diff --git a/pkg/rtc/participant.go b/pkg/rtc/participant.go
index b5c82918f..42e2c2aad 100644
--- a/pkg/rtc/participant.go
+++ b/pkg/rtc/participant.go
@@ -1039,11 +1039,14 @@ func (p *ParticipantImpl) setupTransportManager() error {
 	tm.OnICEConfigChanged(func(iceConfig types.IceConfig) {
 		p.lock.Lock()
 		onICEConfigChanged := p.onICEConfigChanged
+
+		if p.params.ClientConf == nil {
+			p.params.ClientConf = &livekit.ClientConfiguration{}
+		}
 		if iceConfig.PreferSub == types.PreferTls {
-			if p.params.ClientConf == nil {
-				p.params.ClientConf = &livekit.ClientConfiguration{}
-			}
 			p.params.ClientConf.ForceRelay = livekit.ClientConfigSetting_ENABLED
+		} else {
+			p.params.ClientConf.ForceRelay = livekit.ClientConfigSetting_DISABLED
 		}
 		p.lock.Unlock()
 
diff --git a/pkg/service/roommanager.go b/pkg/service/roommanager.go
index ccd75adeb..737331498 100644
--- a/pkg/service/roommanager.go
+++ b/pkg/service/roommanager.go
@@ -595,7 +595,7 @@ func (r *RoomManager) iceServersForRoom(ri *livekit.Room, tlsOnly bool) []*livek
 			urls = append(urls, fmt.Sprintf("turn:%s:%d?transport=udp", r.config.RTC.NodeIP, r.config.TURN.UDPPort))
 		}
 		if r.config.TURN.TLSPort > 0 {
-			urls = append(urls, fmt.Sprintf("turns:%s:%d?transport=tcp", r.config.TURN.Domain, r.config.TURN.TLSPort))
+			urls = append(urls, fmt.Sprintf("turns:%s:443?transport=tcp", r.config.TURN.Domain))
 		}
 		if len(urls) > 0 {
 			iceServers = append(iceServers, &livekit.ICEServer{