diff --git a/.env.example b/.env.example
index 381484a..332af67 100644
--- a/.env.example
+++ b/.env.example
@@ -17,7 +17,7 @@
 #   - All SIP clients connect to DOMAIN_NAME:5061 (TLS)
 #   - coturn handles NAT traversal (STUN) and media relay (TURN)
 #   - Works from any network: LAN, cellular, Proton VPN, hotel WiFi
-#   - TURN credentials are auto-generated if TURN_PASSWORD is empty
+#   - Set TURN_PASSWORD below (generate one: openssl rand -base64 18)
 # ================================================================
 
 # ── Domain Name (REQUIRED) ────────────────────────────────────
@@ -60,11 +60,12 @@ VLAN_SUBNETS=
 
 # ── TURN/STUN Settings ──────────────────────────────────────
 # Used by coturn for TURN relay authentication.
-# Both coturn and Asterisk must use the SAME password.
-# If empty, both default to "changeme" — set a real password here.
+# If empty, defaults to "changeme" — set a real password for security.
+# Generate one with:  openssl rand -base64 18
 #
-# These credentials are shared between coturn and Asterisk.
-# SIP clients do NOT need these - only the server uses them.
+# These credentials are for coturn only. SIP clients that need TURN
+# relay (behind strict NAT) must configure the same credentials in
+# their SIP app settings.
 TURN_USERNAME=easyasterisk
 TURN_PASSWORD=
 
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index e82b70e..da1cfa8 100644
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -279,24 +279,22 @@ EOF
     chown asterisk:asterisk /etc/asterisk/pjsip.conf
 fi
 
-# ── rtp.conf (always regenerated - includes TURN credentials) ──
-# Use 127.0.0.1 for stunaddr/turnaddr because coturn runs on the same host
-# (network_mode: host). Using the FQDN would cause DNS resolution, and if the
-# DNS TTL is 0 Asterisk cancels recurring resolution — breaking ICE entirely
-# and adding a ~27-second timeout delay to every call.
-turn_port="${turn_server##*:}"
-local_turn="127.0.0.1:${turn_port:-3478}"
-log_info "Configuring RTP with ICE + STUN + TURN (local: ${local_turn})..."
+# ── rtp.conf (always regenerated) ──
+# ICE is enabled so Asterisk participates in ICE negotiation with clients.
+# stunaddr/turnaddr are NOT set here because:
+#   - Asterisk already knows its public IP via external_media_address in pjsip.conf
+#   - Its RTP ports are port-forwarded, so host candidates are sufficient
+#   - Setting stunaddr/turnaddr causes STUN/TURN gather timeouts (~27s per call)
+#     when the STUN/TURN server is unreachable or misconfigured
+# coturn is for SIP CLIENTS behind strict NAT — they configure TURN in their
+# own app settings, independently of Asterisk's rtp.conf.
+log_info "Configuring RTP with ICE support..."
 cat > /etc/asterisk/rtp.conf << EOF
 [general]
 rtpstart=${RTP_START:-10000}
 rtpend=${RTP_END:-20000}
 strictrtp=yes
 icesupport=yes
-stunaddr=${local_turn}
-turnaddr=${local_turn}
-turnusername=${TURN_USERNAME}
-turnpassword=${TURN_PASSWORD}
 EOF
 chown asterisk:asterisk /etc/asterisk/rtp.conf
 
diff --git a/easy-asterisk-v0.10.0.sh b/easy-asterisk-v0.10.0.sh
index d4773bf..a306c90 100644
--- a/easy-asterisk-v0.10.0.sh
+++ b/easy-asterisk-v0.10.0.sh
@@ -3032,21 +3032,18 @@ transport=config,pjsip.conf,criteria=type=transport
 EOF
     fi
 
-    # ICE / STUN / TURN configuration
-    # Enabled for: FQDN/internet mode OR VPN with ICE enabled
+    # ICE configuration
+    # ICE is enabled so Asterisk participates in ICE negotiation with clients.
+    # stunaddr/turnaddr are NOT set because:
+    #   - Asterisk knows its public IP via external_media_address in pjsip.conf
+    #   - Its RTP ports are port-forwarded, so host candidates are sufficient
+    #   - Setting stunaddr/turnaddr causes STUN/TURN gather timeouts (~27s delay)
+    # coturn (if running) is for SIP clients behind strict NAT — they configure
+    # TURN in their own app settings, independently of Asterisk's rtp.conf.
     load_config
     local ice_config=""
     if [[ -n "$DOMAIN_NAME" ]] || [[ "$VPN_ICE_ENABLED" == "y" ]] || [[ "$TURN_ENABLED" == "y" ]]; then
-        local stun_addr="${TURN_SERVER:-${CUSTOM_STUN_SERVER:-stun.l.google.com:19302}}"
-        ice_config="icesupport=yes
-stunaddr=${stun_addr}"
-        # Add TURN relay if configured (required for calls through strict NAT/VPN)
-        if [[ "$TURN_ENABLED" == "y" && -n "$TURN_SERVER" && -n "$TURN_USERNAME" && -n "$TURN_PASSWORD" ]]; then
-            ice_config="${ice_config}
-turnaddr=${TURN_SERVER}
-turnusername=${TURN_USERNAME}
-turnpassword=${TURN_PASSWORD}"
-        fi
+        ice_config="icesupport=yes"
     else
         ice_config="# icesupport disabled - LAN only mode"
     fi