diff --git a/backend/src/middleware/security.js b/backend/src/middleware/security.js
index 8aaf010..64560e0 100644
--- a/backend/src/middleware/security.js
+++ b/backend/src/middleware/security.js
@@ -3,6 +3,9 @@ import helmet from 'helmet';
 import cors from 'cors';
 
 export const setupSecurity = (app) => {
+  // Trust proxy for express-rate-limit behind Kubernetes Ingress
+  app.set('trust proxy', 1);
+
   // Helmet for security headers
   app.use(helmet({
     contentSecurityPolicy: {