diff --git a/lib/microwaveprop_web/plugs/remote_ip.ex b/lib/microwaveprop_web/plugs/remote_ip.ex
index 9cdef76e..bfa4fabd 100644
--- a/lib/microwaveprop_web/plugs/remote_ip.ex
+++ b/lib/microwaveprop_web/plugs/remote_ip.ex
@@ -10,19 +10,26 @@ defmodule MicrowavepropWeb.Plugs.RemoteIp do
   def init(opts), do: opts
 
   @impl true
+  # Cloudflare sets Cf-Connecting-Ip with the real client IP.
+  # Fall back to X-Forwarded-For for non-tunneled requests (dev, direct).
+  @ip_headers ["cf-connecting-ip", "x-forwarded-for"]
+
   def call(conn, _opts) do
     ip =
-      case Plug.Conn.get_req_header(conn, "x-forwarded-for") do
-        [forwarded | _] ->
-          forwarded
-          |> String.split(",")
-          |> hd()
-          |> String.trim()
-          |> parse_ip()
+      @ip_headers
+      |> Enum.find_value(fn header ->
+        case Plug.Conn.get_req_header(conn, header) do
+          [value | _] ->
+            value
+            |> String.split(",")
+            |> hd()
+            |> String.trim()
+            |> parse_ip()
 
-        _ ->
-          nil
-      end
+          _ ->
+            nil
+        end
+      end)
 
     conn =
       if ip do