diff --git a/README.md b/README.md
index 2fda80b..3b83a31 100644
--- a/README.md
+++ b/README.md
@@ -126,11 +126,22 @@ kubectl apply -f k3s/expose-ingress.yaml
 curl -si "http://<node-ip>/"
 ```
 
+By default the app sees a cluster-internal address (for example `10.42.0.1`)
+instead of the real client IP, because the Traefik Service runs with
+`externalTrafficPolicy: Cluster`. To preserve the client IP, apply
+[k3s/traefik-config.yaml](k3s/traefik-config.yaml), which sets
+`externalTrafficPolicy: Local` on the Traefik Service:
+
+```bash
+kubectl apply -f k3s/traefik-config.yaml
+```
+
 #### Option 2: ServiceLB
 
 k3s also includes the ServiceLB load balancer. The single `LoadBalancer`
 Service in [k3s/expose-servicelb.yaml](k3s/expose-servicelb.yaml) exposes the
-app on port 8080 of the node's IP address, without an Ingress:
+app on port 8080 of the node's IP address, without an Ingress. The Service sets
+`externalTrafficPolicy: Local` so the app sees the real client IP:
 
 ```bash
 kubectl apply -f k3s/expose-servicelb.yaml
diff --git a/k3s/expose-servicelb.yaml b/k3s/expose-servicelb.yaml
index b745e81..bc0eb4b 100644
--- a/k3s/expose-servicelb.yaml
+++ b/k3s/expose-servicelb.yaml
@@ -4,6 +4,7 @@ metadata:
   name: ok-server
 spec:
   type: LoadBalancer
+  externalTrafficPolicy: Local
   selector:
     app: ok-server
   ports:
diff --git a/k3s/traefik-config.yaml b/k3s/traefik-config.yaml
new file mode 100644
index 0000000..fe8fece
--- /dev/null
+++ b/k3s/traefik-config.yaml
@@ -0,0 +1,10 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    service:
+      spec:
+        externalTrafficPolicy: Local