diff --git a/Dockerfile b/Dockerfile
index 083337b87..3f23ac593 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -35,22 +35,26 @@ ENV NODE_ENV=production
 # Install gosu for dropping privileges safely
 RUN apt-get update && apt-get install -y --no-install-recommends gosu && rm -rf /var/lib/apt/lists/*
 
-# Entrypoint script: fix /data permissions, create Railway config, then drop to node user
+# Entrypoint script: fix /data permissions, ensure trustedProxies config, then drop to node user
 RUN printf '#!/bin/sh\n\
 if [ -d /data ]; then\n\
   chown -R node:node /data 2>/dev/null || true\n\
 fi\n\
-# Create initial config with trustedProxies for Railway/cloud deployments\n\
-if [ -n "$CLAWDBOT_STATE_DIR" ] && [ ! -f "$CLAWDBOT_STATE_DIR/clawdbot.json" ]; then\n\
+# Ensure trustedProxies config exists for Railway/cloud deployments\n\
+if [ -n "$CLAWDBOT_STATE_DIR" ]; then\n\
   mkdir -p "$CLAWDBOT_STATE_DIR"\n\
-  cat > "$CLAWDBOT_STATE_DIR/clawdbot.json" << EOF\n\
+  CONFIG_FILE="$CLAWDBOT_STATE_DIR/clawdbot.json"\n\
+  # If no config or config lacks trustedProxies, create/update it\n\
+  if [ ! -f "$CONFIG_FILE" ] || ! grep -q "trustedProxies" "$CONFIG_FILE" 2>/dev/null; then\n\
+    cat > "$CONFIG_FILE" << EOF\n\
 {\n\
   "gateway": {\n\
     "trustedProxies": ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10"]\n\
   }\n\
 }\n\
 EOF\n\
-  chown node:node "$CLAWDBOT_STATE_DIR/clawdbot.json"\n\
+  fi\n\
+  chown node:node "$CONFIG_FILE" 2>/dev/null || true\n\
 fi\n\
 exec gosu node "$@"\n' > /entrypoint.sh && chmod +x /entrypoint.sh