diff --git a/deploy/sims.hq.conf b/deploy/sims.hq.conf
index 18f935d..b420454 100644
--- a/deploy/sims.hq.conf
+++ b/deploy/sims.hq.conf
@@ -24,7 +24,12 @@ server {
         proxy_pass http://127.0.0.1:5182;
         proxy_set_header Host              $host;
         proxy_set_header X-Real-IP         $remote_addr;
-        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        # REPLACE, do not append (D24 red-team). With the app's `trust proxy 1`, Express
+        # reads the last X-Forwarded-For hop as the client IP. $proxy_add_x_forwarded_for
+        # would append to a CLIENT-SUPPLIED header, letting a caller inject a fake IP and
+        # bypass the per-IP login/reveal rate limiters. $remote_addr is the real socket
+        # peer and cannot be forged, so the app always keys limits on the true client.
+        proxy_set_header X-Forwarded-For   $remote_addr;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 }