diff --git a/public/docs-static/img/agent-network/providers/agent-network-custom-provider.png b/public/docs-static/img/agent-network/providers/agent-network-custom-provider.png
new file mode 100644
index 00000000..a4c6bbf3
Binary files /dev/null and b/public/docs-static/img/agent-network/providers/agent-network-custom-provider.png differ
diff --git a/src/pages/agent-network/providers.mdx b/src/pages/agent-network/providers.mdx
index 199415d3..b5f1ec8e 100644
--- a/src/pages/agent-network/providers.mdx
+++ b/src/pages/agent-network/providers.mdx
@@ -63,6 +63,34 @@ and budgets (see [How It Works](/agent-network/how-it-works#llm-apis-and-ai-gate
     <img src="/docs-static/img/agent-network/providers/agent-network-create-provider.png" alt="agent network connect provider modal" className="imagewrapper" />
 </p>
 
+## Custom & Self-hosted Providers
+
+Pick **Custom / Self-hosted** for any OpenAI-compatible endpoint that isn't a first-party
+vendor or a named gateway — a private inference server, an on-prem deployment, or a local
+model runtime like Ollama or vLLM (vLLM also has its own named entry). NetBird talks to it
+the same way it talks to OpenAI: you provide the **Upstream URL** where requests are
+forwarded and, if the endpoint requires one, an **API key** sent as a bearer token.
+
+<p>
+    <img src="/docs-static/img/agent-network/providers/agent-network-custom-provider.png" alt="custom provider settings with the Skip TLS Verification switch" className="imagewrapper" />
+</p>
+
+### Skip TLS Verification
+
+Self-hosted endpoints often serve HTTPS with a self-signed or otherwise untrusted
+certificate, which makes the proxy reject the connection with an unknown-certificate error.
+Enable **Skip TLS Verification** on a custom provider to disable upstream TLS certificate
+validation so requests go through anyway.
+
+<Warning>
+This turns off certificate checks for that provider's upstream traffic, which removes
+protection against man-in-the-middle attacks. Use it only for quick testing. For anything
+beyond that, mount your CA / trusted certificates on your proxy instances instead of
+skipping verification.
+</Warning>
+
+The switch appears only for custom (self-hosted) providers and is **off by default**.
+
 ## Models and Pricing
 
 Each provider carries a list of models it serves. Leaving the list empty makes the