diff --git a/src/aegis_gitea_mcp/setup_template.py b/src/aegis_gitea_mcp/setup_template.py
index 20d19ad..1bd66fa 100644
--- a/src/aegis_gitea_mcp/setup_template.py
+++ b/src/aegis_gitea_mcp/setup_template.py
@@ -31,6 +31,11 @@ MCP_BEARER_TOKEN=
 PUBLIC_BASE_URL=
 # Extra Host header values accepted behind a reverse proxy (comma separated).
 ALLOWED_HOSTS=
+# Proxy addresses whose X-Forwarded-For is trusted (comma separated IPs or
+# networks). The default only trusts a proxy on this host. Behind a Docker proxy
+# on another address list that address; use * only if the port is reachable
+# solely from the proxy.
+FORWARDED_ALLOW_IPS=127.0.0.1
 
 # --- Per-user OAuth (HTTP only) -----------------------------------------------
 OAUTH_ENABLED=false