diff --git a/src/server.ts b/src/server.ts
index 9e7aea1..c7acb43 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -83,6 +83,13 @@ const verifyNip98Auth = async (req: Request): Promise<string | null> => {
 
 export const server: express.Application = express()
 
+// Behind a TLS-terminating reverse proxy (traefik in the ansible deploy).
+// Without this, req.protocol stays "http" and verifyNip98Auth builds an
+// expectedUrl of http://…, which no browser client will ever sign (clients
+// sign https://…). Trust one proxy hop so req.protocol honors
+// X-Forwarded-Proto and NIP-98 URL matching works.
+server.set('trust proxy', 1)
+
 // CORS middleware for browser-facing routes only.
 // The browser hits /subscription with an Authorization header and Content-Type:
 // application/json, which triggers a CORS preflight. Answer it and allow the