diff --git a/README.md b/README.md
index 38abb37cb..76e5fe4a0 100644
--- a/README.md
+++ b/README.md
@@ -474,6 +474,7 @@ present.
 # Public origins accepted for CSRF when a reverse proxy serves Codex under
 # another scheme or host than Codex sees (e.g. https in front of http).
 # First make sure the proxy sends X-Forwarded-Proto and X-Forwarded-Host.
+# A correctly configured proxy does, and then you shouldn't need this.
 # csrf_trusted_origins = ["https://comics.example.com"]
 
 # [logging]
@@ -709,8 +710,9 @@ above is what keeps the static assets reachable.
 If logging in or saving changes fails with a 403 "CSRF Failed" error behind a
 reverse proxy, first make sure the proxy sends `X-Forwarded-Proto` and
 `X-Forwarded-Host` (the nginx example above does). Codex compares them with the
-browser's `Origin` header. Only if the proxy can't send them, or the error
-persists, add the public origin the browser uses to `config/codex.toml`:
+browser's `Origin` header, so a correctly configured proxy ordinarily needs no
+CSRF setting at all. Only if the proxy can't send them, or the error persists,
+add the public origin the browser uses to `config/codex.toml`:
 
 ```toml
 [server]
diff --git a/codex/settings/codex.toml.default b/codex/settings/codex.toml.default
index 6eb7c0c3b..a7bedd7a1 100644
--- a/codex/settings/codex.toml.default
+++ b/codex/settings/codex.toml.default
@@ -18,6 +18,7 @@
 # Public origins accepted for CSRF when a reverse proxy serves Codex under
 # another scheme or host than Codex sees (e.g. https in front of http).
 # First make sure the proxy sends X-Forwarded-Proto and X-Forwarded-Host.
+# A correctly configured proxy does, and then you shouldn't need this.
 # csrf_trusted_origins = ["https://comics.example.com"]
 # Worker threads that keep a warm database connection between requests.
 # Opening one costs a few milliseconds, mostly SQLite re-reading the