diff --git a/server/lib/readConfigFile.ts b/server/lib/readConfigFile.ts
index 6d95fe26a..0d8786f89 100644
--- a/server/lib/readConfigFile.ts
+++ b/server/lib/readConfigFile.ts
@@ -149,6 +149,8 @@ export const configSchema = z
                     })
                     .optional(),
                 trust_proxy: z.int().gte(0).optional().default(1),
+                trust_ips: z.array(z.string()).optional().default([]),
+                custom_ip_header: z.string().optional().default(""),
                 // Opt-in: have Traefik/Badger stamp the resolved client IP
                 // into a dedicated header (X-Pangolin-Client-Ip) on the
                 // site-resource AI gateway route, so it survives an
diff --git a/server/routers/traefik/traefikConfigProvider.ts b/server/routers/traefik/traefikConfigProvider.ts
index 02e05f5e0..9643aa0b1 100644
--- a/server/routers/traefik/traefikConfigProvider.ts
+++ b/server/routers/traefik/traefikConfigProvider.ts
@@ -51,6 +51,10 @@ export async function traefikConfigProvider(
                                         .internal_hostname
                                 }:${config.getRawConfig().server.internal_port}`
                             ).href,
+                        disableDefaultCFIPs: config.getRawConfig().server.trust_ips.length > 0,
+                        customIPHeader: config.getRawConfig().server.custom_ip_header,
+                        trustip: config.getRawConfig().server.trust_ips,
+
                         userSessionCookieName:
                             config.getRawConfig().server.session_cookie_name,