diff --git a/backend/Dockerfile b/backend/Dockerfile
index a278604..60f2692 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -22,5 +22,8 @@ USER appuser
 # Expose port
 EXPOSE 8000
 
-# Run migrations and start server (--no-server-header suppresses uvicorn version disclosure)
-CMD ["sh", "-c", "alembic upgrade head && uvicorn app.main:app --host 0.0.0.0 --port 8000 --no-server-header"]
+# Run migrations and start server
+# --no-server-header: suppresses uvicorn version disclosure
+# --proxy-headers: reads X-Forwarded-Proto/For from reverse proxy so redirects use correct scheme
+# --forwarded-allow-ips '*': trusts proxy headers from any IP (nginx is on Docker bridge network)
+CMD ["sh", "-c", "alembic upgrade head && uvicorn app.main:app --host 0.0.0.0 --port 8000 --no-server-header --proxy-headers --forwarded-allow-ips '*'"]