diff --git a/Wollmilchsau/Program.cs b/Wollmilchsau/Program.cs
index 3f0f370..00d8a0f 100644
--- a/Wollmilchsau/Program.cs
+++ b/Wollmilchsau/Program.cs
@@ -4,6 +4,7 @@ using Marten;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Authentication.OpenIdConnect;
+using Microsoft.AspNetCore.HttpOverrides;
 using MudBlazor.Services;
 using System.Net.Http.Headers;
 using System.Security.Claims;
@@ -14,6 +15,18 @@ using Wollmilchsau.Services.Ldap;
 
 var builder = WebApplication.CreateBuilder(args);
 
+if (!builder.Environment.IsDevelopment())
+{
+    builder.Services.Configure<ForwardedHeadersOptions>(options =>
+    {
+        // The application is reachable only through the secured reverse-proxy network.
+        options.ForwardedHeaders = ForwardedHeaders.XForwardedProto;
+        options.ForwardLimit = 1;
+        options.KnownIPNetworks.Clear();
+        options.KnownProxies.Clear();
+    });
+}
+
 var oidcConfiguration = builder.Configuration.GetRequiredSection("OIDC");
 var oidcScopes = oidcConfiguration.GetSection("Scopes").Get<string[]>()
     ?? throw new ConfigurationException("OIDC:Scopes");
@@ -125,6 +138,7 @@ var app = builder.Build();
 // Configure the HTTP request pipeline.
 if (!app.Environment.IsDevelopment())
 {
+    app.UseForwardedHeaders();
     app.UseExceptionHandler("/Error", createScopeForErrors: true);
     // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
     app.UseHsts();