diff --git a/build.rs b/build.rs
index 3e9eb38c..3408703e 100644
--- a/build.rs
+++ b/build.rs
@@ -64,25 +64,6 @@ fn generate_secrets() {
 pub mod ice {
     /// Google public STUN server URL (hardcoded)
     pub const STUN_SERVER: &str = "stun:stun.l.google.com:19302";
-
-    /// TURN server URLs - not provided, users must configure their own
-    pub const TURN_URLS: &str = "";
-
-    /// TURN authentication username
-    pub const TURN_USERNAME: &str = "";
-
-    /// TURN authentication password
-    pub const TURN_PASSWORD: &str = "";
-
-    /// Always returns true since we have STUN
-    pub const fn is_configured() -> bool {
-        true
-    }
-
-    /// Always returns false since TURN is not provided
-    pub const fn has_turn() -> bool {
-        false
-    }
 }
 
 /// RustDesk public server configuration - NOT PROVIDED
diff --git a/src/main.rs b/src/main.rs
index 34fc6a74..22f95130 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -288,23 +288,12 @@ async fn main() -> anyhow::Result<()> {
                     .map(|s| !s.is_empty())
                     .unwrap_or(false);
 
-                // If no custom servers, use public ICE servers (like RustDesk)
+                // If no custom servers, use baked-in public STUN
                 if !has_custom_stun && !has_custom_turn {
                     use one_kvm::webrtc::config::public_ice;
-                    if public_ice::is_configured() {
-                        if let Some(stun) = public_ice::stun_server() {
-                            stun_servers.push(stun.clone());
-                            tracing::info!("Using public STUN server: {}", stun);
-                        }
-                        for turn in public_ice::turn_servers() {
-                            tracing::info!("Using public TURN server: {:?}", turn.urls);
-                            turn_servers.push(turn);
-                        }
-                    } else {
-                        tracing::info!(
-                            "No public ICE servers configured, using host candidates only"
-                        );
-                    }
+                    let stun = public_ice::stun_server().to_string();
+                    tracing::info!("Using public STUN server: {}", stun);
+                    stun_servers.push(stun);
                 } else {
                     // Use custom servers
                     if let Some(ref stun) = config.stream.stun_server {
@@ -342,7 +331,7 @@ async fn main() -> anyhow::Result<()> {
         };
         WebRtcStreamer::with_config(webrtc_config)
     };
-    tracing::info!("WebRTC streamer created (supports H264, extensible to VP8/VP9/H265)");
+    tracing::info!("WebRTC streamer created");
 
     // Create OTG Service (single instance for centralized USB gadget management)
     let otg_service = Arc::new(OtgService::new());
diff --git a/src/web/handlers/mod.rs b/src/web/handlers/mod.rs
index a99dc30e..0c66ef77 100644
--- a/src/web/handlers/mod.rs
+++ b/src/web/handlers/mod.rs
@@ -2048,14 +2048,12 @@ pub async fn webrtc_ice_servers(State(state): State<Arc<AppState>>) -> Json<IceS
             }
         }
     } else {
-        // No custom servers configured - use Google STUN as default
-        if let Some(stun) = public_ice::stun_server() {
-            ice_servers.push(IceServerInfo {
-                urls: vec![stun],
-                username: None,
-                credential: None,
-            });
-        }
+        // No custom servers — baked-in public STUN
+        ice_servers.push(IceServerInfo {
+            urls: vec![public_ice::stun_server().to_string()],
+            username: None,
+            credential: None,
+        });
         // Note: TURN servers are not provided - users must configure their own
     }
 
diff --git a/src/webrtc/config.rs b/src/webrtc/config.rs
index 86b41a91..a5eef254 100644
--- a/src/webrtc/config.rs
+++ b/src/webrtc/config.rs
@@ -2,42 +2,18 @@
 
 use serde::{Deserialize, Serialize};
 
-use crate::secrets;
-
-/// ICE server utilities - Only provides Google STUN, no TURN
+/// ICE server utilities — public STUN only (TURN must be user-configured).
 pub mod public_ice {
-    use super::*;
-
-    /// Always returns true (we have Google STUN)
+    /// Whether a build-time public STUN URL exists (always true for stock builds).
+    #[inline]
     pub fn is_configured() -> bool {
-        secrets::ice::is_configured()
+        true
     }
 
-    /// Always returns false (TURN not provided)
-    pub fn has_turn() -> bool {
-        secrets::ice::has_turn()
-    }
-
-    /// Get the Google STUN server URL
-    pub fn stun_server() -> Option<String> {
-        let server = secrets::ice::STUN_SERVER;
-        if server.is_empty() {
-            None
-        } else {
-            Some(server.to_string())
-        }
-    }
-
-    /// Always returns empty vector (TURN not provided)
-    pub fn turn_servers() -> Vec<TurnServer> {
-        vec![]
-    }
-
-    /// Get all public ICE servers (STUN only, no TURN)
-    pub fn get_all_servers() -> (Vec<String>, Vec<TurnServer>) {
-        let stun_servers = stun_server().into_iter().collect();
-        let turn_servers = vec![];
-        (stun_servers, turn_servers)
+    /// Build-time public STUN URL (`secrets::ice::STUN_SERVER`).
+    #[inline]
+    pub fn stun_server() -> &'static str {
+        crate::secrets::ice::STUN_SERVER
     }
 }
 
diff --git a/src/webrtc/webrtc_streamer.rs b/src/webrtc/webrtc_streamer.rs
index 553be30e..e4a34958 100644
--- a/src/webrtc/webrtc_streamer.rs
+++ b/src/webrtc/webrtc_streamer.rs
@@ -759,7 +759,7 @@ impl WebRtcStreamer {
     /// Note: Changes take effect for new sessions only.
     /// Existing sessions need to be reconnected to use the new ICE config.
     ///
-    /// If both stun_server and turn_server are empty/None, uses public ICE servers.
+    /// If both stun_server and turn_server are empty/None, uses baked-in public STUN.
     pub async fn update_ice_config(
         &self,
         stun_server: Option<String>,
@@ -777,21 +777,12 @@ impl WebRtcStreamer {
         let has_custom_stun = stun_server.as_ref().map(|s| !s.is_empty()).unwrap_or(false);
         let has_custom_turn = turn_server.as_ref().map(|s| !s.is_empty()).unwrap_or(false);
 
-        // If no custom servers, use public ICE servers (like RustDesk)
+        // If no custom servers, use baked-in public STUN
         if !has_custom_stun && !has_custom_turn {
             use crate::webrtc::config::public_ice;
-            if public_ice::is_configured() {
-                if let Some(stun) = public_ice::stun_server() {
-                    config.webrtc.stun_servers.push(stun.clone());
-                    info!("Using public STUN server: {}", stun);
-                }
-                for turn in public_ice::turn_servers() {
-                    info!("Using public TURN server: {:?}", turn.urls);
-                    config.webrtc.turn_servers.push(turn);
-                }
-            } else {
-                info!("No public ICE servers configured, using host candidates only");
-            }
+            let stun = public_ice::stun_server().to_string();
+            info!("Using public STUN server: {}", stun);
+            config.webrtc.stun_servers.push(stun);
         } else {
             // Use custom servers
             if let Some(ref stun) = stun_server {