diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 4262fa5..835a437 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -141,6 +141,7 @@ jobs:
               kubectl apply -f k8s/backend-deployment-prod.yaml
               kubectl apply -f k8s/admin-deployment-prod.yaml
               kubectl apply -f k8s/ingress.yaml
+              kubectl apply -f k8s/traefik-config.yaml
 
               # Preserve real client IP
               kubectl patch svc traefik -n kube-system -p '{"spec":{"externalTrafficPolicy":"Local"}}' 2>/dev/null || true
diff --git a/k8s/traefik-config.yaml b/k8s/traefik-config.yaml
new file mode 100644
index 0000000..41cbd35
--- /dev/null
+++ b/k8s/traefik-config.yaml
@@ -0,0 +1,17 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    logs:
+      access:
+        enabled: true
+        format: json
+        fields:
+          headers:
+            defaultmode: keep
+            names:
+              Authorization: drop
+              Cookie: drop