diff --git a/deploy/install.sh b/deploy/install.sh
index e3f7387..6b38f92 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -292,7 +292,13 @@ resolve_derived_values() {
     TURN_DOMAIN_RESOLVED="${TURN_DOMAIN_OVERRIDE:-turn.${DOMAIN}}"
     TURN_CERT_DIR="${TARGET_DIR}/certs"
     TURN_RELAY_HOST_RESOLVED="${TURN_RELAY_HOST}"
-    turn_shared_secret >/dev/null
+    TURN_RELAY_USER="${TURN_RELAY_USER:-glchat}"
+    tun_relay_password_from_env=""
+    if [ -f "$GLCHAT_ENV_FILE" ]; then
+        tun_relay_password_from_env="$(env_get TURN_RELAY_PASSWORD || true)"
+    fi
+    TURN_RELAY_PASSWORD="${TURN_RELAY_PASSWORD:-$tun_relay_password_from_env}"
+    [ -n "$TURN_RELAY_PASSWORD" ] || TURN_RELAY_PASSWORD="$(rand_base64 24)"
 
     disable_simulcast="true"
     if [ "${PROFILE_LIVEKIT_SIMULCAST:-0}" -gt 0 ] 2>/dev/null; then
@@ -329,7 +335,8 @@ resolve_derived_values() {
         PROFILE_LIVEKIT_DISABLE_SIMULCAST PROFILE_LIVEKIT_USE_EXTERNAL_IP \
         GLCHAT_DATA_DIR GLCHAT_CADDY_PROFILE GLCHAT_TURN_CERT_DIR \
         GLCHAT_APP_BIND GLCHAT_LIVEKIT_BIND TLS_ENABLED \
-        TURN_DOMAIN_RESOLVED TURN_CERT_DIR TURN_RELAY_HOST_RESOLVED TURN_SECRET_RESOLVED
+        TURN_DOMAIN_RESOLVED TURN_CERT_DIR TURN_RELAY_HOST_RESOLVED TURN_SECRET_RESOLVED \
+        TURN_RELAY_USER TURN_RELAY_PASSWORD
 }
 
 validate_inputs() {
@@ -658,7 +665,8 @@ TOTP_ENCRYPTION_KEY=@TOTP_ENCRYPTION_KEY@
 WEBHOOK_SECRET=@WEBHOOK_SECRET@
 LIVEKIT_API_KEY=@LIVEKIT_API_KEY@
 LIVEKIT_API_SECRET=@LIVEKIT_API_SECRET@
-TURN_SECRET=@TURN_SECRET@
+TURN_RELAY_USER=@TURN_RELAY_USER@
+TURN_RELAY_PASSWORD=@TURN_RELAY_PASSWORD@
 AGE_RECIPIENT=@AGE_RECIPIENT@
 
 # --- профиль производительности ---
@@ -888,10 +896,10 @@ ensure_swap() {
 render_turn_relay_servers() {
     [ -n "$TURN_RELAY_HOST" ] || return 0
     printf '  turn_servers:\n'
-    printf '    - host: %s\n      port: %s\n      protocol: udp\n      shared_secret: %s\n' \
-        "$TURN_RELAY_HOST" "$TURN_RELAY_PORT" "$TURN_SECRET_RESOLVED"
-    printf '    - host: %s\n      port: %s\n      protocol: tls\n      shared_secret: %s\n' \
-        "$TURN_RELAY_HOST" "$TURN_RELAY_TLS_PORT" "$TURN_SECRET_RESOLVED"
+    printf '    - host: %s\n      port: %s\n      protocol: udp\n      username: %s\n      credential: %s\n' \
+        "$TURN_RELAY_HOST" "$TURN_RELAY_PORT" "$TURN_RELAY_USER" "$TURN_RELAY_PASSWORD"
+    printf '    - host: %s\n      port: %s\n      protocol: tls\n      username: %s\n      credential: %s\n' \
+        "$TURN_RELAY_HOST" "$TURN_RELAY_TLS_PORT" "$TURN_RELAY_USER" "$TURN_RELAY_PASSWORD"
 }
 
 # turn_shared_secret — общий секрет для coturn (use-auth-secret) и LiveKit.