diff --git a/config/prod.exs b/config/prod.exs
index 8838cb49..25473f71 100644
--- a/config/prod.exs
+++ b/config/prod.exs
@@ -10,15 +10,9 @@ config :logger, level: :info
 # before starting your production server.
 config :microwaveprop, MicrowavepropWeb.Endpoint, cache_static_manifest: "priv/static/cache_manifest.json"
 
-# Force using SSL in production. This also sets the "strict-security-transport" header,
-# known as HSTS. If you have a health check endpoint, you may want to exclude it below.
-# Note `:force_ssl` is required to be set at compile-time.
-config :microwaveprop, MicrowavepropWeb.Endpoint,
-  force_ssl: [rewrite_on: [:x_forwarded_proto]],
-  exclude: [
-    # paths: ["/health"],
-    hosts: ["localhost", "127.0.0.1"]
-  ]
+# SSL terminated by Cloudflare tunnel — no force_ssl needed.
+# config :microwaveprop, MicrowavepropWeb.Endpoint,
+#   force_ssl: [rewrite_on: [:x_forwarded_proto]]
 
 # Configure Swoosh API Client
 config :swoosh, api_client: Swoosh.ApiClient.Req
diff --git a/config/runtime.exs b/config/runtime.exs
index 315284d8..45b20da5 100644
--- a/config/runtime.exs
+++ b/config/runtime.exs
@@ -55,6 +55,7 @@ if config_env() == :prod do
     socket_options: maybe_ipv6
 
   config :microwaveprop, MicrowavepropWeb.Endpoint,
+    # SSL terminated by Cloudflare tunnel; generated URLs still use https
     url: [host: host, port: 443, scheme: "https"],
     http: [
       # Enable IPv6 and bind on all interfaces.