diff --git a/Caddyfile b/Caddyfile
index f3aaeb1..b3d2a17 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -11,10 +11,38 @@
 #   docker exec caddy_cf caddy reload --config /etc/caddy/Caddyfile
 # or restart the container.
 {
-	# Trust Cloudflare so real visitor IPs (Cf-Connecting-Ip / X-Forwarded-For)
-	# are used for logging and remote_ip matchers instead of the CF edge IP.
+	# Trust only Cloudflare's edge IPs so real visitor IPs (Cf-Connecting-Ip /
+	# X-Forwarded-For) are honoured only when the request actually comes from
+	# Cloudflare. This prevents header spoofing from any other source.
+	#
+	# Ranges from https://www.cloudflare.com/ips-v4/ and /ips-v6/ .
+	# Keep in sync when Cloudflare updates them (rarely). If you rebuild
+	# caddy-cf with the caddy-dynamic-cloudflare / caddy-cloudflare-ip plugin,
+	# this static list can be replaced with `trusted_proxies cloudflare`.
 	servers {
-		trusted_proxies static private_ranges
+		trusted_proxies static \
+ 173.245.48.0/20 \
+ 103.21.244.0/22 \
+ 103.22.200.0/22 \
+ 103.31.4.0/22 \
+ 141.101.64.0/18 \
+ 108.162.192.0/18 \
+ 190.93.240.0/20 \
+ 188.114.96.0/20 \
+ 197.234.240.0/22 \
+ 198.41.128.0/17 \
+ 162.158.0.0/15 \
+ 104.16.0.0/13 \
+ 104.24.0.0/14 \
+ 172.64.0.0/13 \
+ 131.0.72.0/22 \
+ 2400:cb00::/32 \
+ 2606:4700::/32 \
+ 2803:f800::/32 \
+ 2405:b500::/32 \
+ 2405:8100::/32 \
+ 2a06:98c0::/29 \
+ 2c0f:f248::/32
 		client_ip_headers Cf-Connecting-Ip X-Forwarded-For
 	}
 }