diff --git a/src/ProostenKrant/Program.cs b/src/ProostenKrant/Program.cs
index 030ef10..946ffa8 100644
--- a/src/ProostenKrant/Program.cs
+++ b/src/ProostenKrant/Program.cs
@@ -1,10 +1,23 @@
 using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.AspNetCore.Mvc;
 
 var builder = WebApplication.CreateBuilder(args);
 
 builder.Configuration.AddEnvironmentVariables();
 
+// De app draait achter een reverse proxy (nginx) die TLS afhandelt en de
+// request als plain http doorgeeft. Zonder deze headers genereert de app
+// http://-redirects, die de enhanced navigation van Blazor breekt (fetch
+// weigert een https->http downgrade).
+builder.Services.Configure<ForwardedHeadersOptions>(options =>
+{
+    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
+    // De proxy komt niet per se vanaf loopback (docker-netwerk of andere host).
+    options.KnownIPNetworks.Clear();
+    options.KnownProxies.Clear();
+});
+
 builder.Services.AddRazorComponents();
 builder.Services.AddCascadingAuthenticationState();
 
@@ -54,6 +67,8 @@ catch (Exception ex)
     Console.WriteLine($"Seed overslaan: {ex.Message}");
 }
 
+app.UseForwardedHeaders();
+
 if (!app.Environment.IsDevelopment())
 {
     app.UseExceptionHandler("/fout", createScopeForErrors: true);