diff --git a/hosts/heather/arion-compose.nix b/hosts/heather/arion-compose.nix
index f9b8acb..bbced41 100644
--- a/hosts/heather/arion-compose.nix
+++ b/hosts/heather/arion-compose.nix
@@ -183,6 +183,9 @@
         TURN_HOST = "51.250.45.111";
         TURN_PORT = "3478";
         TURN_TRANSPORT = "udp";
+        # Guest access: unauthenticated users join via guest domain, wait in
+        # lobby until a moderator (mikl) authenticates and admits them.
+        ENABLE_GUESTS = "1";
       };
     };
 
@@ -194,6 +197,10 @@
       service.volumes = [
         "jitsi-prosody-config:/config"
         "jitsi-prosody-data:/var/lib/prosody"
+        # Patched prosody template: guest VirtualHost gets "websocket" module
+        # (upstream bug — guest domain lacks it → wss disconnect loop).
+        # Patched file at /var/lib/jitsi-secrets/jitsi-meet.cfg.lua.template
+        "/var/lib/jitsi-secrets/jitsi-meet.cfg.lua.template:/defaults/conf.d/jitsi-meet.cfg.lua:ro"
       ];
       service.networks.meet-jitsi.aliases = [ "xmpp.meet.jitsi" ];
       service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ];
@@ -204,6 +211,7 @@
         AUTH_TYPE = "internal";
         ENABLE_XMPP_WEBSOCKET = "1";
         ENABLE_IPV6 = "0";
+        ENABLE_GUESTS = "1";
       };
     };
 
@@ -220,6 +228,7 @@
         TZ = "Europe/Moscow";
         ENABLE_AUTH = "1";
         AUTH_TYPE = "internal";
+        ENABLE_GUESTS = "1";
       };
     };