diff --git a/docker_entrypoint.sh b/docker_entrypoint.sh
index 3c85bfa..e3ec40e 100755
--- a/docker_entrypoint.sh
+++ b/docker_entrypoint.sh
@@ -51,6 +51,18 @@ ZMQ_ENABLED=$(q '.advanced.zmq-enabled // true')
 TLS_ENABLED=$(q '.tls.enabled // "disabled"')
 TLS_PORT=$(q '.tls.port // 3334')
 
+# Empty MEMPOOL_BASE_URL means "use mempool.space defaults". When the
+# user picks "Custom URL" in advanced config, we surface the value so
+# kamado-api can include it in the snapshot and the UI can rewrite
+# explorer links to point at the user's own mempool instance.
+MEMPOOL_TYPE=$(q '.advanced.mempool-explorer.type // "default"')
+if [[ "${MEMPOOL_TYPE}" == "custom" ]]; then
+    MEMPOOL_BASE_URL=$(q '.advanced.mempool-explorer.url // ""')
+else
+    MEMPOOL_BASE_URL=""
+fi
+export MEMPOOL_BASE_URL
+
 # CKPool-solo uses the worker's stratum username as the payout
 # address and refuses to authenticate workers whose username is not
 # a valid address on the active network. The conf `btcaddress` is
@@ -256,7 +268,12 @@ OPENSSL_CONF
 foreground = yes
 pid =
 output = /dev/stdout
-debug = 4
+# debug = 5 (notice) so each successful TLS handshake produces a
+# "Service [stratum] accepted connection" / "connected from" pair
+# in the service logs. Failures (bad cert, alert messages, cipher
+# rejection) still surface at level 3, so both happy- and sad-path
+# events are visible without flipping levels per incident.
+debug = 5
 # Pin a modern TLS floor. Any miner firmware younger than ~2018
 # speaks TLS 1.2, and TLS 1.0/1.1 are deprecated anyway.
 sslVersion = all
diff --git a/scripts/procedures/getConfig.ts b/scripts/procedures/getConfig.ts
index f7d301c..c5ce364 100644
--- a/scripts/procedures/getConfig.ts
+++ b/scripts/procedures/getConfig.ts
@@ -179,6 +179,40 @@ export const getConfig: T.ExpectedExports.getConfig = compat.getConfig({
         },
         "default": "info",
       },
+      "mempool-explorer": {
+        "type": "union",
+        "name": "Block Explorer",
+        "description":
+          "Where Kamado's UI links should send you when you click a block hash or a user's BTC address. Defaults to mempool.space (the public instance). Switch to 'Custom' to point Kamado at a self-hosted mempool.space mirror — useful if you run mempool as another StartOS service or on the same network.",
+        "tag": {
+          "id": "type",
+          "name": "Source",
+          "description": "Public mempool.space, or your own instance.",
+          "variant-names": {
+            "default": "mempool.space (default)",
+            "custom": "Custom URL",
+          },
+        },
+        "default": "default",
+        "variants": {
+          "default": {},
+          "custom": {
+            "url": {
+              "type": "string",
+              "name": "Mempool URL",
+              "description":
+                "Base URL of your mempool instance, e.g. https://mempool.example.com. Kamado will append /address/<addr> and /block/<hash> to it, so the instance must follow the standard mempool.space URL layout.",
+              "nullable": false,
+              "default": "",
+              "pattern": "^https?://[^\\s]+$",
+              "pattern-description":
+                "Must be an http:// or https:// URL with no whitespace.",
+              "masked": false,
+              "copyable": false,
+            },
+          },
+        },
+      },
     },
   },
 });