diff --git a/ApiCore-Backend/.env.example b/ApiCore-Backend/.env.example
index 7bcdebb..e709316 100644
--- a/ApiCore-Backend/.env.example
+++ b/ApiCore-Backend/.env.example
@@ -21,7 +21,7 @@ FRONTEND_ORIGIN="http://localhost:3000"
 # Reverse-proxy hops in front of the backend whose X-Forwarded-For is
 # trusted (client IP for rate limits and API-key IP allowlists). "1" for the
 # single K8s ingress; a list such as "loopback, 10.0.0.0/8" also works.
-# Behind Cloudflare + Traefik use "loopback, uniquelocal, <Cloudflare ranges>"
+# Behind Cloudflare + Traefik use "loopback, <pod CIDR>, <Cloudflare ranges>"
 # (see deploy/k8s/backend/configmap.example.yaml); "1" would yield the
 # Cloudflare edge IP that many clients share.
 TRUST_PROXY=1
diff --git a/deploy/k8s/backend/configmap.example.yaml b/deploy/k8s/backend/configmap.example.yaml
index b07f266..8c7bf46 100644
--- a/deploy/k8s/backend/configmap.example.yaml
+++ b/deploy/k8s/backend/configmap.example.yaml
@@ -16,11 +16,13 @@ data:
   BACKUP_RETENTION_COUNT: "14"
   COOKIE_SECURE: "true"
   # Client-IP fuer Rate-Limits und IP-Freigaben der API-Schluessel. Vertraut
-  # werden Cluster/LAN (Traefik) und Cloudflare (https://www.cloudflare.com/ips/).
+  # werden nur das Pod-Netz 10.42.0.0/16 (Traefik) und Cloudflare
+  # (https://www.cloudflare.com/ips/), bewusst nicht LAN/uniquelocal: LAN-Clients
+  # sind selbst Absender, ihre X-Forwarded-For-Werte verwirft Traefik.
   # Express nimmt den ersten X-Forwarded-For-Eintrag von rechts, der aus keinem
   # dieser Netze kommt: den Client, den Cloudflare angehaengt hat. Mit "1" waere
   # es die Cloudflare-Edge, die sich viele Clients teilen.
-  TRUST_PROXY: "loopback, uniquelocal, 173.245.48.0/20, 103.21.244.0/22, 103.22.200.0/22, 103.31.4.0/22, 141.101.64.0/18, 108.162.192.0/18, 190.93.240.0/20, 188.114.96.0/20, 197.234.240.0/22, 198.41.128.0/17, 162.158.0.0/15, 104.16.0.0/13, 104.24.0.0/14, 172.64.0.0/13, 131.0.72.0/22, 2400:cb00::/32, 2606:4700::/32, 2803:f800::/32, 2405:b500::/32, 2405:8100::/32, 2a06:98c0::/29, 2c0f:f248::/32"
+  TRUST_PROXY: "loopback, 10.42.0.0/16, 173.245.48.0/20, 103.21.244.0/22, 103.22.200.0/22, 103.31.4.0/22, 141.101.64.0/18, 108.162.192.0/18, 190.93.240.0/20, 188.114.96.0/20, 197.234.240.0/22, 198.41.128.0/17, 162.158.0.0/15, 104.16.0.0/13, 104.24.0.0/14, 172.64.0.0/13, 131.0.72.0/22, 2400:cb00::/32, 2606:4700::/32, 2803:f800::/32, 2405:b500::/32, 2405:8100::/32, 2a06:98c0::/29, 2c0f:f248::/32"
   # Entra ID SSO. Issuer ist die v2.0-Metadaten-URL des Tenants,
   # Redirect-URI muss exakt der im App-Registrierung hinterlegten entsprechen.
   # Ohne diese vier Variablen (siehe secret.example.yaml fuer Client-ID/-Secret)