diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 1045c67..0a18178 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -13,7 +13,13 @@
 
 services:
   app:
-    command: ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "80", "--workers", "1"]
+    # --proxy-headers makes Starlette honour X-Forwarded-Proto / -For from
+    # NPM, so request.url_for() generates https:// URLs (otherwise static
+    # asset links render as http://… and browsers block as mixed content).
+    # --forwarded-allow-ips=* is safe here: the container has no host port,
+    # only the intranet bridge reaches it.
+    command: ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "80",
+              "--workers", "1", "--proxy-headers", "--forwarded-allow-ips=*"]
     expose:
       - "80"
     networks: