diff --git a/chart/templates/deployment.yaml b/chart/templates/deployment.yaml
index 7f3014d..9e41384 100644
--- a/chart/templates/deployment.yaml
+++ b/chart/templates/deployment.yaml
@@ -31,6 +31,10 @@ spec:
           envFrom:
             - secretRef:
                 name: {{ .Values.config.existingSecret }}
+{{- with .Values.controller.extraEnv }}
+          env:
+            {{- toYaml . | nindent 12 }}
+{{- end }}
 {{- else }}
           # Use hardcoded plaintext values (less secure)
           env:
@@ -44,4 +48,7 @@ spec:
               value: {{ .Values.config.OED_DB_PORT }}
             - name: OED_DB_NAME
               value: {{ .Values.config.OED_DB_NAME }}
+{{- with .Values.controller.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+{{- end }}
 {{- end }}
diff --git a/chart/values.yaml b/chart/values.yaml
index 37c0603..4c50cb4 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -38,6 +38,15 @@ controller:
     limits:
       memory: 1Gi
 
+  # Additional environment variables for the container, as a list of {name, value}
+  extraEnv:
+    # Trust X-Forwarded-* from the ingress so generated URLs use https and logs show client
+    # addresses. 10.42.0.0/16 is this cluster's pod network, so every pod in the cluster is
+    # trusted, not only Traefik; outside clients can't spoof their address. Not "*", which
+    # would log the first X-Forwarded-For entry, one an outside client can set.
+    - name: FORWARDED_ALLOW_IPS
+      value: "10.42.0.0/16"
+
   # TODO: parameterize labels, tolerations, nodeSelector, etc?