diff --git a/nextcloud-container.nix b/nextcloud-container.nix
index 196276a..d763911 100644
--- a/nextcloud-container.nix
+++ b/nextcloud-container.nix
@@ -112,6 +112,8 @@ in {
                       overwriteProtocol = "https";
                       extraTrustedDomains = [ "nextcloud.fudo.org" ];
                       defaultPhoneRegion = "CA";
+                      # TODO: is there a way to narrow this?
+                      trustedProxies = [ "10.0.0.0/8" ];
                     };
                   };
                 };