diff --git a/infra/occupymedia/docker-compose.app.yml b/infra/occupymedia/docker-compose.app.yml
index 5caed5e..c14bca7 100644
--- a/infra/occupymedia/docker-compose.app.yml
+++ b/infra/occupymedia/docker-compose.app.yml
@@ -191,7 +191,9 @@ services:
 
   cloudflared:
     image: cloudflare/cloudflared:latest
-    command: ["tunnel", "--no-autoupdate", "run", "--token", "${CLOUDFLARE_TUNNEL_TOKEN:?}"]
+    # http2 (TCP) instead of QUIC: the upstream drops UDP/large datagrams,
+    # which stalls tunnel responses. Revisit if the path heals.
+    command: ["tunnel", "--no-autoupdate", "--protocol", "http2", "run", "--token", "${CLOUDFLARE_TUNNEL_TOKEN:?}"]
     restart: unless-stopped
 
 volumes: