diff --git a/apps/stalwart/stalwart-bootstrap-config.yaml b/apps/stalwart/stalwart-bootstrap-config.yaml
index 7fb9b18..17e5ee2 100644
--- a/apps/stalwart/stalwart-bootstrap-config.yaml
+++ b/apps/stalwart/stalwart-bootstrap-config.yaml
@@ -5,4 +5,7 @@ metadata:
   name: stalwart-bootstrap-config
   namespace: stalwart
 data:
-  config.json: '{"@type":"RocksDb","path":"/var/lib/stalwart"}'
+  # DEV-476: Bootstrap now points at the PostgreSQL config/data store.
+  # PGPASSWORD is injected into the stalwart container from
+  # secret/stalwart-postgres-credentials (see stalwart-fresh-deployment.yaml).
+  config.json: '{"@type":"PostgreSql","host":"stalwart-postgres","port":5432,"database":"stalwart","authUsername":"stalwart","authSecret":{"@type":"EnvironmentVariable","variableName":"PGPASSWORD"},"useTls":false}'
diff --git a/apps/stalwart/stalwart-config.yaml b/apps/stalwart/stalwart-config.yaml
index cc43958..c9da9bc 100644
--- a/apps/stalwart/stalwart-config.yaml
+++ b/apps/stalwart/stalwart-config.yaml
@@ -10,12 +10,22 @@ data:
     # Stalwart Mail Server Configuration
     #
 
+    # DEV-476: primary store is PostgreSQL (see stalwart-bootstrap-config.yaml).
+    # Note: the container starts with `--config /etc/stalwart/config.json`, so
+    # this stalwart.toml is not read at runtime for a live pod — the bootstrap
+    # JSON is authoritative. Kept in sync here as documentation and for any
+    # one-shot tooling that references the toml.
     [store]
-    data = "rocksdb"
+    data = "postgres"
 
-    [store.rocksdb]
-    type = "rocksdb"
-    path = "/var/lib/stalwart"
+    [store.postgres]
+    type = "postgresql"
+    host = "stalwart-postgres"
+    port = 5432
+    database = "stalwart"
+    user = "stalwart"
+    password = "%{env:PGPASSWORD}%"
+    tls.enable = false
 
     #
     # Server Configuration
diff --git a/apps/stalwart/stalwart-fresh-deployment.yaml b/apps/stalwart/stalwart-fresh-deployment.yaml
index 5201c47..e974c9d 100644
--- a/apps/stalwart/stalwart-fresh-deployment.yaml
+++ b/apps/stalwart/stalwart-fresh-deployment.yaml
@@ -145,6 +145,12 @@ spec:
           value: "/etc/stalwart/certs/tls.crt"
         - name: TLS_PRIVATE_KEY
           value: "/etc/stalwart/certs/tls.key"
+        # DEV-476: bootstrap config.json resolves authSecret via this env var.
+        - name: PGPASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: stalwart-postgres-credentials
+              key: POSTGRES_PASSWORD
         volumeMounts:
         - name: data
           mountPath: /var/lib/stalwart