diff --git a/src/main.ts b/src/main.ts
index 7b0b373..6cf8076 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -25,6 +25,16 @@ async function bootstrap() {
     rawBody: true, // Required for Stripe webhook signature verification
   });
 
+  // ─── Trust the reverse proxy / load balancer in front of this app ─────────
+  // Without this, Express's req.ip (and therefore per-IP rate limiting) sees
+  // the proxy's own connecting IP for every request instead of the real
+  // client IP, so every user behind the same proxy shares one rate-limit
+  // bucket. Only relevant in production, where a proxy is expected; in local
+  // dev the app is hit directly.
+  if (isProduction) {
+    app.getHttpAdapter().getInstance().set("trust proxy", 1);
+  }
+
   // ─── Security headers ─────────────────────────────────────────────────────
   const scriptSrc = isProduction ? ["'self'"] : ["'self'", "'unsafe-inline'"];
   const styleSrc = isProduction ? ["'self'"] : ["'self'", "'unsafe-inline'"];