diff --git a/hosts/telefonmann/default.nix b/hosts/telefonmann/default.nix
index 53bbeb2..4e1eb72 100644
--- a/hosts/telefonmann/default.nix
+++ b/hosts/telefonmann/default.nix
@@ -71,12 +71,6 @@ in {
 
     intercomPrefix = "*80";  # generates e.g. *8020, *8021, *8022 per extension
 
-    codecs = {
-      trunk = [ "g722" "alaw" "ulaw" ];
-      # hardwarePhones = [ "g722" "alaw" "ulaw" "ilbc" ];  # default; Cisco 8961 supported set
-      # softClients    = [ "opus" "g722" "alaw" "ulaw" ];  # default; opus first for best quality
-    };
-
     mohClasses = {
       "default" = {
         files = [ ./music/vapor.mp3 ];
@@ -92,18 +86,21 @@ in {
         usernameFile = config.age.secrets."voip-trunk-ewe1-username".path;
         passwordFile = config.age.secrets."voip-trunk-ewe1-password".path;
         callerIdFile = config.age.secrets."voip-trunk-ewe1-callerid".path;
+        codecs       = [ "g722" "alaw" "ulaw" ];
       };
       "ewe2" = {
         hostFile     = config.age.secrets."voip-trunk-ewe-host".path;
         usernameFile = config.age.secrets."voip-trunk-ewe2-username".path;
         passwordFile = config.age.secrets."voip-trunk-ewe2-password".path;
         callerIdFile = config.age.secrets."voip-trunk-ewe2-callerid".path;
+        codecs       = [ "g722" "alaw" "ulaw" ];
       };
       "ewe3" = {
         hostFile     = config.age.secrets."voip-trunk-ewe-host".path;
         usernameFile = config.age.secrets."voip-trunk-ewe3-username".path;
         passwordFile = config.age.secrets."voip-trunk-ewe3-password".path;
         callerIdFile = config.age.secrets."voip-trunk-ewe3-callerid".path;
+        codecs       = [ "g722" "alaw" "ulaw" ];
       };
     };
 
diff --git a/modules/voip/asterisk/default.nix b/modules/voip/asterisk/default.nix
index 968efb6..4ca59f1 100644
--- a/modules/voip/asterisk/default.nix
+++ b/modules/voip/asterisk/default.nix
@@ -164,26 +164,18 @@ let
     type = transport
     protocol = udp
     bind = 0.0.0.0:${toString cfg.sipPort}
-    ; --- templates ---
+    ; --- endpoint templates ---
 
-    [endpoint-cisco-8961](!)
+    ${lib.concatStringsSep "\n" (lib.mapAttrsToList (_: m: ''
+    [${m.endpointTemplate}](!)
     type = endpoint
     context = internal
     transport = transport-tcp
     disallow = all
-    ${lib.concatMapStrings (c: "allow = ${c}\n    ") cfg.codecs.hardwarePhones}
-    direct_media = no
-    trust_id_inbound = yes
-    send_pai = yes
-
-    [endpoint-generic](!)
-    type = endpoint
-    context = internal
-    transport = transport-tcp
-    disallow = all
-    ${lib.concatMapStrings (c: "allow = ${c}\n    ") cfg.codecs.softClients}
+    ${lib.concatMapStrings (c: "allow = ${c}\n    ") m.codecs}
     direct_media = no
     send_pai = yes
+    '') models)}
 
     [auth-userpass](!)
     type = auth
@@ -250,7 +242,7 @@ let
     aors = trunk-${name}-aor
     trust_id_inbound = yes
     disallow = all
-    ${lib.concatMapStrings (c: "allow = ${c}\n    ") cfg.codecs.trunk}
+    ${lib.concatMapStrings (c: "allow = ${c}\n    ") t.codecs}
 
     [trunk-${name}-aor]
     type = aor
diff --git a/modules/voip/dashboard.nix b/modules/voip/dashboard.nix
index 299774c..1b45e9c 100644
--- a/modules/voip/dashboard.nix
+++ b/modules/voip/dashboard.nix
@@ -250,13 +250,13 @@ let
         <div class="card">
           <h2>SIP Trunks</h2>
           <table>
-            <tr><th>Name</th><th>Host</th><th>Username</th><th>Transport</th><th>Caller ID</th></tr>
+            <tr><th>Name</th><th>Host</th><th>Username</th><th>Transport</th><th>Caller ID</th><th>Codecs</th></tr>
             ${lib.concatStringsSep "\n" (lib.mapAttrsToList (name: t:
               let callerIdCell =
                     if t.callerIdFile != null || t.callerId != "" then rtv t.callerId t.callerIdFile
                     else "<em>provider default</em>";
               in
-              ''<tr><td><code>${name}</code></td><td>${rtv t.host t.hostFile}</td><td><code>${rtv t.username t.usernameFile}</code></td><td>${t.transport}</td><td>${callerIdCell}</td></tr>''
+              ''<tr><td><code>${name}</code></td><td>${rtv t.host t.hostFile}</td><td><code>${rtv t.username t.usernameFile}</code></td><td>${t.transport}</td><td>${callerIdCell}</td><td><code>${lib.concatStringsSep " › " t.codecs}</code></td></tr>''
             ) cfg.sipTrunks)}
           </table>
         </div>
@@ -357,9 +357,12 @@ let
           <h2>Codecs</h2>
           <table>
             <tr><th>Endpoint type</th><th>Preference order</th></tr>
-            <tr><td>Hardware phones</td><td><code>${lib.concatStringsSep " › " cfg.codecs.hardwarePhones}</code></td></tr>
-            <tr><td>Soft clients</td><td><code>${lib.concatStringsSep " › " cfg.codecs.softClients}</code></td></tr>
-            <tr><td>Trunks</td><td><code>${lib.concatStringsSep " › " cfg.codecs.trunk}</code></td></tr>
+            ${lib.concatStringsSep "\n" (lib.mapAttrsToList (name: m:
+              ''<tr><td>${name}</td><td><code>${lib.concatStringsSep " › " m.codecs}</code></td></tr>''
+            ) models)}
+            ${lib.concatStringsSep "\n" (lib.mapAttrsToList (name: t:
+              ''<tr><td>trunk: ${name}</td><td><code>${lib.concatStringsSep " › " t.codecs}</code></td></tr>''
+            ) cfg.sipTrunks)}
           </table>
         </div>
 
diff --git a/modules/voip/options.nix b/modules/voip/options.nix
index 7e4f86d..3823e65 100644
--- a/modules/voip/options.nix
+++ b/modules/voip/options.nix
@@ -118,30 +118,6 @@ in {
       description = "Dial prefix for auto-generated intercom extensions. e.g. \"*80\" generates *80100 for ext 100. Only intercom-capable (provisioned) phones get entries.";
     };
 
-    codecs = lib.mkOption {
-      description = "Codec preference lists for each endpoint class, ordered highest priority first.";
-      default     = {};
-      type        = lib.types.submodule {
-        options = {
-          hardwarePhones = lib.mkOption {
-            type    = lib.types.listOf lib.types.str;
-            default = [ "g722" "alaw" "ulaw" "ilbc" ];
-            description = "Codecs for provisioned hardware phones (e.g. Cisco 8961). Supports G.722, G.711, iLBC. Opus and G.726 not supported. G.729 supported but not useful on LAN.";
-          };
-          softClients = lib.mkOption {
-            type    = lib.types.listOf lib.types.str;
-            default = [ "opus" "g722" "alaw" "ulaw" ];
-            description = "Codecs for software SIP clients. Opus first for best quality on modern softphones.";
-          };
-          trunk = lib.mkOption {
-            type    = lib.types.listOf lib.types.str;
-            default = [ "alaw" "ulaw" ];
-            description = "Codecs offered to SIP trunks. Most providers only support G.711.";
-          };
-        };
-      };
-    };
-
     mohClasses = lib.mkOption {
       default     = {};
       description = "Music on hold classes. Files are transcoded to ulaw at build time.";
@@ -208,6 +184,11 @@ in {
             default     = null;
             description = "File containing the outbound caller ID. Takes precedence over callerId.";
           };
+          codecs = lib.mkOption {
+            type        = lib.types.listOf lib.types.str;
+            default     = [ "alaw" "ulaw" ];
+            description = "Codec preference list for this trunk, ordered highest priority first. Most providers only support G.711.";
+          };
         };
       });
     };
diff --git a/modules/voip/phones.nix b/modules/voip/phones.nix
index d87f3f2..2468cc5 100644
--- a/modules/voip/phones.nix
+++ b/modules/voip/phones.nix
@@ -12,6 +12,7 @@ let
       hasProvisioning  = true;
       hasIntercom      = true;   # auto-answer speakerphone line
       hasMultiLine     = true;   # separate L2 line for family/shared DID
+      codecs           = [ "g722" "alaw" "ulaw" "ilbc" ];
     };
     "sip-client" = {
       endpointTemplate = "endpoint-generic";
@@ -19,6 +20,7 @@ let
       hasProvisioning  = false;
       hasIntercom      = false;
       hasMultiLine     = false;
+      codecs           = [ "opus" "g722" "alaw" "ulaw" ];
     };
   };