diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9f7e4d1..29c60d4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [Unreleased]
+
+### Changed
+- Element Calling: pin LiveKit to 1.13.6 and advertise the LAN interface
+  (rtc.advertise_internal_ip) so Wi-Fi callers get a local ICE candidate and
+  calls no longer depend on router NAT hairpin
+- Element Calling: use a single UDP media mux (7882); move the TURN relay to
+  40000-40099 and remove the unreachable 5349 TURN/TLS listener
+- Hub: update Element Calling router-port guidance to the new port set
+
+### Fixed
+- Element Calling: TURN relay could not deliver media to the SFU on routers
+  without NAT loopback (turn.allow_restricted_peer_cidrs now permits the LAN
+  subnet derived from the primary interface)
+
 ## [1.1.3] - 2026-08-27
 
 ### Added
diff --git a/app/sovran_systemsos_web/server.py b/app/sovran_systemsos_web/server.py
index 9931f53..9bdc7e8 100644
--- a/app/sovran_systemsos_web/server.py
+++ b/app/sovran_systemsos_web/server.py
@@ -1112,7 +1112,7 @@ def _get_firewall_allowed_ports() -> dict[str, set[int]]:
         )
         if proc.returncode == 0:
             for line in proc.stdout.splitlines():
-                # e.g. ACCEPT tcp  -- ... dpt:443  or  dpts:7882:7894
+                # e.g. ACCEPT tcp  -- ... dpt:443  or  dpts:40000:40099
                 m = re.search(r'(tcp|udp).*dpts?:(\d+)(?::(\d+))?', line)
                 if m:
                     proto_match = m.group(1)
@@ -1170,7 +1170,7 @@ def _resolve_all_addresses_cached(domain: str) -> list[str]:
 
 
 def _port_range_to_ints(port_str: str) -> list[int]:
-    """Convert a port string like ``"443"``, ``"30000-40000"`` to a list of ints."""
+    """Convert a port string like ``"443"``, ``"40000-40099"`` to a list of ints."""
     port_str = port_str.strip()
     if re.match(r'^\d+$', port_str):
         return [int(port_str)]
diff --git a/app/sovran_systemsos_web/static/js/helpers.js b/app/sovran_systemsos_web/static/js/helpers.js
index 974711b..8d9ed68 100644
--- a/app/sovran_systemsos_web/static/js/helpers.js
+++ b/app/sovran_systemsos_web/static/js/helpers.js
@@ -88,7 +88,7 @@ function renderPortForwardGuideHtml(ports, opts) {
     '<ul class="port-req-steps">' +
       '<li>Set the <strong>internal (private) port</strong> and the <strong>external (public) port</strong> to the <strong>same number</strong>.</li>' +
       '<li>Match the <strong>protocol</strong> exactly — a rule set to TCP will not pass UDP traffic. Where the table says <strong>TCP + UDP</strong>, create both rules (or pick &ldquo;Both&rdquo;/&ldquo;TCP/UDP&rdquo; if your router offers it).</li>' +
-      '<li>For a range such as <strong>30000-40000</strong>, use your router&rsquo;s port-range fields — start 30000, end 40000 — rather than one rule per port.</li>' +
+      '<li>For a range such as <strong>40000-40099</strong>, use your router&rsquo;s port-range fields — start 40000, end 40099 — rather than one rule per port.</li>' +
     '</ul>' +
     '<table class="' + tableClass + '">' +
       '<thead><tr><th>Port(s)</th><th>Protocol</th><th>Used for</th></tr></thead>' +
diff --git a/app/sovran_systemsos_web/versions.json b/app/sovran_systemsos_web/versions.json
index b6cc3ed..fb7af4b 100644
--- a/app/sovran_systemsos_web/versions.json
+++ b/app/sovran_systemsos_web/versions.json
@@ -10,7 +10,7 @@
   "albyhub.service": "1.24.0",
   "mempool.service": "3.2.1",
   "matrix-synapse.service": "1.115.0",
-  "livekit.service": "1.5.2",
+  "livekit.service": "1.13.6",
   "vaultwarden.service": "1.32.0",
   "haven-relay.service": "0.1.0"
 }