diff --git a/internal/observability/localip_test.go b/internal/observability/localip_test.go
new file mode 100644
index 00000000..c2fe1762
--- /dev/null
+++ b/internal/observability/localip_test.go
@@ -0,0 +1,27 @@
+package observability
+
+import (
+	"testing"
+)
+
+func TestIsLocalClientIPReturnsTrueForLoopback(t *testing.T) {
+	for _, ip := range []string{"127.0.0.1", "::1"} {
+		if !isLocalClientIP(ip) {
+			t.Fatalf("isLocalClientIP(%q) = false, want true", ip)
+		}
+	}
+}
+
+func TestIsLocalClientIPReturnsFalseForExternal(t *testing.T) {
+	for _, ip := range []string{"8.8.8.8", "192.168.1.1", ""} {
+		if isLocalClientIP(ip) {
+			t.Fatalf("isLocalClientIP(%q) = true, want false", ip)
+		}
+	}
+}
+
+func TestIsLocalClientIPReturnsFalseForInvalid(t *testing.T) {
+	if isLocalClientIP("not-an-ip") {
+		t.Fatal("isLocalClientIP('not-an-ip') = true, want false")
+	}
+}