diff --git a/echolot-app/app/src/main/kotlin/app/echo_lot/app/SettingsScreen.kt b/echolot-app/app/src/main/kotlin/app/echo_lot/app/SettingsScreen.kt
index 7e29dc3..b87c77e 100644
--- a/echolot-app/app/src/main/kotlin/app/echo_lot/app/SettingsScreen.kt
+++ b/echolot-app/app/src/main/kotlin/app/echo_lot/app/SettingsScreen.kt
@@ -67,14 +67,17 @@ fun SettingsScreen(
     var privacy by remember { mutableStateOf(settings.privacyLevel) }
     var stableSalt by remember { mutableStateOf(settings.stableSalt) }
     var enrollLink by remember { mutableStateOf("") }
-    var serverUrl by remember { mutableStateOf(settings.serverUrl) }
+    // The public name, which is what the operator handed out and what a person recognises. The
+    // endpoint actually dialled is shown beneath it when the two differ, rather than hidden — a
+    // network engineer debugging a connection wants to see where it really goes.
+    var serverUrl by remember { mutableStateOf(settings.serverPublicUrl) }
     var serverPin by remember { mutableStateOf(settings.serverPin) }
     var serverCred by remember { mutableStateOf(settings.serverCredential) }
     // Enrolling is asynchronous, so these are re-read when its result lands rather than when the
     // button is pressed — reading them immediately showed the previous server's values and looked
     // exactly like an enrollment that had silently done nothing.
     androidx.compose.runtime.LaunchedEffect(enrollStatus) {
-        serverUrl = settings.serverUrl
+        serverUrl = settings.serverPublicUrl
         serverPin = settings.serverPin
         serverCred = settings.serverCredential
     }
@@ -237,9 +240,25 @@ fun SettingsScreen(
                 }
 
                 OutlinedTextField(
-                    value = serverUrl, onValueChange = { serverUrl = it; settings.serverUrl = it },
+                    value = serverUrl,
+                    onValueChange = {
+                        serverUrl = it
+                        // Typed by hand there is no discovery to consult, so what was entered is
+                        // both the public name and the endpoint. Setting only one of them would
+                        // leave the app dialling the previous server.
+                        settings.serverUrl = it
+                        settings.serverPublicUrl = it
+                    },
                     label = { Text("Server URL") }, singleLine = true, modifier = Modifier.fillMaxWidth(),
                 )
+                if (settings.serverUrl.isNotBlank() && settings.serverUrl != settings.serverPublicUrl) {
+                    Text(
+                        "Connects to ${settings.serverUrl} — this server publishes one name and " +
+                            "points devices at another, so its pinned certificate can share a port " +
+                            "with its web interface.",
+                        style = MaterialTheme.typography.bodySmall,
+                    )
+                }
                 OutlinedTextField(
                     value = serverPin, onValueChange = { serverPin = it; settings.serverPin = it },
                     label = { Text("Certificate pin (SPKI, base64)") }, singleLine = true,