diff --git a/internal/hub/agent_connect.go b/internal/hub/agent_connect.go
index bf690c6b..0d55ce07 100644
--- a/internal/hub/agent_connect.go
+++ b/internal/hub/agent_connect.go
@@ -317,6 +317,9 @@ func getRealIP(r *http.Request) string {
 	if ip := r.Header.Get("CF-Connecting-IP"); ip != "" {
 		return ip
 	}
+	if ip := r.Header.Get("X-Real-IP"); ip != "" {
+		return ip
+	}
 	if ip := r.Header.Get("X-Forwarded-For"); ip != "" {
 		// X-Forwarded-For can contain a comma-separated list: "client_ip, proxy1, proxy2"
 		// Take the first one
diff --git a/internal/hub/agent_connect_test.go b/internal/hub/agent_connect_test.go
index ff65e428..c07849cb 100644
--- a/internal/hub/agent_connect_test.go
+++ b/internal/hub/agent_connect_test.go
@@ -1796,6 +1796,24 @@ func TestGetRealIP(t *testing.T) {
 			remoteAddr: "127.0.0.1:12345",
 			expectedIP: "192.168.1.8",
 		},
+		{
+			name:       "X-Real-IP header",
+			headers:    map[string]string{"X-Real-IP": "10.8.0.4"},
+			remoteAddr: "172.21.0.1:12345",
+			expectedIP: "10.8.0.4",
+		},
+		{
+			name:       "X-Real-IP takes precedence over X-Forwarded-For",
+			headers:    map[string]string{"X-Real-IP": "10.8.0.4", "X-Forwarded-For": "10.8.0.5"},
+			remoteAddr: "172.21.0.1:12345",
+			expectedIP: "10.8.0.4",
+		},
+		{
+			name:       "CF-Connecting-IP takes precedence over X-Real-IP",
+			headers:    map[string]string{"CF-Connecting-IP": "1.2.3.4", "X-Real-IP": "10.8.0.4"},
+			remoteAddr: "172.21.0.1:12345",
+			expectedIP: "1.2.3.4",
+		},
 	}
 
 	for _, tc := range testCases {