diff --git a/deploy/windows/web.config b/deploy/windows/web.config
index fe712b0..4821797 100644
--- a/deploy/windows/web.config
+++ b/deploy/windows/web.config
@@ -28,7 +28,7 @@
 
     <httpPlatform
         processPath="C:\shopdb-flask\venv\Scripts\waitress-serve.exe"
-        arguments="--port=%HTTP_PLATFORM_PORT% --host=127.0.0.1 --threads=8 wsgi:app"
+        arguments="--port=%HTTP_PLATFORM_PORT% --host=127.0.0.1 --threads=8 --trusted-proxy=127.0.0.1 --trusted-proxy-headers=x-forwarded-for wsgi:app"
         stdoutLogEnabled="true"
         stdoutLogFile="C:\shopdb-flask\logs\httpplatform"
         startupTimeLimit="120"
diff --git a/docs/INSTALL-WINDOWS-IIS.md b/docs/INSTALL-WINDOWS-IIS.md
index f6a4b97..b935d3b 100644
--- a/docs/INSTALL-WINDOWS-IIS.md
+++ b/docs/INSTALL-WINDOWS-IIS.md
@@ -199,6 +199,15 @@ no path), so it is the same for both methods.
 > default**. It needs the URL Rewrite module; with it active but the module
 > absent, IIS returns 500.19. Install URL Rewrite, then uncomment the
 > `<rewrite>` block, to record real client IPs in audit logs.
+>
+> Two companion requirements, or the app keeps seeing 127.0.0.1:
+> `allowedServerVariables` is locked at server level by default (500.52 when
+> the block activates) - unlock once with
+> `appcmd unlock config -section:system.webServer/rewrite/allowedServerVariables`.
+> And waitress 2+ strips X-Forwarded-For from untrusted proxies, so the
+> waitress `arguments` line must carry
+> `--trusted-proxy=127.0.0.1 --trusted-proxy-headers=x-forwarded-for`
+> (the shipped web.config already does).
 
 ---
 
@@ -224,6 +233,8 @@ each gets its own site, app pool, port, and venv.
 | --- | --- |
 | `flask db upgrade` -> error **1071** | MySQL 5.6 without the step-1 flags (or server not restarted). |
 | IIS **500.19** | handler sections not unlocked (step 7.4), or the `<rewrite>` block active without URL Rewrite. |
+| IIS **500.52** after enabling the rewrite block | `allowedServerVariables` locked at server level - `appcmd unlock config -section:system.webServer/rewrite/allowedServerVariables`. |
+| Audit log shows only **127.0.0.1** with the rewrite block active | waitress strips untrusted proxy headers - `--trusted-proxy=127.0.0.1 --trusted-proxy-headers=x-forwarded-for` missing from the waitress `arguments`. |
 | **500** with an empty HttpPlatform log | app-pool identity can't read `APP_ROOT` / run the venv (step 7.3), or `.env` missing/invalid. |
 | "No time zone found with key America/New_York" | `tzdata` not installed (`pip install tzdata`). |
 | Nav missing Equipment/PCs/... | plugins not installed (step 6 `flask plugin install`), or site not recycled. |