diff --git a/src/pages/selfhosted/maintenance/scaling/set-up-external-relays.mdx b/src/pages/selfhosted/maintenance/scaling/set-up-external-relays.mdx
index f714e0402..f410904e8 100644
--- a/src/pages/selfhosted/maintenance/scaling/set-up-external-relays.mdx
+++ b/src/pages/selfhosted/maintenance/scaling/set-up-external-relays.mdx
@@ -12,7 +12,7 @@ For each relay server you want to deploy:
 - Public IP address
 - A domain name pointing to the server (e.g., `relay-us.example.com`)
 - Docker installed
-- Firewall ports open: **80/tcp** (Let's Encrypt HTTP challenge), **443/tcp** (relay), and **3478/udp** (STUN). If you configure multiple STUN ports, open all of them
+- Firewall ports open: **80/tcp** (Let's Encrypt HTTP challenge), **443/tcp** and **443/udp** (relay: WebSocket and QUIC), and **3478/udp** (STUN). If you configure multiple STUN ports, open all of them
 
 ## Generate Authentication Secret
 
@@ -68,7 +68,10 @@ services:
     container_name: netbird-relay
     restart: unless-stopped
     ports:
+      # TCP for the WebSocket transport
       - '443:443'
+      # UDP for QUIC; without the /udp suffix Docker forwards TCP only
+      - '443:443/udp'
       # Expose all ports listed in NB_STUN_PORTS
       - '3478:3478/udp'
     env_file: