diff --git a/templates/vikunja/docker-compose.yml b/templates/vikunja/docker-compose.yml
index 5b1f8f7..9d2f329 100644
--- a/templates/vikunja/docker-compose.yml
+++ b/templates/vikunja/docker-compose.yml
@@ -19,6 +19,11 @@ services:
       - TZ=Europe/Budapest
       - VIKUNJA_SERVICE_PUBLICURL=https://${SUBDOMAIN}.${DOMAIN}
       - VIKUNJA_SERVICE_JWTSECRET=${VIKUNJA_SERVICE_JWTSECRET}
+      # R-776 (R-753, controller >= 0.286.0): the default `direct` reads the TCP peer (traefik) — one address for every
+      # visitor, so a stranger trips the login floor (10/min per address) for the household. `xff` walks X-Forwarded-For
+      # from the RIGHT skipping private addresses (echo's default trust): the tunnel's real visitor, or the LAN client.
+      # 9202 re-measure owed (checklist 3.6).
+      - VIKUNJA_SERVICE_IPEXTRACTIONMETHOD=xff
     volumes:
       - vikunja_data:/app/vikunja/files
       - vikunja_db:/db