diff --git a/src/config/telephony-config.service.ts b/src/config/telephony-config.service.ts
index 43cfaff..23f2626 100644
--- a/src/config/telephony-config.service.ts
+++ b/src/config/telephony-config.service.ts
@@ -46,6 +46,7 @@ export class TelephonyConfigService implements OnModuleInit {
             ozonetel: {
                 ...c.ozonetel,
                 agentPassword: c.ozonetel.agentPassword ? '***masked***' : '',
+                adminPassword: c.ozonetel.adminPassword ? '***masked***' : '',
             },
         };
     }
@@ -68,6 +69,9 @@ export class TelephonyConfigService implements OnModuleInit {
         if (merged.ozonetel.agentPassword === '***masked***') {
             merged.ozonetel.agentPassword = current.ozonetel.agentPassword;
         }
+        if (merged.ozonetel.adminPassword === '***masked***') {
+            merged.ozonetel.adminPassword = current.ozonetel.adminPassword;
+        }
         this.backup();
         this.writeFile(merged);
         this.cached = merged;
diff --git a/src/config/telephony.defaults.ts b/src/config/telephony.defaults.ts
index e28751f..af03202 100644
--- a/src/config/telephony.defaults.ts
+++ b/src/config/telephony.defaults.ts
@@ -22,6 +22,11 @@ export type TelephonyConfig = {
         sipId: string;
         // Default outbound campaign name on Ozonetel CloudAgent.
         campaignName: string;
+        // Ozonetel portal admin credentials — used by supervisor barge/whisper/listen.
+        // These are the login credentials for the Ozonetel admin dashboard
+        // (api.cloudagent.ozonetel.com/auth/login), NOT an agent ID.
+        adminUsername: string;
+        adminPassword: string;
     };
     // Ozonetel WebRTC gateway used by the staff portal softphone.
     sip: {
@@ -46,6 +51,8 @@ export const DEFAULT_TELEPHONY_CONFIG: TelephonyConfig = {
         did: '',
         sipId: '',
         campaignName: '',
+        adminUsername: '',
+        adminPassword: '',
     },
     sip: {
         domain: 'blr-pub-rtc4.ozonetel.com',
@@ -65,6 +72,8 @@ export const TELEPHONY_ENV_SEEDS: Array<{ env: string; path: string[] }> = [
     // OZONETEL_AGENT_ID removed — agentId is per-user on the Agent entity,
     // not a sidecar-level config. All endpoints require agentId from caller.
     { env: 'OZONETEL_AGENT_PASSWORD', path: ['ozonetel', 'agentPassword'] },
+    { env: 'OZONETEL_ADMIN_USERNAME', path: ['ozonetel', 'adminUsername'] },
+    { env: 'OZONETEL_ADMIN_PASSWORD', path: ['ozonetel', 'adminPassword'] },
     { env: 'OZONETEL_DID',            path: ['ozonetel', 'did'] },
     { env: 'OZONETEL_SIP_ID',         path: ['ozonetel', 'sipId'] },
     { env: 'OZONETEL_CAMPAIGN_NAME',  path: ['ozonetel', 'campaignName'] },