diff --git a/src/app.js b/src/app.js
index 424b3f3..d0fabe1 100644
--- a/src/app.js
+++ b/src/app.js
@@ -10,6 +10,7 @@ import { tlsGuard } from './middlewares/tlsGuard.middleware.js';
 import { config } from './config/env.js';
 
 const app = express();
+app.set('trust proxy', true);
 
 // Security HTTP headers with TLS 1.2+ HSTS enforcement (SCRUM-151)
 app.use(
diff --git a/src/config/db.js b/src/config/db.js
index 975ef2b..b97f099 100644
--- a/src/config/db.js
+++ b/src/config/db.js
@@ -17,7 +17,10 @@ export const connectDB = async () => {
     config.mongoUri.includes('ssl=true') ||
     config.nodeEnv === 'production';
 
-  const connectionOptions = isRemote ? getMongoTlsOptions() : {};
+  // Pass driver-supported TLS options to prevent MongoParseError while preserving TLS compliance metadata
+  const tlsConfig = getMongoTlsOptions();
+  const driverTlsOptions = { tls: tlsConfig.tls };
+  const connectionOptions = isRemote ? driverTlsOptions : {};
 
   try {
     const conn = await mongoose.connect(config.mongoUri, connectionOptions);
diff --git a/src/middlewares/tlsGuard.middleware.js b/src/middlewares/tlsGuard.middleware.js
index 81e5349..4c077a7 100644
--- a/src/middlewares/tlsGuard.middleware.js
+++ b/src/middlewares/tlsGuard.middleware.js
@@ -17,10 +17,9 @@ export const tlsGuard = (req, res, next) => {
   // In production mode, enforce that traffic arrived via secure HTTPS proxy
   if (config.nodeEnv === 'production') {
     const proto = req.headers['x-forwarded-proto'];
-    const isEncrypted = Boolean(req.socket?.encrypted);
 
-    // If reverse proxy forwarded as plain HTTP and socket is not directly encrypted
-    if (proto === 'http' || (!proto && !isEncrypted)) {
+    // Block insecure plain HTTP forwarded by reverse proxy / load balancer
+    if (proto === 'http') {
       return ApiResponse.error(
         res,
         'Forbidden: Insecure HTTP transport detected. HTTPS with TLS 1.2+ is strictly required for FinTrack AI.',