diff --git a/Dockerfile b/Dockerfile
index 75012f7..21ecce2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,6 +19,7 @@ ENV DERP_CERT_MODE letsencrypt
 ENV DERP_CERT_DIR /app/certs
 ENV DERP_ADDR :443
 ENV DERP_STUN true
+ENV DERP_STUN_PORT 3478
 ENV DERP_HTTP_PORT 80
 ENV DERP_VERIFY_CLIENTS false
 
@@ -29,6 +30,7 @@ CMD /app/derper --hostname=$DERP_DOMAIN \
     --certdir=$DERP_CERT_DIR \
     --a=$DERP_ADDR \
     --stun=$DERP_STUN  \
+    --stun-port=$DERP_STUN_PORT \
     --http-port=$DERP_HTTP_PORT \
     --verify-clients=$DERP_VERIFY_CLIENTS
 
diff --git a/README.md b/README.md
index 6ef9787..1acf13f 100644
--- a/README.md
+++ b/README.md
@@ -19,6 +19,7 @@ docker run -e DERP_DOMAIN=derper.your-domain.com -p 80:80 -p 443:443 -p 3478:347
 | DERP_CERT_MODE      | false    | mode for getting a cert. possible options: manual, letsencrypt         | letsencrypt       |
 | DERP_ADDR           | false    | listening server address                                               | :443              |
 | DERP_STUN           | false    | also run a STUN server                                                 | true              |
+| DERP_STUN_PORT      | false    | The UDP port on which to serve STUN.                                   | 3478              |
 | DERP_HTTP_PORT      | false    | The port on which to serve HTTP. Set to -1 to disable                  | 80                |
 | DERP_VERIFY_CLIENTS | false    | verify clients to this DERP server through a local tailscaled instance | false             |