diff --git a/apps/vikunja/README.md b/apps/vikunja/README.md
index 8ba0b01..c1f88c5 100644
--- a/apps/vikunja/README.md
+++ b/apps/vikunja/README.md
@@ -28,9 +28,11 @@ Both the app and Postgres pin to Hetzner location `fsn1` because their PVCs live
 - Vikunja does not map OIDC groups to the admin flag. Promote the first user post-login: `kubectl -n vikunja exec deploy/vikunja -- /app/vikunja/vikunja user set-admin --admin <username>`.
 - **PKCE must be OFF on the Pocket ID client.** Vikunja 2.x's OAuth redirect (`frontend/src/helpers/redirectToProvider.ts`) does not send `code_challenge`, and the Go backend does not implement PKCE either. With `pkceEnabled: true` on Pocket ID the flow fails at `/authorize` with `invalid_request … 'code_challenge' parameter is missing`. Client is confidential (`isPublic: false`), so `client_secret` still authenticates the token exchange.
 
-## Optional: SMTP
+## SMTP
 
-`VIKUNJA_MAILER_ENABLED=false` today. To enable reminder emails, create a Stalwart mailbox `vikunja@basicstack.de`, add its credentials as a sealed secret `vikunja-mailer`, and set `VIKUNJA_MAILER_ENABLED=true` plus host/port/from env vars.
+Reminder emails go through Stalwart on `stalwart-smtp.stalwart.svc.cluster.local:25` using unauthenticated in-cluster relay. Stalwart's port-25 listener trusts the pod-network CIDR (`10.244.0.0/16`), so no SMTP AUTH is required and no sealed secret is needed. Envelope-from is `vikunja@basicstack.de` (the mailbox already exists in Stalwart as principal `g`).
+
+If a future policy tightens the port-25 CIDR trust, switch to submission on `stalwart-smtp:587` with STARTTLS and a `vikunja-mailer` sealed secret (`VIKUNJA_MAILER_USERNAME`/`VIKUNJA_MAILER_PASSWORD` from a secretKeyRef, `VIKUNJA_MAILER_AUTHTYPE=plain`); creating that secret requires a working Stalwart admin session to (re)set the vikunja principal's password.
 
 ## Change control
 
diff --git a/apps/vikunja/vikunja-deployment.yaml b/apps/vikunja/vikunja-deployment.yaml
index 070b0c4..6d5439a 100644
--- a/apps/vikunja/vikunja-deployment.yaml
+++ b/apps/vikunja/vikunja-deployment.yaml
@@ -100,7 +100,17 @@ spec:
               name: vikunja-oidc-secret
               key: client-secret
         - name: VIKUNJA_MAILER_ENABLED
+          value: "true"
+        - name: VIKUNJA_MAILER_HOST
+          value: stalwart-smtp.stalwart.svc.cluster.local
+        - name: VIKUNJA_MAILER_PORT
+          value: "25"
+        - name: VIKUNJA_MAILER_FORCESSL
           value: "false"
+        - name: VIKUNJA_MAILER_SKIPTLSVERIFY
+          value: "true"
+        - name: VIKUNJA_MAILER_FROMEMAIL
+          value: vikunja@basicstack.de
         resources:
           requests:
             cpu: 100m