diff --git a/templates/kimai/docker-compose.yml b/templates/kimai/docker-compose.yml
index 8ddafb4..e8a5ac5 100644
--- a/templates/kimai/docker-compose.yml
+++ b/templates/kimai/docker-compose.yml
@@ -22,6 +22,11 @@ services:
       - DATABASE_URL=mysql://kimai:${DB_PASSWORD}@kimai-db:3306/kimai?charset=utf8mb4&serverVersion=11.6.2-MariaDB
       - ADMINMAIL=${ADMIN_EMAIL:-admin@example.com}
       - ADMINPASS=${ADMIN_PASSWORD}
+      # R-776 (R-753, controller >= 0.286.0): trust the docker networks as proxies (the image default is
+      # nginx,localhost,127.0.0.1, so traefik was not trusted and every login/reset limiter keyed on traefik's one address
+      # — a stranger's tries throttled the household too). Symfony then walks X-Forwarded-For from the RIGHT: the tunnel's
+      # real visitor, or the LAN client. The bookstack shape (APP_PROXIES); 9202 re-measure owed (checklist 3.6).
+      - TRUSTED_PROXIES=127.0.0.1,172.16.0.0/12
     volumes:
       - kimai_var:/opt/kimai/var
     networks: