diff --git a/internal/api/auth.go b/internal/api/auth.go
index 46e18c2e..ac125463 100644
--- a/internal/api/auth.go
+++ b/internal/api/auth.go
@@ -100,7 +100,7 @@ func (h *handlers) handleLogin(w http.ResponseWriter, r *http.Request) {
 		// the active-sessions surface: a session that was born somewhere the
 		// user recognises but is being used from somewhere they don't is the
 		// case this whole surface exists to surface.
-		Ip: auth.ClientIP(r),
+		Ip: auth.ClientIP(r, h.netSettings.Hops()),
 	}); err != nil {
 		h.logger.Error("api: insert session failed", "err", err)
 		writeErr(w, apierror.InternalMsg("insert failed", err))
diff --git a/internal/api/auth_register.go b/internal/api/auth_register.go
index 5bf1803e..6f098787 100644
--- a/internal/api/auth_register.go
+++ b/internal/api/auth_register.go
@@ -175,7 +175,7 @@ func (h *handlers) handleRegister(w http.ResponseWriter, r *http.Request) {
 		UserID:    user.ID,
 		TokenHash: auth.HashSessionToken(sessionToken),
 		UserAgent: r.UserAgent(),
-		Ip:        auth.ClientIP(r),
+		Ip:        auth.ClientIP(r, h.netSettings.Hops()),
 	}); err != nil {
 		h.logger.Error("register: insert session failed", "err", err)
 		writeErr(w, apierror.Internal(err))
diff --git a/web/src/lib/components/NetworkSettingsCard.test.ts b/web/src/lib/components/NetworkSettingsCard.test.ts
index b7bc4eef..11aebb36 100644
--- a/web/src/lib/components/NetworkSettingsCard.test.ts
+++ b/web/src/lib/components/NetworkSettingsCard.test.ts
@@ -34,7 +34,10 @@ describe('NetworkSettingsCard', () => {
     getNetworkSettings.mockResolvedValue(settings());
     render(NetworkSettingsCard);
 
-    expect(await screen.findByText('198.51.100.7')).toBeTruthy();
+    // The address legitimately appears twice — as the detected client and
+    // inside the forwarded chain — so wait on the unique label, not the value.
+    await screen.findByText('Your address right now');
+    expect(screen.getAllByText('198.51.100.7').length).toBeGreaterThan(0);
     expect(screen.getByText('172.18.0.1:40000')).toBeTruthy();
   });
 
@@ -83,7 +86,7 @@ describe('NetworkSettingsCard', () => {
     );
     render(NetworkSettingsCard);
 
-    await screen.findByText('198.51.100.7');
+    await screen.findByText('Your address right now');
     expect(screen.queryByText(/arrived with/)).toBeNull();
   });
 
@@ -101,6 +104,6 @@ describe('NetworkSettingsCard', () => {
     const retry = await screen.findByRole('button', { name: 'Try again' });
     getNetworkSettings.mockResolvedValue(settings());
     await fireEvent.click(retry);
-    await screen.findByText('198.51.100.7');
+    await screen.findByText('Your address right now');
   });
 });