diff --git a/roles/web-app-matrix/meta/services.yml b/roles/web-app-matrix/meta/services.yml
index 99fa5b916a..78277d71ba 100644
--- a/roles/web-app-matrix/meta/services.yml
+++ b/roles/web-app-matrix/meta/services.yml
@@ -18,10 +18,14 @@ matomo:
 email:
   enabled: "{{ 'web-app-mailu' in group_names }}"
   shared: "{{ 'web-app-mailu' in group_names }}"
+# nocheck: playwright-service-flag — TURN/STUN server, no Playwright surface (provider: web-svc-coturn)
+coturn:
+  enabled: "{{ 'web-svc-coturn' in group_names }}"
+  shared: "{{ 'web-svc-coturn' in group_names }}"
 # nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
 postgres:
-  enabled: true # nocheck: dynamic-flag
-  shared: true # nocheck: dynamic-flag — matrix requires central postgres for both flavors
+  enabled: true # nocheck: dynamic-flag — matrix always needs a database
+  shared: "{{ 'svc-db-postgres' in group_names }}"
 synapse:
   version: latest
   image: matrixdotorg/synapse
@@ -76,8 +80,8 @@ prometheus:
 matrix:
   flavor: ansible
   upstream:
-    repo: https://github.com/spantaleev/matrix-docker-ansible-deploy
-    ref: 9634cc3f7956e312eaf04647d85cbab46173f2e9
+    repo: https://github.com/kevinveenbirkenbach/matrix-docker-ansible-deploy
+    ref: master
     migration_validated_version: v2026.05.18.0
   runner:
     image: infinito/web-app-matrix-mdad-runner:1
diff --git a/roles/web-app-matrix/meta/variants.yml b/roles/web-app-matrix/meta/variants.yml
index 1427c22fd8..421828475d 100644
--- a/roles/web-app-matrix/meta/variants.yml
+++ b/roles/web-app-matrix/meta/variants.yml
@@ -2,6 +2,9 @@
 - services:
     matrix:
       flavor: ansible
+    coturn:
+      enabled: true
+      shared: true
     css:
       enabled: true
       shared: true
@@ -20,6 +23,8 @@
     matomo:
       enabled: true
       shared: true
+    postgres:
+      shared: true
     sso:
       enabled: true
       shared: true
@@ -30,6 +35,9 @@
 - services:
     matrix:
       flavor: ansible
+    coturn:
+      enabled: false
+      shared: false
     css:
       enabled: false
       shared: false
@@ -48,6 +56,8 @@
     matomo:
       enabled: false
       shared: false
+    postgres:
+      shared: false
     sso:
       enabled: false
       shared: false
@@ -58,6 +68,9 @@
 - services:
     matrix:
       flavor: compose
+    coturn:
+      enabled: true
+      shared: true
     css:
       enabled: true
       shared: true
@@ -76,6 +89,8 @@
     matomo:
       enabled: true
       shared: true
+    postgres:
+      shared: true
     sso:
       enabled: true
       shared: true
diff --git a/roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2 b/roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2
index 4af87d21a0..3d73c33ac5 100644
--- a/roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2
+++ b/roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2
@@ -22,7 +22,21 @@ matrix_synapse_database_user: "{{ MATRIX_POSTGRES_USER }}"
 matrix_synapse_database_password: "{{ MATRIX_POSTGRES_PASSWORD }}"
 matrix_synapse_database_database: "{{ MATRIX_POSTGRES_DATABASE }}"
 
+matrix_homeserver_container_network: host
 matrix_synapse_container_network: host
+matrix_client_element_container_network: host
+matrix_coturn_docker_network: host
+
+{% if MATRIX_COTURN_SHARED %}
+matrix_coturn_enabled: false
+matrix_synapse_turn_uris:
+  - "turn:{{ MATRIX_COTURN_HOST }}:{{ MATRIX_COTURN_STUN_TURN_PORT }}?transport=udp"
+  - "turn:{{ MATRIX_COTURN_HOST }}:{{ MATRIX_COTURN_STUN_TURN_PORT }}?transport=tcp"
+  - "turns:{{ MATRIX_COTURN_HOST }}:{{ MATRIX_COTURN_STUN_TURN_TLS_PORT }}?transport=udp"
+  - "turns:{{ MATRIX_COTURN_HOST }}:{{ MATRIX_COTURN_STUN_TURN_TLS_PORT }}?transport=tcp"
+matrix_synapse_turn_shared_secret: "{{ MATRIX_COTURN_AUTH_SECRET }}"
+{% endif %}
+
 matrix_synapse_container_client_api_host_bind_port: "0.0.0.0:{{ MATRIX_SYNAPSE_PORT }}"
 matrix_synapse_container_federation_api_plain_host_bind_port: "0.0.0.0:{{ MATRIX_FEDERATION_PORT }}"
 matrix_client_element_container_http_host_bind_port: "0.0.0.0:{{ MATRIX_ELEMENT_PORT }}"
diff --git a/roles/web-app-matrix/vars/main.yml b/roles/web-app-matrix/vars/main.yml
index 18db30f3e3..b9ef6187d7 100644
--- a/roles/web-app-matrix/vars/main.yml
+++ b/roles/web-app-matrix/vars/main.yml
@@ -61,6 +61,12 @@ MATRIX_POSTGRES_USER: "{{ lookup('database', application_id, 'username') }}"
 MATRIX_POSTGRES_PASSWORD: "{{ lookup('database', application_id, 'password') }}"
 MATRIX_POSTGRES_DATABASE: "{{ lookup('database', application_id, 'name') }}"
 
+MATRIX_COTURN_SHARED: "{{ lookup('config', application_id, 'services.coturn.shared') | bool }}"
+MATRIX_COTURN_HOST: "{{ lookup('domain', 'web-svc-coturn') if MATRIX_COTURN_SHARED else '' }}"
+MATRIX_COTURN_STUN_TURN_PORT: "{{ lookup('config', 'web-svc-coturn', 'services.coturn.ports.public.stun_turn') if MATRIX_COTURN_SHARED else '' }}"
+MATRIX_COTURN_STUN_TURN_TLS_PORT: "{{ lookup('config', 'web-svc-coturn', 'services.coturn.ports.public.stun_turn_tls') if MATRIX_COTURN_SHARED else '' }}"
+MATRIX_COTURN_AUTH_SECRET: "{{ lookup('config', 'web-svc-coturn', 'credentials.auth_secret') if MATRIX_COTURN_SHARED else '' }}"
+
 MATRIX_OUTBOUND_MAIL_ENABLED: "{{ lookup('config', application_id, 'services.email.enabled') | bool }}"
 MATRIX_OUTBOUND_MAIL: "{{ lookup('email', application_id) if MATRIX_OUTBOUND_MAIL_ENABLED else {} }}"
 MATRIX_OUTBOUND_MAIL_HOST: "{{ MATRIX_OUTBOUND_MAIL.host | default('') }}"