diff --git a/.env.example b/.env.example
index 1e95381..9f5c15c 100644
--- a/.env.example
+++ b/.env.example
@@ -10,6 +10,14 @@ MEDIAMTX_WHIP_PUBLIC=http://${PUBLIC_HOST}:8889
 MEDIAMTX_HLS_PUBLIC=http://${PUBLIC_HOST}:8890
 BLOSSOM_URL_DEFAULT=http://${PUBLIC_HOST}:8098
 
+# ICE host candidate MediaMTX advertises for WebRTC/WHIP (browser-publish
+# "stream from this browser"). If you're behind Cloudflare or similar
+# HTTP(S)-only proxy, this MUST be the raw origin IP, not PUBLIC_HOST —
+# Cloudflare never forwards raw UDP, so a proxied hostname here makes the
+# WHIP handshake succeed while media silently never arrives. Same reasoning
+# as MEDIAMTX_RTMP_PUBLIC above. Plain host/IP, no scheme or port.
+MEDIAMTX_WEBRTC_HOST=${PUBLIC_HOST}
+
 # Default nostr relays for NIP-53 live-event announcements (comma separated,
 # changeable at runtime in Settings)
 NOSTR_RELAYS=wss://relay.damus.io,wss://nos.lol,wss://relay.nostr.band
diff --git a/docker-compose.yml b/docker-compose.yml
index 103f511..2bbf4d1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -44,8 +44,16 @@ services:
       - "8189:8189/udp"    # WebRTC ICE
       - "8890:8888"        # HLS (host 8890; 8888 kept free for other apps)
     environment:
-      # Browsers need a reachable ICE host candidate; set PUBLIC_HOST in .env
-      MTX_WEBRTCADDITIONALHOSTS: ${PUBLIC_HOST:-localhost}
+      # Browsers need a reachable ICE host candidate for the actual UDP media
+      # path (browser-publish "stream from this browser" / WHIP). This must
+      # be the raw origin IP, NOT PUBLIC_HOST — Cloudflare's proxy only
+      # forwards HTTP(S), never raw UDP, regardless of port (same reason
+      # MEDIAMTX_RTMP_PUBLIC above uses the raw IP instead of the
+      # Cloudflare-proxied domain). Using PUBLIC_HOST here means the browser
+      # resolves the ICE candidate to Cloudflare's edge and the WHIP HTTP
+      # handshake succeeds while media silently never arrives — set
+      # MEDIAMTX_WEBRTC_HOST in .env.
+      MTX_WEBRTCADDITIONALHOSTS: ${MEDIAMTX_WEBRTC_HOST:-localhost}
     volumes:
       - ./mediamtx/mediamtx.yml:/mediamtx.yml:ro
       - mediamtx-recordings:/recordings
diff --git a/mediamtx/mediamtx.yml b/mediamtx/mediamtx.yml
index 8a48890..63df3d3 100644
--- a/mediamtx/mediamtx.yml
+++ b/mediamtx/mediamtx.yml
@@ -39,6 +39,9 @@ webrtc: yes
 webrtcAddress: :8889
 webrtcLocalUDPAddress: :8189
 webrtcAllowOrigins: ["*"]
+# webrtcAdditionalHosts is set via MTX_WEBRTCADDITIONALHOSTS in
+# docker-compose.yml (MEDIAMTX_WEBRTC_HOST in .env) — see the comment there
+# for why it must be the raw IP, not the Cloudflare-proxied domain.
 
 # ---- recording -----------------------------------------------------------
 pathDefaults: