diff --git a/deploy/ansible/roles/app/templates/haproxy.cfg.j2 b/deploy/ansible/roles/app/templates/haproxy.cfg.j2
index 4ab3a20..cea93df 100644
--- a/deploy/ansible/roles/app/templates/haproxy.cfg.j2
+++ b/deploy/ansible/roles/app/templates/haproxy.cfg.j2
@@ -16,7 +16,7 @@ defaults
     log     global
     mode    http
     option  httplog
-    option  dontlognormal
+    option  dontlog-normal
     option  http-keep-alive
     maxconn 10000
     timeout connect 5s
@@ -36,8 +36,7 @@ frontend https_in
     # Access to port 443 is already restricted to Cloudflare IPs at the firewall level
     # All requests reaching HAProxy come from Cloudflare; no additional ACL validation is required.
 
-    # HAProxy's own forwardfor must be disabled, otherwise it will insert Cloudflare node IPs
-    no option forwardfor
+    # HAProxy's own forwardfor is not enabled; real IP is set explicitly below via CF-Connecting-IP
 
     # Overwrite standard headers directly with the real IP forcibly added by Cloudflare
     http-request set-header X-Forwarded-For %[req.hdr(CF-Connecting-IP)]