diff --git a/chart/templates/deployment.yaml b/chart/templates/deployment.yaml
index b7880e3..9e9f2ed 100644
--- a/chart/templates/deployment.yaml
+++ b/chart/templates/deployment.yaml
@@ -27,6 +27,10 @@ spec:
           envFrom:
             - secretRef:
                 name: {{ .Values.config.existingSecret }}
+{{- with .Values.controller.extraEnv }}
+          env:
+            {{- toYaml . | nindent 12 }}
+{{- end }}
 {{- else }}
           # Use hardcoded plaintext values (less secure)
           env:
@@ -40,4 +44,7 @@ spec:
               value: {{ .Values.config.CLEAN_DB_PORT }}
             - name: CLEAN_DB_NAME
               value: {{ .Values.config.CLEAN_DB_NAME }}
+{{- with .Values.controller.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+{{- end }}
 {{- end }}
diff --git a/chart/values.mmli2.yaml b/chart/values.mmli2.yaml
index 80d20a1..c5f1236 100644
--- a/chart/values.mmli2.yaml
+++ b/chart/values.mmli2.yaml
@@ -29,6 +29,15 @@ controller:
     pullPolicy: Always
     #pullSecrets: []
 
+  # Additional environment variables for the container, as a list of {name, value}
+  extraEnv:
+    # Trust X-Forwarded-* from the ingress so generated URLs use https and logs show client
+    # addresses. 10.42.0.0/16 is this cluster's pod network, so every pod in the cluster is
+    # trusted, not only Traefik; outside clients can't spoof their address. Not "*", which
+    # would log the first X-Forwarded-For entry, one an outside client can set.
+    - name: FORWARDED_ALLOW_IPS
+      value: "10.42.0.0/16"
+
   # TODO: parameterize labels, tolerations, nodeSelector, resources, etc?
 
 
diff --git a/chart/values.yaml b/chart/values.yaml
index fb1d28c..5d0d17b 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -29,6 +29,9 @@ controller:
     pullPolicy: Always
     #pullSecrets: []
 
+  # Additional environment variables for the container, as a list of {name, value}
+  extraEnv: []
+
   # TODO: parameterize labels, tolerations, nodeSelector, resources, etc?