diff --git a/server.js b/server.js
index cef946c..b709627 100644
--- a/server.js
+++ b/server.js
@@ -18,6 +18,13 @@ const app = express();
 const PORT = process.env.PORT || 3000;
 const isProd = process.env.NODE_ENV === 'production';
 
+// We sit behind nginx/PM2 in production; trust X-Forwarded-* headers so that
+// req.secure reflects the actual client connection (otherwise secure cookies
+// would never be set and rate-limiting would treat every client as the same IP).
+if (isProd) {
+    app.set('trust proxy', 1);
+}
+
 initDatabase();
 
 // Graceful shutdown