diff --git a/k8s/apps/mtproxy/telemt-daemonset.yaml b/k8s/apps/mtproxy/telemt-daemonset.yaml
index 5d285f0..dd97184 100644
--- a/k8s/apps/mtproxy/telemt-daemonset.yaml
+++ b/k8s/apps/mtproxy/telemt-daemonset.yaml
@@ -55,8 +55,9 @@ spec:
                 echo "ERROR: node ${NODE_NAME} has no mtproxy label"
                 exit 1
               fi
-              # Build ee-prefixed secret for secure mode
-              EE_SECRET="ee${SECRET}"
+              # Build ee-prefixed secret: ee + secret + hex(tls_domain)
+              # "ya.ru" = 79612e7275
+              EE_SECRET="ee${SECRET}79612e7275"
               LINK="tg://proxy?server=${SERVER}&port=${TELEMT_PORT}&secret=${EE_SECRET}"
               echo "Registering telemt: ${SERVER} -> ${LINK}"
               if kubectl get secret telemt-links -n "${NAMESPACE}" &>/dev/null; then