diff --git a/apps/stalwart/stalwart-config.yaml b/apps/stalwart/stalwart-config.yaml
index d3ff5ed..cc43958 100644
--- a/apps/stalwart/stalwart-config.yaml
+++ b/apps/stalwart/stalwart-config.yaml
@@ -39,17 +39,29 @@ data:
     bind = ["0.0.0.0:25"]
     protocol = "smtp"
 
+    # Security: Allow internal cluster IPs for Traefik ingress
+    [server.listener.smtp.security]
+    allowed-ips = ["10.244.0.0/16", "127.0.0.1/32"]
+
     # Submission Listener (Port 587 with STARTTLS)
     [server.listener.submission]
     bind = ["0.0.0.0:587"]
     protocol = "smtp"
 
+    # Security: Allow internal cluster IPs for Traefik ingress
+    [server.listener.submission.security]
+    allowed-ips = ["10.244.0.0/16", "127.0.0.1/32"]
+
     # IMAPS Listener (Port 993 with TLS)
     [server.listener.imaps]
     bind = ["0.0.0.0:993"]
     protocol = "imap"
     tls.implicit = true
 
+    # Security: Allow internal cluster IPs for Traefik ingress
+    [server.listener.imaps.security]
+    allowed-ips = ["10.244.0.0/16", "127.0.0.1/32"]
+
     #
     # TLS Configuration
     #