diff --git a/docs/install/docker.md b/docs/install/docker.md
index 9658c3b..e24d835 100644
--- a/docs/install/docker.md
+++ b/docs/install/docker.md
@@ -83,12 +83,27 @@ contains the same public host as `APP_URL`, including its port when one is used.
   - `SANCTUM_STATEFUL_DOMAINS=invoiceshelf.acme.com,invoiceshelf.acme.com:8080`
   - `SANCTUM_STATEFUL_DOMAINS=localhost,localhost:3000,invoiceshelf.acme.com`
 
+#### TRUSTED_PROXIES
+Which upstream proxies may rewrite the client address, host, port and scheme. The default
+`*` trusts every hop, which is what you want for a container behind a reverse proxy you
+control.
+
+If you narrow it, list the address **the container actually sees**, which is normally the
+Docker bridge gateway (`172.x.x.x`) and not your proxy's LAN address. Getting this wrong
+makes InvoiceShelf discard the proxy's `X-Forwarded-Proto` header and fall back to
+generating `http://` links behind an https site, which shows up as a failed sign-in that
+works after a page refresh.
+- **Examples**:
+  - `TRUSTED_PROXIES=*` (default)
+  - `TRUSTED_PROXIES=172.18.0.1`
+
 For example, a reverse-proxied installation at `https://invoices.example.com` uses:
 
 ```yaml
 - APP_URL=https://invoices.example.com
 - SESSION_DOMAIN=invoices.example.com
 - SANCTUM_STATEFUL_DOMAINS=invoices.example.com
+- TRUSTED_PROXIES=*
 ```
 
 Restart the stack after changing these variables.