diff --git a/docker_entrypoint.sh b/docker_entrypoint.sh
index 7146315..3c85bfa 100755
--- a/docker_entrypoint.sh
+++ b/docker_entrypoint.sh
@@ -84,6 +84,15 @@ export BITCOIN_NOTIFY=false
 export ZMQ_BLOCK="tcp://${BITCOIN_RPC_HOST}:28332"
 export BLOCKPOLL_MS=100
 export UPDATE_INTERVAL_S=30
+
+# ckpool binds two stratum sockets — a public plaintext port and a
+# loopback-only port that stunnel forwards TLS traffic to. Clients
+# arriving via the second bind get client.server == 1 in the runtime
+# JSON, which lets the dashboard tag them with a TLS lock icon
+# without resorting to source-IP heuristics. Even when TLS is
+# disabled the second bind is harmless (nothing connects to it).
+export TLS_INTERNAL_PORT=3437
+
 mkdir -p "${LOGDIR}" "${SOCKET_DIR}" /etc/ckpool
 
 # Render ckpool.conf using the same sed approach as the upstream
@@ -102,6 +111,7 @@ sed \
     -e "s|\${BLOCKPOLL_MS}|${BLOCKPOLL_MS}|g" \
     -e "s|\${UPDATE_INTERVAL_S}|${UPDATE_INTERVAL_S}|g" \
     -e "s|\${STRATUM_PORT}|${STRATUM_PORT}|g" \
+    -e "s|\${TLS_INTERNAL_PORT}|${TLS_INTERNAL_PORT}|g" \
     -e "s|\${MINDIFF}|${MINDIFF}|g" \
     -e "s|\${STARTDIFF}|${STARTDIFF}|g" \
     -e "s|\${MAXDIFF}|${MAXDIFF}|g" \
@@ -257,7 +267,10 @@ options = NO_TLSv1_1
 
 [stratum]
 accept = 0.0.0.0:${TLS_PORT}
-connect = 127.0.0.1:${STRATUM_PORT}
+# Forward to ckpool's loopback-only TLS bind, not the public plaintext
+# port. ckpool tags traffic by serverurl index (server == 1 -> TLS),
+# which the dashboard reads to render a lock icon next to the client.
+connect = 127.0.0.1:${TLS_INTERNAL_PORT}
 cert = ${CERT}
 # No client-cert auth — stratum over TLS is opportunistic encryption;
 # the stratum protocol layer handles miner auth via username.