diff --git a/filebrowser_quantum/CHANGELOG.md b/filebrowser_quantum/CHANGELOG.md
index 0cd16b62b1..34f740bd0e 100644
--- a/filebrowser_quantum/CHANGELOG.md
+++ b/filebrowser_quantum/CHANGELOG.md
@@ -11,6 +11,7 @@
   - Users, shares and settings in `/config/database.db` are migrated to `/config/database.sqlite` on first start.
 - `http.trustProxyHeaders` is set to `true`, because the add-on always runs behind nginx on a subpath.
 - The container healthcheck now uses upstream's `/health` endpoint.
+- Direct access on port 8071 no longer passes on a client-supplied `X-Forwarded-For`, so the IP-based login lockout cannot be bypassed now that proxy headers are trusted. Ingress keeps the forwarded chain.
 
 ## 2.0.0 (2026-10-10)
 - Update to latest version from gtsteffaniak/filebrowser (changelog : https://github.com/gtsteffaniak/filebrowser/releases)
diff --git a/filebrowser_quantum/rootfs/etc/cont-init.d/99-run.sh b/filebrowser_quantum/rootfs/etc/cont-init.d/99-run.sh
index 48405bae53..c1e099dcc1 100755
--- a/filebrowser_quantum/rootfs/etc/cont-init.d/99-run.sh
+++ b/filebrowser_quantum/rootfs/etc/cont-init.d/99-run.sh
@@ -87,7 +87,7 @@ if [ -f "$FILEBROWSER_CONFIG" ] && [ "$(yq e '.server.database | tag' "$FILEBROW
     cp "$FILEBROWSER_CONFIG" "${FILEBROWSER_CONFIG}.v1.bak"
     yq e -i '
         .http *= (.server | pick(["socket", "tlsCert", "tlsKey", "externalUrl", "internalUrl", "disableWebDAV"])) |
-        del(.server.port, .server.listen, .server.baseURL, .server.socket, .server.tlsCert, .server.tlsKey, .server.externalUrl, .server.internalUrl, .server.disableWebDAV) |
+        del(.server.database, .server.port, .server.listen, .server.baseURL, .server.socket, .server.tlsCert, .server.tlsKey, .server.externalUrl, .server.internalUrl, .server.disableWebDAV) |
         del(.http.trustedHeaders, .integrations.media.exiftoolPath, .userDefaults) |
         del(.server.sources[].config.conditionals, .server.sources[].config.indexingIntervalMinutes) |
         del(.server.sources[].config.rules[].fileNames, .server.sources[].config.rules[].folderNames)
@@ -106,8 +106,7 @@ bashio::log.info "... set server"
 yq e -i ".http.port = 8080"              "$FILEBROWSER_CONFIG"
 yq e -i ".http.listen = \"0.0.0.0\""    "$FILEBROWSER_CONFIG"
 yq e -i ".http.trustProxyHeaders = true" "$FILEBROWSER_CONFIG"
-# Whole-object assignment also drops migrateFrom once the migration is done
-yq e -i ".server.database = {\"path\": \"/config/database.sqlite\"}" "$FILEBROWSER_CONFIG"
+yq e -i ".server.database.path = \"/config/database.sqlite\" | del(.server.database.migrateFrom)" "$FILEBROWSER_CONFIG"
 # Import the 1.x BoltDB until the SQLite database exists
 if [ -s /config/database.db ] && [ ! -s /config/database.sqlite ]; then
     yq e -i ".server.database.migrateFrom = \"/config/database.db\"" "$FILEBROWSER_CONFIG"
diff --git a/filebrowser_quantum/rootfs/etc/nginx/includes/proxy_params.conf b/filebrowser_quantum/rootfs/etc/nginx/includes/proxy_params.conf
index 924ba949e5..521c597beb 100644
--- a/filebrowser_quantum/rootfs/etc/nginx/includes/proxy_params.conf
+++ b/filebrowser_quantum/rootfs/etc/nginx/includes/proxy_params.conf
@@ -10,7 +10,7 @@ proxy_set_header Accept-Encoding "";
 proxy_set_header Connection $connection_upgrade;
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Host $http_host;
-proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-For $fb_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
 proxy_set_header X-NginX-Proxy true;
 proxy_set_header X-Real-IP $remote_addr; 
diff --git a/filebrowser_quantum/rootfs/etc/nginx/servers/direct.conf b/filebrowser_quantum/rootfs/etc/nginx/servers/direct.conf
index d10b7c9c76..342347187e 100644
--- a/filebrowser_quantum/rootfs/etc/nginx/servers/direct.conf
+++ b/filebrowser_quantum/rootfs/etc/nginx/servers/direct.conf
@@ -1,3 +1,11 @@
+# FileBrowser trusts X-Forwarded-For (http.trustProxyHeaders) for login rate
+# limits: keep the chain from the Supervisor ingress proxy, but replace
+# whatever a client sends straight to the published port
+map $server_port $fb_forwarded_for {
+    8072    $remote_addr;
+    default $proxy_add_x_forwarded_for;
+}
+
 server {
     listen 0.0.0.0:8072 default_server;