diff --git a/config/config.go b/config/config.go
index cfc4698..d026b4e 100644
--- a/config/config.go
+++ b/config/config.go
@@ -98,6 +98,7 @@ func (d *Config) Clone() *Config {
 	data.Storage = d.Storage
 	data.RTMP = d.RTMP
 	data.SRT = d.SRT
+	data.WebRTC = d.WebRTC
 	data.FFmpeg = d.FFmpeg
 	data.Playout = d.Playout
 	data.Debug = d.Debug
@@ -131,6 +132,8 @@ func (d *Config) Clone() *Config {
 
 	data.SRT.Log.Topics = copy.Slice(d.SRT.Log.Topics)
 
+	data.WebRTC.NAT1To1IPs = copy.Slice(d.WebRTC.NAT1To1IPs)
+
 	data.Router.BlockedPrefixes = copy.Slice(d.Router.BlockedPrefixes)
 	data.Router.Routes = copy.StringMap(d.Router.Routes)
 
diff --git a/config/config_test.go b/config/config_test.go
index 132857f..a88298b 100644
--- a/config/config_test.go
+++ b/config/config_test.go
@@ -56,6 +56,33 @@ func TestConfigCopy(t *testing.T) {
 	require.Equal(t, []string{"foo.com"}, config2.Host.Name)
 }
 
+// TestConfigCopyWebRTC is a regression test for Clone() silently dropping the
+// WebRTC Data section. The first live M2 deploy surfaced this: env vars bound
+// correctly onto the original Config, but Core handed the clone to app/api, so
+// cfg.WebRTC.Enable was always the zero value and the subsystem was skipped.
+func TestConfigCopyWebRTC(t *testing.T) {
+	fs, _ := fs.NewMemFilesystem(fs.MemConfig{})
+	config1 := New(fs)
+
+	config1.WebRTC.Enable = true
+	config1.WebRTC.PublicIP = "10.0.0.25"
+	config1.WebRTC.NAT1To1IPs = []string{"10.0.0.25", "203.0.113.10"}
+	config1.WebRTC.UDPMuxPort = 45000
+
+	config2 := config1.Clone()
+
+	require.Equal(t, true, config2.WebRTC.Enable)
+	require.Equal(t, "10.0.0.25", config2.WebRTC.PublicIP)
+	require.Equal(t, []string{"10.0.0.25", "203.0.113.10"}, config2.WebRTC.NAT1To1IPs)
+	require.Equal(t, 45000, config2.WebRTC.UDPMuxPort)
+
+	// NAT1To1IPs is a slice — mutating the clone must not affect the
+	// source, which is what every other section guarantees via
+	// copy.Slice. Same contract for WebRTC.
+	config2.WebRTC.NAT1To1IPs[0] = "mutated"
+	require.Equal(t, "10.0.0.25", config1.WebRTC.NAT1To1IPs[0])
+}
+
 func TestValidateDefault(t *testing.T) {
 	fs, err := fs.NewMemFilesystem(fs.MemConfig{})
 	require.NoError(t, err)