diff --git a/apps/stalwart/stalwart-fresh-deployment.yaml b/apps/stalwart/stalwart-fresh-deployment.yaml
index f81bb53..d88fd4c 100644
--- a/apps/stalwart/stalwart-fresh-deployment.yaml
+++ b/apps/stalwart/stalwart-fresh-deployment.yaml
@@ -18,65 +18,6 @@ spec:
       storage: 20Gi
 ---
 apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: stalwart-config
-  namespace: stalwart
-data:
-  config.toml: |
-    [server]
-    hostname = "mail.basicstack.de"
-
-    [server.listener.smtp]
-    bind = ["0.0.0.0:25"]
-    protocol = "smtp"
-
-    [server.listener.submission]
-    bind = ["0.0.0.0:587"]
-    protocol = "smtp"
-    tls.implicit = false
-
-    [server.listener.submissions]
-    bind = ["0.0.0.0:465"]
-    protocol = "smtp"
-    tls.implicit = true
-
-    [server.listener.imap]
-    bind = ["0.0.0.0:143"]
-    protocol = "imap"
-    tls.implicit = false
-
-    [server.listener.imaps]
-    bind = ["0.0.0.0:993"]
-    protocol = "imap"
-    tls.implicit = true
-
-    [server.listener.http]
-    bind = ["0.0.0.0:8080"]
-    protocol = "http"
-
-    [storage]
-    data = "rocksdb"
-    blob = "rocksdb"
-    fts = "rocksdb"
-    lookup = "rocksdb"
-
-    [store.rocksdb]
-    type = "rocksdb"
-    path = "/var/lib/stalwart"
-    compression = "lz4"
-
-    [directory.internal]
-    type = "internal"
-    store = "rocksdb"
-
-    [session.auth]
-    directory = "internal"
-
-    [jmap.protocol]
-    set.max-objects = 100000
----
-apiVersion: v1
 kind: Service
 metadata:
   name: stalwart-smtp
@@ -185,6 +126,9 @@ spec:
         - name: bootstrap-config
           mountPath: /etc/stalwart/config.json
           subPath: config.json
+        - name: tls-certs
+          mountPath: /etc/stalwart/certs
+          readOnly: true
         resources:
           requests:
             memory: "512Mi"
@@ -215,6 +159,10 @@ spec:
       - name: bootstrap-config
         configMap:
           name: stalwart-bootstrap-config
+      - name: tls-certs
+        secret:
+          secretName: stalwart-tls
+          defaultMode: 0444
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress