diff --git a/docs/full-stack-setup-design.md b/docs/full-stack-setup-design.md
index fc16fd3..9eb5abe 100644
--- a/docs/full-stack-setup-design.md
+++ b/docs/full-stack-setup-design.md
@@ -861,6 +861,7 @@ public_url  = "{{ .VtaPublicURL }}"        # https://vta-{vta_name}.{domain}
 [services]
 rest    = true
 didcomm = true
+tsp     = true
 
 [server]
 host = "0.0.0.0"
@@ -900,7 +901,7 @@ pre_rotation_count = {{ .PreRotationCount }}
 ```toml
 [deployment]
 type      = "server"
-protocols = ["didcomm"]
+protocols = ["didcomm", "tsp"]
 use_vta   = true
 vta_mode  = "sealed-export"
 
@@ -956,6 +957,7 @@ data_dir   = "data/daemon"
 [identity]
 public_url   = "{{ .PublicURL }}"      # https://dids-{vta_name}.{domain}
 mediator_did = "{{ .MediatorDid }}"    # 1b
+transport    = "both"
 
 [vta]
 request_path  = "bootstrap-request.json"   # phase 1 only
@@ -1014,6 +1016,7 @@ path      = "{{ .VtcName }}-vtc"              # DID path — did:webvh:<scid>:<d
 [messaging]
 mediator_did = "{{ .MediatorDid }}"           # 1b — the same shared mediator
 mediator_url = "{{ .MediatorURL }}"           # informational only; endpoint is resolved from the DID doc
+transports   = ["tsp", "didcomm"]
 
 [secrets]
 backend           = "vault"
@@ -1641,6 +1644,7 @@ daemon), rather than taken from docs:
 | `[secrets]` field names + defaults + `deny_unknown_fields` | `vtc-service/src/config.rs::SecretsConfig` (mirrors `vti_secrets`; kv_mount `secret`, secret_key `seed`, auth `kubernetes`) |
 | `vault-secrets` is a non-default vtc feature | `vtc-service/Cargo.toml` + `docs/03-vtc/feature-flags.md` |
 | `[messaging]` fields (`mediator_did` required, `mediator_url` optional) | `vti-common/src/config.rs::MessagingConfig` |
+| `[messaging].transports` required, `["tsp","didcomm"]`, not persisted | `vtc-service/src/setup/from_toml.rs::MessagingSetup` + `wizard.rs::Transport` |
 | `[webvh].server_id` → `WEBVH_SERVER` template var | `vtc-service/src/setup/wizard.rs` (`WebvhTarget`, `build_template_vars`) |
 | `vta contexts create` offline, `--admin-did`/`--admin-expires N[s\|m\|h\|d\|w]`, atomic ACL; Conflict on existing id | `vta-service/src/main.rs::ContextCommands::Create`; `operations/contexts.rs` (`Conflict: context already exists`) |
 | `vta import-did --role admin --context <ctx>` as the exists-tolerant regrant | `vta-service/src/main.rs::ImportDid` (`--context Vec<String>`) |
diff --git a/docs/vta-setup-design.md b/docs/vta-setup-design.md
index 3ba96ab..5a30f71 100644
--- a/docs/vta-setup-design.md
+++ b/docs/vta-setup-design.md
@@ -351,6 +351,7 @@ public_url  = "{{ .PublicURL }}"           # https://{subdomain}.{CLUSTER_DOMAIN
 [services]
 rest    = true
 didcomm = true
+tsp     = true
 
 [server]
 host = "0.0.0.0"
diff --git a/internal/setup/templates.go b/internal/setup/templates.go
index c4c64be..ca8db0f 100644
--- a/internal/setup/templates.go
+++ b/internal/setup/templates.go
@@ -15,6 +15,7 @@ public_url  = "{{ .PublicURL }}"
 [services]
 rest    = true
 didcomm = true
+tsp     = true
 
 [server]
 host = "0.0.0.0"
diff --git a/internal/setup/templates_fullstack.go b/internal/setup/templates_fullstack.go
index f56c065..98eb6da 100644
--- a/internal/setup/templates_fullstack.go
+++ b/internal/setup/templates_fullstack.go
@@ -18,6 +18,7 @@ public_url  = "{{ .VtaPublicURL }}"
 [services]
 rest    = true
 didcomm = true
+tsp     = true
 
 [server]
 host = "0.0.0.0"
@@ -88,7 +89,7 @@ func RenderFullStackVtaSetupTOML(s *model.SetupSession, vault VaultSecrets) (str
 
 var mediatorRecipeTmpl = template.Must(template.New("fs-mediator-recipe").Parse(`[deployment]
 type      = "server"
-protocols = ["didcomm"]
+protocols = ["didcomm", "tsp"]
 use_vta   = true
 vta_mode  = "sealed-export"
 
@@ -165,6 +166,7 @@ data_dir   = "data/daemon"
 [identity]
 public_url   = "{{ .PublicURL }}"
 mediator_did = "{{ .MediatorDid }}"
+transport    = "both"
 
 [vta]
 {{- if eq .Phase "offline-prepare" }}
diff --git a/internal/setup/templates_vtc.go b/internal/setup/templates_vtc.go
index 0baa9d2..dc35986 100644
--- a/internal/setup/templates_vtc.go
+++ b/internal/setup/templates_vtc.go
@@ -39,6 +39,7 @@ path      = "{{ .VtcDidPath }}"
 [messaging]
 mediator_did = "{{ .MediatorDid }}"
 mediator_url = "{{ .MediatorURL }}"
+transports   = ["tsp", "didcomm"]
 
 [secrets]
 backend           = "vault"