diff --git a/.env.example b/.env.example
index 80947ff..1436eb6 100644
--- a/.env.example
+++ b/.env.example
@@ -53,6 +53,11 @@ MC_RCON_PASSWORD=your-rcon-password-here
 # Available at: https://modrinth.com/plugins
 MC_MODRINTH_PROJECTS=veinminer,luckperms,simple-voice-chat,treetimber,viaversion,viabackwards,chunky,axgraves,singleplayersleep,fodrops,maxtools,essentialsx?,coreprotect?,bluemap?,spark?
 
+# ── Bedrock Support (Geyser/Floodgate) ────────
+# Direct-download plugin URLs (comma or newline delimited).
+# Requires a separate playit.gg "Minecraft Bedrock" tunnel — see docs/playit.md
+# MC_PLUGINS=https://download.geysermc.org/v2/projects/geyser/versions/latest/builds/latest/downloads/spigot,https://download.geysermc.org/v2/projects/floodgate/versions/latest/builds/latest/downloads/spigot
+
 # ── Spigot Plugins (Spiget resource IDs) ──────
 # 1997=ProtocolLib  59773=ChestSort  131972=RezzLoaders
 MC_SPIGET_RESOURCES=1997,59773,131972
@@ -68,6 +73,7 @@ MC_SPIGET_RESOURCES=1997,59773,131972
 # MC_SERVER_PORT=25565
 # MC_RCON_PORT=25575
 # MC_VOICE_PORT=24454
+# MC_BEDROCK_PORT=19132
 # MC_CPU_LIMIT=2.0
 # MC_CPU_RESERVE=0.5
 
diff --git a/README.md b/README.md
index abfa602..f09e1a0 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ A Dockerised PaperMC server configured for small groups, with tunnelled public a
 * [Features](./docs/features.md)
 * [System Requirements](./docs/system-requirements.md)
 * [Getting Started](#getting-started)
-* [playit.gg Tunnel Setup](./docs/duckdns.md)
+* [playit.gg Tunnel Setup](./docs/playit.md)
 * [Usage](./docs/usage.md)
 * [Maintenance](./docs/maintenance.md)
 * [Troubleshooting](./docs/troubleshooting.md)
diff --git a/compose.yml b/compose.yml
index 5975399..09b51f4 100644
--- a/compose.yml
+++ b/compose.yml
@@ -22,6 +22,7 @@ services:
       - "127.0.0.1:${MC_SERVER_PORT:-25565}:25565"
       - "127.0.0.1:${MC_RCON_PORT:-25575}:25575"
       - "127.0.0.1:${MC_VOICE_PORT:-24454}:24454/udp"
+      - "127.0.0.1:${MC_BEDROCK_PORT:-19132}:19132/udp"
     
     # Optimized memory limits (6GB)
     deploy:
@@ -66,7 +67,7 @@ services:
       
       # Player Management
       MAX_PLAYERS: "${MC_MAX_PLAYERS:-6}"
-      PLAYER_IDLE_TIMEOUT: "${MC_IDLE_TIMEOUT:-0}"
+      PLAYER_IDLE_TIMEOUT: "${MC_IDLE_TIMEOUT:-5}"
       ENABLE_WHITELIST: "${MC_ENABLE_WHITELIST:-true}"
       ENFORCE_WHITELIST: "${MC_ENABLE_WHITELIST:-true}"
       WHITELIST: "${MC_WHITELIST:-424cd779-3028-42b2-bbe0-9d140ded1e7e,252bd633-504d-439b-8a5a-d99283f4b5a9,aed95856-af9d-4973-8c62-e6ee98cef7f5}"
@@ -113,7 +114,8 @@ services:
       ENFORCE_SECURE_PROFILE: "${MC_ENFORCE_SECURE_PROFILE:-false}"
       
       # Plugins
-      PLUGINS: ""
+      # Geyser/Floodgate URLs go via MC_PLUGINS (see .env.example) for Bedrock support
+      PLUGINS: "${MC_PLUGINS:-}"
       
       # Modrinth projects — auto-resolves the correct build for the running loader
       MODRINTH_PROJECTS: "${MC_MODRINTH_PROJECTS:-luckperms,simple-voice-chat,better-veinminer,treetimber,viaversion,viabackwards,chunky,axgraves}"
diff --git a/docs/playit.md b/docs/playit.md
index 9438dbf..5dec947 100644
--- a/docs/playit.md
+++ b/docs/playit.md
@@ -55,3 +55,32 @@ If the agent can't connect, re-run the first-time setup flow:
 ## Custom domain
 
 playit.gg supports custom domains on paid plans. Configure these in the playit dashboard — no changes needed in `.env` or `compose.yml`.
+
+## Bedrock (Geyser) tunnel
+
+Bedrock Edition players need a second, separate tunnel — playit's **Minecraft Bedrock** type, which is UDP rather than Java's TCP. This needs Geyser/Floodgate installed via `MC_PLUGINS` in `.env` (see `.env.example`) and port `19132/udp` exposed, which `compose.yml` already handles through `MC_BEDROCK_PORT`.
+
+### Setup
+
+1. In the playit dashboard, add a tunnel with these settings:
+   - **Type:** Minecraft Bedrock
+   - **Local address:** `mc:19132`
+   - **Proxy Protocol:** proxy-protocol-v2
+2. On the host, open Geyser's config (`<data-dir>/plugins/Geyser-Spigot/config.yml`) and under `advanced: bedrock:`, set:
+   ```yaml
+   use-haproxy-protocol: true
+   broadcast-port: <tunnel port>
+   ```
+   This lives in the data volume, outside this repo, so it has to be edited directly on the host.
+3. Apply the plugin and port changes:
+   ```bash
+   docker compose up -d mc
+   ```
+
+### Current tunnel
+
+```
+meeting-hidden.gl.at.ply.gg:61768
+```
+
+Bedrock players connect with this address. `broadcast-port` in Geyser's `config.yml` should be set to `61768` to match. If the tunnel is ever recreated, the address changes and this needs updating.