diff --git a/src/lib/client-ip.test.ts b/src/lib/client-ip.test.ts
index 56f4dcf..266381a 100644
--- a/src/lib/client-ip.test.ts
+++ b/src/lib/client-ip.test.ts
@@ -12,10 +12,10 @@ describe('getClientIp', () => {
     expect(getClientIp(request)).toBe('192.168.1.1');
   });
 
-  it('returns socket.remoteAddress when request.ip is undefined', () => {
+  it('returns raw.socket.remoteAddress when request.ip is undefined', () => {
     const request = {
       ip: undefined,
-      socket: { remoteAddress: '10.0.0.2' },
+      raw: { socket: { remoteAddress: '10.0.0.2' } },
     } as unknown as FastifyRequest;
     expect(getClientIp(request)).toBe('10.0.0.2');
   });
@@ -25,14 +25,14 @@ describe('getClientIp', () => {
     expect(getClientIp(request)).toBe('192.168.1.1');
   });
 
-  it('returns "unknown" when neither ip nor socket.remoteAddress is available', () => {
-    const request = { ip: undefined, socket: {} } as unknown as FastifyRequest;
-    expect(getClientIp(request)).toBe('unknown');
+  it('returns empty string when neither ip nor socket.remoteAddress is available', () => {
+    const request = { ip: undefined, raw: { socket: {} } } as unknown as FastifyRequest;
+    expect(getClientIp(request)).toBe('');
   });
 
-  it('returns "unknown" when request has no socket', () => {
-    const request = { ip: undefined } as unknown as FastifyRequest;
-    expect(getClientIp(request)).toBe('unknown');
+  it('returns empty string when request.raw has no socket', () => {
+    const request = { ip: undefined, raw: {} } as unknown as FastifyRequest;
+    expect(getClientIp(request)).toBe('');
   });
 });
 
diff --git a/src/lib/client-ip.ts b/src/lib/client-ip.ts
index 1b7ce6e..46dd508 100644
--- a/src/lib/client-ip.ts
+++ b/src/lib/client-ip.ts
@@ -8,11 +8,11 @@ import type { FastifyRequest } from 'fastify';
  * returns that trusted value.
  */
 export function getClientIp(request: FastifyRequest): string {
-  const ip = request.ip ?? (request as any).socket?.remoteAddress;
+  const ip = request.ip ?? request.raw.socket?.remoteAddress;
   if (ip && typeof ip === 'string') {
     // IPv6-mapped IPv4: ::ffff:192.168.1.1 -> 192.168.1.1
     if (ip.startsWith('::ffff:')) return ip.slice(7);
     return ip;
   }
-  return 'unknown';
+  return '';
 }