diff --git a/services/jitsi/deployment.yaml b/services/jitsi/deployment.yaml
index 0bb9c51..53c5dc4 100644
--- a/services/jitsi/deployment.yaml
+++ b/services/jitsi/deployment.yaml
@@ -122,7 +122,7 @@ spec:
             # - { name: JVB_STUN_SERVERS, value: "stun.l.google.com:19302,stun1.l.google.com:19302,meet-jit-si-turnrelay.jitsi.net:443" }
             - { name: JVB_ENABLE_APIS, value: "rest,colibri" }
             - { name: JVB_WS_DOMAIN, value: "meet.bstein.dev" }
-            - { name: JVB_WS_TLS,    value: "false" }        # TLS ends at Traefik; keep WS HTTP
+            - { name: JVB_WS_TLS,    value: "true" }         # advertise wss:// for bridge channel
             - { name: JVB_ADVERTISE_IPS, value: "38.28.125.112" }
             - { name: JVB_TCP_HARVESTER_DISABLED, value: "false" }
             - { name: JVB_TCP_PORT, value: "4443" }