diff --git a/server/src/services/audioBridgeService.js b/server/src/services/audioBridgeService.js
index c781acd8..46af4720 100644
--- a/server/src/services/audioBridgeService.js
+++ b/server/src/services/audioBridgeService.js
@@ -23,7 +23,8 @@ function stopBridge(rawName) {
 function startBridge(rawName, baseName) {
   if (bridges.has(rawName)) return;
 
-  const inputUrl = `srt://${SRT_HOST}:9000?streamid=#!::r=${rawName},m=request&mode=caller&transtype=live&latency=20`;
+  // Use explicit credentials so mediamtx auth will allow the bridge to pull.
+  const inputUrl = `srt://${SRT_HOST}:9000?streamid=#!::r=${rawName},m=request&mode=caller&transtype=live&latency=20&u=bridge&p=bridge`;
   const outputUrl = `srt://${SRT_HOST}:9000?streamid=#!::r=${baseName},m=publish&mode=caller&transtype=live&pkt_size=1316`;
 
   const args = [
diff --git a/server/src/services/videoAuthService.js b/server/src/services/videoAuthService.js
index bd170a3d..ec2a5c76 100644
--- a/server/src/services/videoAuthService.js
+++ b/server/src/services/videoAuthService.js
@@ -73,6 +73,12 @@ app.post('/mediamtx/auth', (req, res) => {
   const path = (body.path || '').replace(/^\//, '');
   const sessionId = body.user;
   const streamInfo = extractStreamInfo(path);
+
+  // Allow internal bridge (server-side audio transcode) to pull/push without a websocket session.
+  if (body.user === 'bridge' && body.pass === 'bridge') {
+    return res.status(200).end();
+  }
+
   logger.info('video auth request', { path: body.path, sessionId, stream: streamInfo });
 
   if (!sessionId || !streamInfo?.id) {