diff --git a/FieldLogger/Services/SettingsService.cs b/FieldLogger/Services/SettingsService.cs
index 0710eb7..d9a582a 100644
--- a/FieldLogger/Services/SettingsService.cs
+++ b/FieldLogger/Services/SettingsService.cs
@@ -73,7 +73,7 @@ public sealed class SettingsService
 
     public int MqttPort
     {
-        get => Preferences.Default.Get(MqttPortKey, 8884);
+        get => Preferences.Default.Get(MqttPortKey, 443);
         set => Preferences.Default.Set(MqttPortKey, value);
     }
 
diff --git a/FieldLogger/Services/Sync/MqttSyncService.cs b/FieldLogger/Services/Sync/MqttSyncService.cs
index 4044d47..542fc6e 100644
--- a/FieldLogger/Services/Sync/MqttSyncService.cs
+++ b/FieldLogger/Services/Sync/MqttSyncService.cs
@@ -185,6 +185,9 @@ public sealed class MqttSyncService : IMqttSyncService
             {
                 Host = _settings.MqttHost,
                 Port = _settings.MqttPort,
+                WebSocketUri = _settings.MqttPort == 443
+                    ? $"wss://{_settings.MqttHost}/mqtt"
+                    : null,
                 ClientId = _settings.MqttClientId,
                 Username = _settings.MqttOrgId,
                 Password = password,
diff --git a/FieldLogger/ViewModels/SettingsViewModel.cs b/FieldLogger/ViewModels/SettingsViewModel.cs
index 2868b24..73586ec 100644
--- a/FieldLogger/ViewModels/SettingsViewModel.cs
+++ b/FieldLogger/ViewModels/SettingsViewModel.cs
@@ -24,7 +24,7 @@ public sealed partial class SettingsViewModel : ObservableObject
     private string _mqttHost = "";
 
     [ObservableProperty]
-    private string _mqttPort = "8884";
+    private string _mqttPort = "443";
 
     [ObservableProperty]
     private string _mqttOrgId = "";
diff --git a/FieldLogger/Views/SettingsPage.xaml b/FieldLogger/Views/SettingsPage.xaml
index 6b2ff2e..62a7ccb 100644
--- a/FieldLogger/Views/SettingsPage.xaml
+++ b/FieldLogger/Views/SettingsPage.xaml
@@ -58,7 +58,7 @@
                         <Switch Grid.Column="1" IsToggled="{Binding MqttEnabled}" />
                     </Grid>
                     <Entry Text="{Binding MqttHost}" Placeholder="dev.hub.umagul.net" />
-                    <Entry Text="{Binding MqttPort}" Placeholder="8884" Keyboard="Numeric" />
+                    <Entry Text="{Binding MqttPort}" Placeholder="443 (WSS) or 8884 (MQTTS)" Keyboard="Numeric" />
                     <Entry Text="{Binding MqttOrgId}" Placeholder="Organization ID / MQTT username" />
                     <Entry Text="{Binding MqttPassword}" Placeholder="New MQTT password (stored securely)" IsPassword="True" />
                     <Label Text="{Binding MqttClientId, StringFormat='Client: {0}'}" FontSize="10" TextColor="Gray" />
diff --git a/src/FieldLogger.Sync/MqttnetTransport.cs b/src/FieldLogger.Sync/MqttnetTransport.cs
index 0299e95..391ea57 100644
--- a/src/FieldLogger.Sync/MqttnetTransport.cs
+++ b/src/FieldLogger.Sync/MqttnetTransport.cs
@@ -11,7 +11,10 @@ namespace FieldLogger.Sync;
 public sealed record MqttBrokerConfig
 {
     public required string Host { get; init; }
-    public int Port { get; init; } = 8884;
+    public int Port { get; init; } = 443;
+    /// <summary>When set, use MQTT over secure WebSockets (normally
+    /// wss://dev.hub.umagul.net/mqtt) instead of raw MQTTS.</summary>
+    public string? WebSocketUri { get; init; }
     public bool UseTls { get; init; } = true;
     public required string ClientId { get; init; }
     /// <summary>Interim credential (username = orgId, password = scoped per-org secret).
@@ -52,8 +55,13 @@ public sealed class MqttnetTransport : IMqttTransport, IAsyncDisposable
 
         _ackTopic = ackTopic;
 
-        var options = new MqttClientOptionsBuilder()
-            .WithTcpServer(_config.Host, _config.Port)
+        var builder = new MqttClientOptionsBuilder();
+        if (string.IsNullOrWhiteSpace(_config.WebSocketUri))
+            builder.WithTcpServer(_config.Host, _config.Port);
+        else
+            builder.WithWebSocketServer(options => options.WithUri(_config.WebSocketUri));
+
+        var options = builder
             .WithClientId(_config.ClientId)
             .WithProtocolVersion(MQTTnet.Formatter.MqttProtocolVersion.V500)
             .WithCleanSession(false)                                  // persistent session (durable)