diff --git a/app/api/auth/route.ts b/app/api/auth/route.ts
index dc7d20d..6202d96 100644
--- a/app/api/auth/route.ts
+++ b/app/api/auth/route.ts
@@ -12,9 +12,10 @@ const AUTH_RPM = 10;
 
 export async function POST(request: NextRequest) {
   // ── Rate limiting (brute-force protection) ──────────
-  // Security: Prioritize request.ip and x-real-ip to prevent x-forwarded-for spoofing
+  // Security: Prioritize x-real-ip (set by trusted reverse proxies like nginx/Traefik)
+  // over x-forwarded-for which can be spoofed by clients.
+  // Note: request.ip was removed in Next.js 15+.
   const ip =
-    request.ip ??
     request.headers.get('x-real-ip') ??
     request.headers.get('x-forwarded-for')?.split(',')[0].trim() ??
     'unknown';
diff --git a/app/api/image/[id]/route.ts b/app/api/image/[id]/route.ts
index a5daac8..ae60889 100644
--- a/app/api/image/[id]/route.ts
+++ b/app/api/image/[id]/route.ts
@@ -26,9 +26,10 @@ function widthToSize(w: number): ImageSize {
 
 export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
   // ── Rate limiting ──────────────────────────────────
-  // Security: Prioritize request.ip and x-real-ip to prevent x-forwarded-for spoofing
+  // Security: Prioritize x-real-ip (set by trusted reverse proxies like nginx/Traefik)
+  // over x-forwarded-for which can be spoofed by clients.
+  // Note: request.ip was removed in Next.js 15+.
   const ip =
-    request.ip ??
     request.headers.get('x-real-ip') ??
     request.headers.get('x-forwarded-for')?.split(',')[0].trim() ??
     'unknown';