diff --git a/bootstrap/app.php b/bootstrap/app.php
index 8cf08d4..c0b4954 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -4,6 +4,7 @@ use App\Http\Middleware\EnsureHouseholdSelected;
 use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Configuration\Exceptions;
 use Illuminate\Foundation\Configuration\Middleware;
+use Illuminate\Http\Request;
 
 return Application::configure(basePath: dirname(__DIR__))
     ->withRouting(
@@ -15,6 +16,20 @@ return Application::configure(basePath: dirname(__DIR__))
         $middleware->alias([
             'household' => EnsureHouseholdSelected::class,
         ]);
+
+        // Behind a reverse proxy (nginx/Caddy) terminating TLS, Laravel only
+        // sees the internal HTTP hop unless it trusts X-Forwarded-* headers —
+        // otherwise every generated URL (including @vite asset URLs) comes
+        // back as http:// and gets blocked as mixed content on an https:// page.
+        $trustedProxies = env('TRUSTED_PROXIES', '*');
+
+        $middleware->trustProxies(
+            at: $trustedProxies === '*' ? '*' : array_filter(explode(',', (string) $trustedProxies)),
+            headers: Request::HEADER_X_FORWARDED_FOR
+                | Request::HEADER_X_FORWARDED_HOST
+                | Request::HEADER_X_FORWARDED_PORT
+                | Request::HEADER_X_FORWARDED_PROTO,
+        );
     })
     ->withExceptions(function (Exceptions $exceptions) {
         //