diff --git a/app/matrix/lib/synapse.libsonnet b/app/matrix/lib/synapse.libsonnet
index 71d03d7..0b05795 100644
--- a/app/matrix/lib/synapse.libsonnet
+++ b/app/matrix/lib/synapse.libsonnet
@@ -69,6 +69,13 @@
             server_url: "https://%s/_cas" % [cfg.webDomain],
             service_url: "https://%s" % [cfg.webDomain],
         },
+    } else {}) + (if cfg.coturn.enable then {
+        turn_uris: [ "turn:%s?transport=udp" % cfg.coturn.config.domain, "turn:%s?transport=tcp" % cfg.coturn.config.domain ],
+
+        # Lifetime of single TURN user credentials - 1 day, recommended by TURN REST
+        # spec, see https://datatracker.ietf.org/doc/html/draft-uberti-behave-turn-rest-00#section-2.2
+        turn_user_lifetime: 24 * 60 * 60 * 1000,
+        turn_allow_guests: true,
     } else {}),
 
     configMap: app.ns.Contain(kube.ConfigMap("synapse")) {
@@ -87,6 +94,8 @@
             enabled: true,
             client_secret: "$(OIDC_CLIENT_SECRET)",
         },
+    } else {}) + (if cfg.coturn.enable then {
+        turn_shared_secret: "$(TURN_SHARED_SECRET)",
     } else {}),
 
     # Synapse process Deployment/StatefulSet base resource.
@@ -151,6 +160,7 @@
                                 REDIS_PASSWORD: app.redis.cfg.password,
                                 POD_NAME: { fieldRef: { fieldPath: "metadata.name" } },
                                 OIDC_CLIENT_SECRET: if cfg.oidc.enable then cfg.oidc.config.client_secret else "",
+                                TURN_SHARED_SECRET: if cfg.coturn.enable then cfg.coturn.config.authSecret else "",
 
                                 X_SECRETS_CONFIG: std.manifestYamlDoc(app.secretsConfig),
                                 X_LOCAL_CONFIG: std.manifestYamlDoc(worker.cfg.localConfig),