diff --git a/.sops.yaml b/.sops.yaml
index 2a386fb..8b9d5fe 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -46,4 +46,7 @@ creation_rules:
     age: age1uzs33ep6k3htnuwyyp54y373wkf7urd0qvk5kxcmptr5tt0fffus4v06gn
   - path_regex: map_monitor.*\.enc\.yaml$
     encrypted_regex: ^(data|stringData)$
-    age: age1k4j5vyqqt7w7k52gvkpfe6znqr9mlgt076l7xgdtyc75lamsh4aqshj5qs
\ No newline at end of file
+    age: age1k4j5vyqqt7w7k52gvkpfe6znqr9mlgt076l7xgdtyc75lamsh4aqshj5qs
+  - path_regex: jitsi.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1zmr32r5mcgyh73asvzl8l690pzwqsx9hle27u3cydngsgv56wykq3v67px
\ No newline at end of file
diff --git a/clusters/base/apps/jitsi/helmrelease.yaml b/clusters/base/apps/jitsi/helmrelease.yaml
index 8fd4b0d..d6a3427 100644
--- a/clusters/base/apps/jitsi/helmrelease.yaml
+++ b/clusters/base/apps/jitsi/helmrelease.yaml
@@ -20,6 +20,21 @@ spec:
       retries: 5
   driftDetection:
     mode: enabled
+  # fixed xmpp credentials: the chart generates random ones on every render, which
+  # desyncs jicofo/jvb from the already running prosody after an upgrade
+  valuesFrom:
+    - kind: Secret
+      name: jitsi-secrets
+      valuesKey: JICOFO_AUTH_PASSWORD
+      targetPath: jicofo.xmpp.password
+    - kind: Secret
+      name: jitsi-secrets
+      valuesKey: JICOFO_COMPONENT_SECRET
+      targetPath: jicofo.xmpp.componentSecret
+    - kind: Secret
+      name: jitsi-secrets
+      valuesKey: JVB_AUTH_PASSWORD
+      targetPath: jvb.xmpp.password
   values:
     publicURL: https://v.aggtaa.com
 
@@ -40,8 +55,10 @@ spec:
     # media traffic: UDP 10000 must be forwarded from the WAN router to the JVB service ip (kubectl get svc -n video)
     jvb:
       UDPPort: 10000
+      # wan ip first, then the service ip for clients on the lan (no hairpin nat needed);
+      # the chart passes this string as-is to JVB_ADVERTISE_IPS, which accepts a comma separated list
       publicIPs:
-        - 91.233.45.43
+        - 91.233.45.43,10.0.64.9
       service:
         enabled: true
         type: LoadBalancer
diff --git a/clusters/base/apps/jitsi/kustomization.yaml b/clusters/base/apps/jitsi/kustomization.yaml
index d7fbb03..37e8d2e 100644
--- a/clusters/base/apps/jitsi/kustomization.yaml
+++ b/clusters/base/apps/jitsi/kustomization.yaml
@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - helmrepository.yaml
   - helmrelease.yaml
+  - secret.enc.yaml
diff --git a/clusters/base/apps/jitsi/secret.enc.yaml b/clusters/base/apps/jitsi/secret.enc.yaml
new file mode 100644
index 0000000..4bf39e6
--- /dev/null
+++ b/clusters/base/apps/jitsi/secret.enc.yaml
@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: jitsi-secrets
+    namespace: video
+stringData:
+    JICOFO_AUTH_PASSWORD: ENC[AES256_GCM,data:OUEZWPlqpkuhEI8kf65kKUooeahC3z03STevw7oOWx8=,iv:KSfrwehZG9kW7bfzQ5yavq6gYj+TrYKS/LZPNzaZdLI=,tag:/FiUF75ib3RXPuzO0EhIpw==,type:str]
+    JICOFO_COMPONENT_SECRET: ENC[AES256_GCM,data:y8a84NdaClBRUFDPtXhulJxrX68Tn+4s1NrNqyhBjvI=,iv:fdqlgRwHNTdqegvfOrvX1Iph5aMKAtyW5zJUr+kBNx0=,tag:yNQ53KQQWafV7CSbNttJUQ==,type:str]
+    JVB_AUTH_PASSWORD: ENC[AES256_GCM,data:GWSHUDfEZmLbKzU02U+ImCR0nVIp5ebngWVKBOmjOjY=,iv:uG7/4QPD8Wd2Q6lqPgKTD533GdbkXjdtZqJnshmNzjI=,tag:jhj5L86v0ZFalyhfQOTgCA==,type:str]
+sops:
+    age:
+        - recipient: age1zmr32r5mcgyh73asvzl8l690pzwqsx9hle27u3cydngsgv56wykq3v67px
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuSXZWTzloNTMzWk5samRU
+            amhURmFvdDlSMjd1RVFjUWxuWEtoVE13WUNJClptVUgxblRWL1RIYmZPZ2x2MG1H
+            Y3ovWWlwL2dLeW9xbndXWEMvQVZONGcKLS0tIGxZNDZkRDBkZ0NDVWxMNGxoUFR4
+            VG1wSm5wUWRVUEZ3cWlMb2lBNTVkZGcKAa4/S8EWBMt+uvT/6hYRl1GascDul+ox
+            qlSV/20eA9uamssuId63ewaO4hL7ekwKwqM5cAFH+wx2dno9Ajuang==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-11-04T11:21:36Z"
+    mac: ENC[AES256_GCM,data:r7iq6iTFL70Zat0sVw9nAHiueZNUWzV2j6q6POBUjeGLqn53ygJAXqG31REBLNKBwabLxsNlTmZRujpP6ySkbFve6fN1C6+6HFWdHnkeJx1nk4iJTvb5+Ld7Exp8yt6b46M/hHZxOffO23jVHuAa47hZ4lHphFpSrlgif79W/CI=,iv:bP9ll+tuTFOfh3kE7xiXtF0cH0sCfhaIs9fhNt0JoEU=,tag:hpBZBwRZxyAgn20aaGoGWA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
diff --git a/clusters/home/apps/jitsi.yaml b/clusters/home/apps/jitsi.yaml
index 1179ff5..f512190 100644
--- a/clusters/home/apps/jitsi.yaml
+++ b/clusters/home/apps/jitsi.yaml
@@ -15,3 +15,7 @@ spec:
     - name: namespaces
     - name: infra
   retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age-jitsi