diff --git a/sim/cluster0/scripts/deploy-coturn.sh b/sim/cluster0/scripts/deploy-coturn.sh
new file mode 100755
index 0000000..b39fdcb
--- /dev/null
+++ b/sim/cluster0/scripts/deploy-coturn.sh
@@ -0,0 +1,73 @@
+#!/bin/sh
+# STUN/TURN (coturn) on cast02 — co-located with Janus SFU for lab NAT traversal.
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=/dev/null
+. "$ROOT/scripts/lib/common.sh"
+load_cluster_env
+
+install_coturn_on_cast02() {
+  [ "$(host_short)" = "$CAST02_HOST" ] || return 0
+  log "cast02: install/configure coturn"
+  apk add --no-cache coturn 2>/dev/null || apk add --no-cache turnserver 2>/dev/null || {
+    log "WARN cast02: coturn package not available"
+    return 1
+  }
+
+  TURN_REALM="${LAB_TURN_REALM:-acl0.f0xx.org}"
+  TURN_USER="${LAB_TURN_USER:-acturn}"
+  TURN_SECRET="$(read_cred coturn secret 2>/dev/null || echo 'ac-lab-turn-change-me')"
+  TURN_LISTEN="${CAST02_IP:-127.0.0.1}"
+
+  mkdir -p /etc/coturn
+  cat > /etc/turnserver.conf <<EOF
+# Android Cast lab TURN (cast02) — static auth for WebRTC clients
+listening-port=3478
+tls-listening-port=5349
+listening-ip=${TURN_LISTEN}
+relay-ip=${TURN_LISTEN}
+realm=${TURN_REALM}
+server-name=cast02-turn
+fingerprint
+lt-cred-mech
+user=${TURN_USER}:${TURN_SECRET}
+no-cli
+no-tlsv1
+no-tlsv1_1
+min-port=49152
+max-port=65535
+log-file=/var/log/turnserver.log
+EOF
+
+  rc-update add coturn default 2>/dev/null || rc-update add turnserver default 2>/dev/null || true
+  rc-service coturn restart 2>/dev/null || rc-service turnserver restart 2>/dev/null || true
+  if ss -lun | grep -q ':3478 '; then
+    log "cast02: coturn listening on UDP 3478"
+  else
+    log "WARN cast02: coturn may not be listening (check /var/log/turnserver.log)"
+  fi
+}
+
+write_sfu_turn_config() {
+  WS="${AC_WORKSPACE_ROOT:-/var/www/ac/workspace}/ac-ms-sfu-signaling/config/config.php"
+  [ -f "$WS" ] || return 0
+  TURN_USER="${LAB_TURN_USER:-acturn}"
+  TURN_SECRET="$(read_cred coturn secret 2>/dev/null || echo 'ac-lab-turn-change-me')"
+  TURN_HOST="${CAST02_IP}"
+  if grep -q "'turn_" "$WS" 2>/dev/null; then
+    return 0
+  fi
+  log "append TURN hints to sfu config (clients may still use public STUN)"
+  # shellcheck disable=SC2016
+  sed -i "/];$/i\\
+    'turn_host' => '${TURN_HOST}',\\
+    'turn_port' => 3478,\\
+    'turn_user' => '${TURN_USER}',\\
+    'turn_pass' => '${TURN_SECRET}',\\
+    'stun_urls' => ['stun:stun.l.google.com:19302'],\\
+" "$WS" 2>/dev/null || true
+}
+
+install_coturn_on_cast02
+write_sfu_turn_config
+log "deploy-coturn_ok $(host_short)"
diff --git a/sim/cluster0/scripts/smoke_sfu.sh b/sim/cluster0/scripts/smoke_sfu.sh
new file mode 100755
index 0000000..13af48d
--- /dev/null
+++ b/sim/cluster0/scripts/smoke_sfu.sh
@@ -0,0 +1,28 @@
+#!/bin/sh
+# SFU lab smoke: Janus HTTP + signaling health (run on app node or dev).
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=/dev/null
+. "$ROOT/scripts/lib/common.sh"
+load_cluster_env 2>/dev/null || true
+
+ORIGIN="${LAB_PUBLIC_ORIGIN:-https://apps.f0xx.org}"
+JANUS="${CAST02_IP:-10.7.16.237}"
+FAIL=0
+
+check() {
+  if "$@"; then
+    log "OK: $*"
+  else
+    log "FAIL: $*"
+    FAIL=1
+  fi
+}
+
+check curl -sf "http://${JANUS}:8088/janus/info" | grep -q janus
+check curl -sf "${ORIGIN}/app/androidcast_project/sfu/health" | grep -q '"ok"'
+
+if [ "$FAIL" -ne 0 ]; then
+  exit 1
+fi
+log "smoke_sfu_ok"