Edge/BYOC WebRTC STUN binding failure after Zendesk Talk cutover

Quick question about BYOC Edge configuration for our Zendesk Talk migration. Agents in the EU-West cluster are failing to establish media streams immediately after login.

WebSocket connection to ‘wss://edge-01.eu-west-1.aws.genesys.cloud’ failed: STUN binding request timeout.

The Zendesk side used standard STUN servers, but GC requires specific edge routing. Is there a missing firewall rule for UDP 3478-3480?