diff --git a/src/bootstrap/app.php b/src/bootstrap/app.php
index fe445d7..8896976 100644
--- a/src/bootstrap/app.php
+++ b/src/bootstrap/app.php
@@ -18,6 +18,13 @@ return Application::configure(basePath: dirname(__DIR__))
 
         $middleware->redirectGuestsTo('/login');
         $middleware->redirectUsersTo('/');
+
+        // The app container only ever serves plain HTTP; TLS is terminated by an
+        // upstream reverse proxy/load balancer. Without trusting that proxy,
+        // Laravel ignores its X-Forwarded-Proto header and generates http://
+        // URLs (e.g. via asset()) even when the site is loaded over https://,
+        // which trips browsers' mixed-content blocking (seen on /api/docs).
+        $middleware->trustProxies(at: '*');
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         //