diff --git a/templates/zipline/docker-compose.yml b/templates/zipline/docker-compose.yml
index 2a48bcc..7a81c84 100644
--- a/templates/zipline/docker-compose.yml
+++ b/templates/zipline/docker-compose.yml
@@ -19,6 +19,12 @@ services:
     environment:
       - TZ=Europe/Budapest
       - CORE_SECRET=${CORE_SECRET}
+      # R-776 (R-753, controller >= 0.286.0): Fastify's trustProxy with a CIDR list walks X-Forwarded-For from the RIGHT,
+      # skipping the docker networks — so the login limiter (7 / 10 s per address) keys on each VISITOR, not on traefik's
+      # one address for everybody. Never trustProxy=true without the list (that is the leftmost, client-written entry).
+      # 9202 re-measure owed (checklist 3.6).
+      - CORE_TRUST_PROXY=true
+      - CORE_TRUSTED_PROXIES=172.16.0.0/12
       # FIGYELEM: a v4 óta a DB változó neve DATABASE_URL (prefix NÉLKÜL), míg a
       # CORE_SECRET megtartotta a prefixet. A régi CORE_DATABASE_URL nevet a v4
       # már nem ismeri fel, és indulás nélkül kilép: