diff --git a/README.md b/README.md
index 8f0db92..f95f187 100644
--- a/README.md
+++ b/README.md
@@ -53,6 +53,7 @@ docker run -d --name timerr --restart unless-stopped \
   -e DEBUG=0 \
   -e SECRET_KEY='replace-with-a-long-random-secret' \
   -e ALLOWED_HOSTS='your-domain.example' \
+  -e CSRF_TRUSTED_ORIGINS='https://your-domain.example' \
   -e DATABASE_NAME=/app/data/timerr.sqlite3 \
   -v timerr-data:/app/data \
   git.spyk3r.com/spyk3r/timerr:latest
diff --git a/compose.yaml b/compose.yaml
index d69183b..edb0aee 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -7,6 +7,7 @@ services:
       DEBUG: "1"
       SECRET_KEY: "change-me"
       ALLOWED_HOSTS: "localhost,127.0.0.1"
+      CSRF_TRUSTED_ORIGINS: ""
       DATABASE_NAME: "/app/data/timerr.sqlite3"
     volumes:
       - timerr-data:/app/data
diff --git a/config/settings.py b/config/settings.py
index d756b59..1f53cc2 100644
--- a/config/settings.py
+++ b/config/settings.py
@@ -28,6 +28,15 @@ DEBUG = os.getenv("DEBUG", "1") == "1"
 
 ALLOWED_HOSTS = [host for host in os.getenv("ALLOWED_HOSTS", "localhost,127.0.0.1").split(",") if host]
 
+CSRF_TRUSTED_ORIGINS = [
+    origin
+    for origin in os.getenv("CSRF_TRUSTED_ORIGINS", "").split(",")
+    if origin
+]
+
+# Traefik terminates TLS and forwards the original protocol in this header.
+SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+
 
 # Application definition