diff --git a/app/webrtc/handler_test.go b/app/webrtc/handler_test.go
index 1d19a08..6d7ab4d 100644
--- a/app/webrtc/handler_test.go
+++ b/app/webrtc/handler_test.go
@@ -110,6 +110,45 @@ func TestSubsystem_ICEServerURIs_ReturnsConfiguredURIs(t *testing.T) {
 	}
 }
 
+// TestSubsystem_ICEServers_OperatorOverride verifies that when the operator
+// supplies ICEServers via config (CORE_WEBRTC_ICE_SERVERS), those URIs
+// completely replace the built-in STUN defaults rather than being appended.
+// This exercises the override branch added in subsystem.New for issue #23.
+func TestSubsystem_ICEServers_OperatorOverride(t *testing.T) {
+	custom := []string{
+		"stun:stun.example.com:3478",
+		"turn:user:secret@turn.example.com:3478",
+	}
+	sub, err := New(config.DataWebRTC{
+		Enable:     true,
+		ICEServers: custom,
+	}, nil)
+	if err != nil {
+		t.Fatalf("New with custom ICEServers: %v", err)
+	}
+
+	uris := sub.ICEServerURIs()
+
+	if len(uris) != len(custom) {
+		t.Fatalf("expected %d URIs (custom), got %d: %v", len(custom), len(uris), uris)
+	}
+	for i, want := range custom {
+		if uris[i] != want {
+			t.Errorf("ICEServerURIs[%d]: want %q, got %q", i, want, uris[i])
+		}
+	}
+
+	// Confirm the built-in defaults are NOT present.
+	defaults := corewebrtc.DefaultConfig().ICEServers
+	for _, def := range defaults {
+		for _, got := range uris {
+			if got == def {
+				t.Errorf("built-in default URI %q should have been replaced but was found in override list", def)
+			}
+		}
+	}
+}
+
 // TestAddCORS_ExposesLinkHeader verifies that CORS preflight responses
 // include "Link" in Access-Control-Expose-Headers so browsers can read
 // the RFC 9429 §4.3 Link headers returned on the 201 Subscribe response.