diff --git a/config/settings/selfhosted.py b/config/settings/selfhosted.py
index bc47dd6..31b9450 100644
--- a/config/settings/selfhosted.py
+++ b/config/settings/selfhosted.py
@@ -93,6 +93,13 @@ CORS_ALLOWED_ORIGINS = os.environ.get(
     'http://localhost:8000'
 ).split(',')
 
+# CSRF - configurable for self-hosted
+# Must include the exact URL (with protocol and port) you're accessing the site from
+CSRF_TRUSTED_ORIGINS = os.environ.get(
+    'CSRF_TRUSTED_ORIGINS',
+    'http://localhost:8000'
+).split(',')
+
 # Static files
 STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'