diff --git a/services/pstn-trunk.sh b/services/pstn-trunk.sh
index f032835..239b09c 100644
--- a/services/pstn-trunk.sh
+++ b/services/pstn-trunk.sh
@@ -219,7 +219,7 @@ _pstn_ensure_live_includes() {
 # identify/endpoint objects needed per IP, unlike the older chan_sip
 # peer-per-source-IP pattern some providers' sample configs still show.
 _pstn_write_pjsip_include() {
-    local FILE="$1" SERVER="$2" SERVER_IPS="$3" DID="$4"
+    local FILE="$1" SERVER="$2" SERVER_IPS="$3"
     cat > "$FILE" << 'EOF'
 ; SIP PSTN trunk — IP authentication, no password stored (see
 ; docs/pstn-calling-voipms-plan.md). Regenerated by services/pstn-trunk.sh —
@@ -241,6 +241,18 @@ _pstn_write_pjsip_include() {
 ; below instead tells Asterisk to honor identity info the provider actually
 ; sends (P-Asserted-Identity/Remote-Party-ID, in addition to the From
 ; header) for this trunk, so real inbound Caller-ID reaches the dialplan.
+;
+; No static from_user= on the endpoint below either, for the same reason
+; on the outbound side. Confirmed live: a static from_user pinned to the
+; shared trunk DID silently wins over CALLERID(num) — PJSIP only falls
+; back to the channel's caller ID number for the From-header username when
+; from_user is unset on the endpoint. With it set, pstn_check_busy's
+; per-extension personal_did lookup (see the outbound dialplan below) still
+; ran and still set CALLERID(num) correctly, but every outbound call's From
+; header — what the provider actually presents as Caller ID — used the
+; static DID regardless, so every extension showed the same "original"
+; number no matter which personal_did it was supposed to dial out as.
+; Leaving from_user unset lets that per-call CALLERID(num) reach the wire.
 
 [pstn-trunk]
 type=aor
@@ -263,12 +275,11 @@ context=from-pstn-trunk
 disallow=all
 allow=ulaw,alaw
 aors=pstn-trunk
-from_user=__PSTN_DID__
 from_domain=__PSTN_SERVER__
 trust_id_inbound=yes
 direct_media=no
 EOF
-    sed -i "s/__PSTN_SERVER__/${SERVER}/g; s/__PSTN_DID__/${DID}/g" "$FILE"
+    sed -i "s/__PSTN_SERVER__/${SERVER}/g" "$FILE"
 }
 
 # ── Shared: one inbound ring-group member's live permission check ─────────
@@ -1584,7 +1595,7 @@ _pstn_apply_settings() {
     _pstn_patch_vendor_files "$EA_DIR" || return 1
 
     mkdir -p "$ASTERISK_DIR"
-    _pstn_write_pjsip_include "$ASTERISK_DIR/pstn-trunk-pjsip.conf" "$SERVER" "$SERVER_IPS" "$DID"
+    _pstn_write_pjsip_include "$ASTERISK_DIR/pstn-trunk-pjsip.conf" "$SERVER" "$SERVER_IPS"
     _pstn_write_dialplan_include "$ASTERISK_DIR/pstn-trunk-dialplan.conf" "$DID" "$NTFY_URL"
     _pstn_write_inbound_dialplan_include "$ASTERISK_DIR/pstn-trunk-inbound-dialplan.conf" "$RING_EXTS" "$NTFY_URL"
     _pstn_write_personal_group_ring_script "$ASTERISK_DIR/pstn-personal-group-ring.sh"