diff --git a/services/mam-api/src/routes/cluster.js b/services/mam-api/src/routes/cluster.js
index fc34301..dad3c67 100644
--- a/services/mam-api/src/routes/cluster.js
+++ b/services/mam-api/src/routes/cluster.js
@@ -43,9 +43,10 @@ function pickIp(reportedIp, reqIp) {
   const clean = (s) => (s || '').replace(/^::ffff:/, '');
   const isDockerBridge = (ip) => /^172\.17\./.test(ip || '');
   const r = clean(reqIp);
-  if (!reportedIp) return r || null;
-  if (isDockerBridge(reportedIp) && r && !isDockerBridge(r)) return r;
-  return reportedIp;
+  // Trust payload ip_address when present and not docker0 bridge
+  if (reportedIp && !isDockerBridge(reportedIp)) return reportedIp;
+  // Fall back to req.ip when payload missing or docker0
+  return r || null;
 }
 
 function dockerRequest(path, method = 'GET', body = null) {