diff --git a/pkg/coredata/cookie_consent_record.go b/pkg/coredata/cookie_consent_record.go
index 6b7fa8827..3a59bd485 100644
--- a/pkg/coredata/cookie_consent_record.go
+++ b/pkg/coredata/cookie_consent_record.go
@@ -223,7 +223,7 @@ WHERE
 	%s
 	AND cookie_banner_id = @cookie_banner_id
 	AND visitor_id = @visitor_id
-ORDER BY created_at DESC
+ORDER BY created_at DESC, id DESC
 LIMIT 1;
 `
 
diff --git a/pkg/server/api/cookiebanner/v1/handler.go b/pkg/server/api/cookiebanner/v1/handler.go
index b154a4454..883eb2aec 100644
--- a/pkg/server/api/cookiebanner/v1/handler.go
+++ b/pkg/server/api/cookiebanner/v1/handler.go
@@ -19,6 +19,7 @@ import (
 	"errors"
 	"net"
 	"net/http"
+	"strings"
 
 	"github.com/go-chi/chi/v5"
 	"go.gearno.de/kit/httpserver"
@@ -164,6 +165,13 @@ func (h *Handler) handlePostConsent(w http.ResponseWriter, r *http.Request) {
 
 func clientIP(r *http.Request) string {
 	if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+		// X-Forwarded-For may contain a comma-separated chain; use only the
+		// leftmost (client) entry.
+		if i := strings.IndexByte(xff, ','); i != -1 {
+			xff = xff[:i]
+		}
+		xff = strings.TrimSpace(xff)
+
 		if ip, _, err := net.SplitHostPort(xff); err == nil {
 			return ip
 		}
diff --git a/pkg/validator/validator_format.go b/pkg/validator/validator_format.go
index 394ba7262..af3d51aa1 100644
--- a/pkg/validator/validator_format.go
+++ b/pkg/validator/validator_format.go
@@ -160,7 +160,7 @@ func Origin() ValidatorFunc {
 			return newValidationError(ErrorCodeInvalidFormat, "must be a valid origin (e.g. https://example.com)")
 		}
 
-		if parsedURL.Host == "" {
+		if parsedURL.Host == "" || parsedURL.Hostname() == "" {
 			return newValidationError(ErrorCodeInvalidFormat, "must be a valid origin (e.g. https://example.com)")
 		}