diff --git a/.env.example b/.env.example
index d44d3f8..458c7ed 100644
--- a/.env.example
+++ b/.env.example
@@ -15,4 +15,4 @@ CONTROL_HOST=0.0.0.0
 
 # Comma-separated IP/CIDR allow-list for the SOCKS proxy.
 # Default: RFC 1918 private ranges + loopback.
-SOCKS_POLICY=accept 127.0.0.1,accept 10.0.0.0/8,accept 172.16.0.0/12,accept 192.168.0.0/16
+SOCKS_POLICY=accept 127.0.0.1,accept 10.0.0.0/8,accept 172.16.0.0/12,accept 192.168.0.0/16,reject *
diff --git a/compose.yml b/compose.yml
index 16a163d..371efb1 100644
--- a/compose.yml
+++ b/compose.yml
@@ -22,7 +22,7 @@ services:
       CONTROL_HOST: '${CONTROL_HOST:-0.0.0.0}'
 
       # Which source IPs may use the proxy.
-      SOCKS_POLICY: '${SOCKS_POLICY:-accept 127.0.0.1,accept 10.0.0.0/8,accept 172.16.0.0/12,accept 192.168.0.0/16}'
+      SOCKS_POLICY: '${SOCKS_POLICY:-accept 127.0.0.1,accept 10.0.0.0/8,accept 172.16.0.0/12,accept 192.168.0.0/16,reject *}'
 
     ports:
       # SOCKS5 proxy — your scraper connects here
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 0753171..fc149af 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -22,6 +22,6 @@ EXPOSE 9150 9151
 ENV CONTROL_PASSWORD="changeme" \
     SOCKS_HOST="0.0.0.0" \
     CONTROL_HOST="0.0.0.0" \
-    SOCKS_POLICY="accept 127.0.0.1,accept 10.0.0.0/8,accept 172.16.0.0/12,accept 192.168.0.0/16"
+    SOCKS_POLICY="accept 127.0.0.1,accept 10.0.0.0/8,accept 172.16.0.0/12,accept 192.168.0.0/16,reject *"
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index 8461e61..4181b7e 100644
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -18,7 +18,6 @@ SocksPort ${SOCKS_HOST}:9150
 
 # Accept policy: allow only the listed CIDRs, reject everything else.
 $(echo "${SOCKS_POLICY}" | tr ',' '\n' | sed 's/^ */SocksPolicy /')
-SocksPolicy reject *
 
 # === Control port (used by stem for NEWNYM / circuit rotation) ===
 ControlPort ${CONTROL_HOST}:9151
@@ -34,4 +33,4 @@ echo "[tor-proxy] SOCKS5  -> ${SOCKS_HOST}:9150"
 echo "[tor-proxy] Control -> ${CONTROL_HOST}:9151 (password auth)"
 
 # Run as the 'tor' user created by the apk package.
-exec su-exec tor tor -f /etc/tor/torrc "$@"
\ No newline at end of file
+exec su-exec tor tor -f /etc/tor/torrc "$@"