diff --git a/infra/gamearray.env.j2 b/infra/gamearray.env.j2
index 1f0088d..14c38ca 100644
--- a/infra/gamearray.env.j2
+++ b/infra/gamearray.env.j2
@@ -10,4 +10,11 @@ STRIPE_SECRET_KEY={{ stripe_secret_key }}
 CELERY_BROKER_URL=redis://gamearray_redis:6379/0
 REDIS_URL=redis://gamearray_redis:6379/1
 PYSWISS_URL=https://charts.earthmanrpg.me
+# coturn / WebRTC voice — only COTURN_SHARED_SECRET is sensitive (it signs the
+# TURN HMAC creds + must equal the coturn droplet's static-auth-secret). Host +
+# realm are public. coturn_secret comes from the vault (share it across the app
+# + coturn host groups, e.g. group_vars/all/vault.yaml, so both plays match).
+COTURN_SHARED_SECRET={{ coturn_secret }}
+COTURN_TURN_HOST=turn.earthmanrpg.me
+COTURN_REALM=earthmanrpg.me