diff --git a/manifest/overlays/production/keycloak-instance.yaml b/manifest/overlays/production/keycloak-instance.yaml
index 7bacba1..13fe015 100644
--- a/manifest/overlays/production/keycloak-instance.yaml
+++ b/manifest/overlays/production/keycloak-instance.yaml
@@ -42,7 +42,7 @@ spec:
 
   # ── Proxy: trust forwarded headers from Traefik ──────────────────────────
   proxy:
-    headers: forwarded
+    headers: xforwarded
 
   # ── Bootstrap admin credentials (sealed secret — see admin.sealed.secret.yaml)
   bootstrapAdmin: