diff --git a/daybook_project/settings.py b/daybook_project/settings.py
index 3b396a6..db820ce 100644
--- a/daybook_project/settings.py
+++ b/daybook_project/settings.py
@@ -9,6 +9,12 @@ SECRET_KEY = os.environ.get("DJANGO_SECRET_KEY", "dev-only-change-me")
 DEBUG = os.environ.get("DJANGO_DEBUG", "1").lower() in {"1", "true", "yes", "on"}
 ALLOWED_HOSTS = [host.strip() for host in os.environ.get("DJANGO_ALLOWED_HOSTS", "*").split(",") if host.strip()]
 
+# Needed when running behind a TLS-terminating reverse proxy (Apache/Nginx/etc.):
+# Django otherwise thinks every request is plain HTTP, which breaks CSRF checks
+# on login/POST. The proxy must forward X-Forwarded-Proto: https.
+CSRF_TRUSTED_ORIGINS = [origin.strip() for origin in os.environ.get("DJANGO_CSRF_TRUSTED_ORIGINS", "").split(",") if origin.strip()]
+SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+
 INSTALLED_APPS = [
     "django.contrib.admin",
     "django.contrib.auth",