diff --git a/server/db/mac_models.json b/server/db/mac_models.json
index 6d9b837d5..bb9621995 100644
--- a/server/db/mac_models.json
+++ b/server/db/mac_models.json
@@ -38,6 +38,9 @@
   "Mac16,7": "MacBook Pro",
   "Mac16,8": "MacBook Pro",
   "Mac16,9": "Mac Studio",
+  "Mac17,14": "Mac Studio",
+  "Mac17,15": "Mac Studio",
+  "Mac17,16": "Mac mini",
   "Mac17,2": "MacBook Pro",
   "Mac17,3": "MacBook Air",
   "Mac17,4": "MacBook Air",
@@ -46,6 +49,7 @@
   "Mac17,7": "MacBook Pro",
   "Mac17,8": "MacBook Pro",
   "Mac17,9": "MacBook Pro",
+  "Mac18,5": "Mac mini",
   "MacBook1,1": "MacBook",
   "MacBook10,1": "MacBook",
   "MacBook2,1": "MacBook",
@@ -173,7 +177,7 @@
   "PowerMac12,1": "iMac",
   "PowerMac2,1": "iMac",
   "PowerMac2,2": "iMac",
-  "PowerMac3,1": "Mac Server",
+  "PowerMac3,1": "Power Macintosh",
   "PowerMac3,3": "Power Macintosh",
   "PowerMac3,4": "Power Macintosh",
   "PowerMac3,5": "Power Macintosh",
@@ -232,4 +236,4 @@
   "iMac8,1": "iMac",
   "iMac9,1": "iMac",
   "iMacPro1,1": "iMac Pro"
-}
+}
\ No newline at end of file
diff --git a/server/lib/readConfigFile.ts b/server/lib/readConfigFile.ts
index 6d95fe26a..0d8786f89 100644
--- a/server/lib/readConfigFile.ts
+++ b/server/lib/readConfigFile.ts
@@ -149,6 +149,8 @@ export const configSchema = z
                     })
                     .optional(),
                 trust_proxy: z.int().gte(0).optional().default(1),
+                trust_ips: z.array(z.string()).optional().default([]),
+                custom_ip_header: z.string().optional().default(""),
                 // Opt-in: have Traefik/Badger stamp the resolved client IP
                 // into a dedicated header (X-Pangolin-Client-Ip) on the
                 // site-resource AI gateway route, so it survives an
diff --git a/server/routers/traefik/traefikConfigProvider.ts b/server/routers/traefik/traefikConfigProvider.ts
index 02e05f5e0..9643aa0b1 100644
--- a/server/routers/traefik/traefikConfigProvider.ts
+++ b/server/routers/traefik/traefikConfigProvider.ts
@@ -51,6 +51,10 @@ export async function traefikConfigProvider(
                                         .internal_hostname
                                 }:${config.getRawConfig().server.internal_port}`
                             ).href,
+                        disableDefaultCFIPs: config.getRawConfig().server.trust_ips.length > 0,
+                        customIPHeader: config.getRawConfig().server.custom_ip_header,
+                        trustip: config.getRawConfig().server.trust_ips,
+
                         userSessionCookieName:
                             config.getRawConfig().server.session_cookie_name,