diff --git a/backoffice/app/app.py b/backoffice/app/app.py
index d71a03b..b34598f 100644
--- a/backoffice/app/app.py
+++ b/backoffice/app/app.py
@@ -415,4 +415,12 @@ def index():
 
 
 if __name__ == "__main__":
-    serve(app, host="0.0.0.0", port=8080)
+    # Waitress strips X-Forwarded-* by default unless the proxy is declared
+    # trusted -- without this, ProxyFix upstream never sees them, and every
+    # url_for(_external=True) link (e.g. the owner's ICS feed, #22) silently
+    # falls back to "http". Port 8080 is never published to the host, so the
+    # only thing that can dial us at all is Caddy on the shared `proxy`
+    # Docker network -- trusting "*" here doesn't widen who can reach us.
+    serve(app, host="0.0.0.0", port=8080, trusted_proxy="*",
+          trusted_proxy_headers={"x-forwarded-for", "x-forwarded-proto", "x-forwarded-host"},
+          clear_untrusted=True)