diff --git a/services/asterisk.sh b/services/asterisk.sh
index 0cfa883..c0f04d1 100644
--- a/services/asterisk.sh
+++ b/services/asterisk.sh
@@ -1447,9 +1447,11 @@ docker exec -it ${CONTAINER} easy-asterisk
 | 5061          | TCP      | SIP over TLS                     |
 | ${WEB_ADMIN_PORT_VAL}          | TCP      | Easy Asterisk web admin (auto-picked — see \`.env\`) |
 | 8088/8089     | TCP      | Asterisk HTTP/WS (ARI/AMI)       |
-| 3478          | UDP/TCP  | TURN/STUN (coturn)               |
 | 10000–20000   | UDP      | RTP media streams                |
-| 49152–49252   | UDP      | TURN relay media ports           |
+$( [[ "$USE_EMBEDDED_COTURN" == true ]] \
+    && echo "| 3478          | UDP/TCP  | TURN/STUN (this install's own dedicated coturn) |
+| 49152–49252   | UDP      | TURN relay media ports (dedicated coturn)  |" \
+    || echo "| See \`~/docker/coturn/.env\` | UDP/TCP | TURN/STUN — shared coturn service, not opened by this install |" )
 
 ## Data directories (all inside ${EA_DIR}/, included in backup)
 
diff --git a/services/mattermost.sh b/services/mattermost.sh
index 7ccb3a6..063ab63 100644
--- a/services/mattermost.sh
+++ b/services/mattermost.sh
@@ -415,6 +415,18 @@ networks:
     fi
     [ -n "$MM_SECRET" ] || MM_SECRET=$(generate_password 48)
 
+    # Listening port (3479, vs. Asterisk's embedded coturn on 3478) and relay
+    # range (49253-49452, vs. Asterisk's 49152-49252) are both deliberately
+    # offset from services/asterisk.sh's embedded coturn defaults. Confirmed
+    # live: an earlier version of this range (49153-49352) overlapped
+    # Asterisk's by ~100 ports — the exact bug the shared coturn service
+    # (services/coturn.sh) exists to avoid, reintroduced here because this
+    # is the no-shared-coturn fallback path. If more than one Mattermost
+    # instance ever falls back to embedded coturn at the same time, they'll
+    # collide with EACH OTHER on these same fixed numbers — not handled here
+    # (single-instance-without-shared-coturn is the case this fallback is
+    # actually for; install services/coturn.sh instead if you need more than
+    # one consumer without hand-managing per-instance port math).
     local _COTURN_SERVICE=""
     if [ "$USE_EMBEDDED_COTURN" = true ]; then
         _COTURN_SERVICE="
@@ -431,8 +443,8 @@ networks:
       - --use-auth-secret
       - --static-auth-secret=\${COTURN_SECRET}
       - --realm=\${MM_REALM:-localhost}
-      - --min-port=49153
-      - --max-port=49352
+      - --min-port=49253
+      - --max-port=49452
       - --no-tls
       - --no-dtls
       - --no-cli
@@ -532,7 +544,7 @@ EOF
         ufw allow "${CALLS_UDP_PORT}/udp" comment "Mattermost Calls RTC${INSTANCE_SUFFIX:+ ($INSTANCE_SUFFIX)}"
         if [ "$USE_EMBEDDED_COTURN" = true ]; then
             ufw allow 3479/udp; ufw allow 3479/tcp
-            ufw allow 49153:49352/udp comment "Mattermost coturn relay"
+            ufw allow 49253:49452/udp comment "Mattermost coturn relay"
         fi
         # Shared coturn opens its own ports once, at its own install time.
     fi