diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index e8b2e76..4cd6ee1 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -76,6 +76,9 @@ services:
       # Main router (via Cloudflare tunnel → port 80)
       - "traefik.http.routers.rfiles.rule=Host(`rfiles.online`) || Host(`www.rfiles.online`) || HostRegexp(`{subdomain:[a-z0-9-]+}.rfiles.online`)"
       - "traefik.http.routers.rfiles.entrypoints=web"
+      # Pass X-Forwarded-Proto so Django CSRF works behind Cloudflare tunnel
+      - "traefik.http.middlewares.rfiles-headers.headers.customrequestheaders.X-Forwarded-Proto=https"
+      - "traefik.http.routers.rfiles.middlewares=rfiles-headers"
       # Direct upload router (bypasses Cloudflare, TLS via Let's Encrypt)
       - "traefik.http.routers.rfiles-direct.rule=Host(`direct.rfiles.online`)"
       - "traefik.http.routers.rfiles-direct.entrypoints=websecure"