diff --git a/app/webrtc/subsystem.go b/app/webrtc/subsystem.go
index 9c7e34e..800c4e2 100644
--- a/app/webrtc/subsystem.go
+++ b/app/webrtc/subsystem.go
@@ -85,6 +85,14 @@ func New(dataCfg config.DataWebRTC, logger log.Logger) (*Subsystem, error) {
 	}
 	coreCfg.NAT1To1IPs = nat1to1IPs
 
+	// If the operator supplied explicit ICE server URIs via config/env,
+	// override the built-in defaults (typically Google's public STUN servers).
+	// An empty list means "keep the built-in defaults".
+	if len(dataCfg.ICEServers) > 0 {
+		coreCfg.ICEServers = make([]string, len(dataCfg.ICEServers))
+		copy(coreCfg.ICEServers, dataCfg.ICEServers)
+	}
+
 	factory, err := corewebrtc.NewPeerFactory(coreCfg)
 	if err != nil {
 		return nil, fmt.Errorf("webrtc subsystem: build peer factory: %w", err)
@@ -190,9 +198,11 @@ func (s *Subsystem) StreamCount() int {
 }
 
 // ICEServerURIs returns the ICE server URI list from the core config.
-// Used by the WHEP handler to emit RFC 9429 §4.3 Link headers so that
-// browsers can discover STUN/TURN servers without a separate signalling
-// round-trip.
+// Used by the WHEP and WHIP handlers to emit RFC 9429 / RFC 9261 Link
+// headers so that browsers can discover STUN/TURN servers without a
+// separate signalling round-trip. If the operator configured explicit
+// servers via CORE_WEBRTC_ICE_SERVERS those are returned; otherwise
+// the built-in Pion defaults are returned.
 func (s *Subsystem) ICEServerURIs() []string {
 	return s.coreCfg.ICEServers
 }