The private ranges below cover the
+# Docker network the proxy connects from; leave unset only when there is no proxy.
+TRUSTED_PROXIES=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+
 # Logging
 LOG_CHANNEL=stack
 LOG_STACK=single,sentry_logs
diff --git a/bootstrap/app.php b/bootstrap/app.php
index 404e9296..70c38bce 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -33,7 +33,7 @@ return Application::configure(basePath: dirname(__DIR__))
         $trustedProxies = env('TRUSTED_PROXIES');
 
         $middleware->trustProxies(
-            at: is_string($trustedProxies) ? explode(',', $trustedProxies) : null,
+            at: is_string($trustedProxies) ? array_map('trim', explode(',', $trustedProxies)) : null,
             headers: Request::HEADER_X_FORWARDED_FOR
                 | Request::HEADER_X_FORWARDED_HOST
                 | Request::HEADER_X_FORWARDED_PORT