diff --git a/templates/adventurelog/docker-compose.yml b/templates/adventurelog/docker-compose.yml
index 62991ca..229470e 100644
--- a/templates/adventurelog/docker-compose.yml
+++ b/templates/adventurelog/docker-compose.yml
@@ -64,6 +64,10 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.adventurelog-backend.rule=Host(`${SUBDOMAIN}.${DOMAIN}`) && (PathPrefix(`/media`) || PathPrefix(`/static`) || PathPrefix(`/admin`) || PathPrefix(`/accounts`))"
+      # R-753: this app reads the LEFTMOST X-Forwarded-For entry, which a stranger writes once traefik keeps the
+      # tunnel's chain — so its chain is removed here (it then reads traefik's X-Real-Ip or peer; never forgeable).
+      - "traefik.http.middlewares.adventurelog-backend-xff.headers.customrequestheaders.X-Forwarded-For="
+      - "traefik.http.routers.adventurelog-backend.middlewares=adventurelog-backend-xff"
       - "traefik.http.routers.adventurelog-backend.priority=20"
       - "traefik.http.routers.adventurelog-backend.entrypoints=websecure"
       - "traefik.http.routers.adventurelog-backend.tls=true"
@@ -122,6 +126,10 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.adventurelog.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
+      # R-753: this app reads the LEFTMOST X-Forwarded-For entry, which a stranger writes once traefik keeps the
+      # tunnel's chain — so its chain is removed here (it then reads traefik's X-Real-Ip or peer; never forgeable).
+      - "traefik.http.middlewares.adventurelog-xff.headers.customrequestheaders.X-Forwarded-For="
+      - "traefik.http.routers.adventurelog.middlewares=adventurelog-xff"
       - "traefik.http.routers.adventurelog.priority=10"
       - "traefik.http.routers.adventurelog.entrypoints=websecure"
       - "traefik.http.routers.adventurelog.tls=true"