diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 035ecaa..be8463e 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -18,7 +18,7 @@ on:
       - .gitea/workflows/deploy.yml
 
 env:
-  PORTAL_RELEASE: v0.6.15
+  PORTAL_RELEASE: v0.6.21
   INSTANCE: uhhm-portal
 
 jobs:
@@ -129,6 +129,17 @@ jobs:
           		}
           	}
 
+          	# CalDAV and CardDAV discovery (RFC 6764): a client looks for
+          	# these on the domain its address is in, and Stalwart answers
+          	# each with a 307 to the collection. iOS uses these even though
+          	# Apple Mail ignores autoconfig and Autodiscover entirely.
+          	@dav path /.well-known/caldav /.well-known/carddav
+          	handle @dav {
+          		reverse_proxy stalwart:8080 {
+          			header_up Host mail.{$DOMAIN}
+          		}
+          	}
+
           	@autodiscover path /Autodiscover/* /autodiscover/* /AutoDiscover/*
           	handle @autodiscover {
           		reverse_proxy stalwart:8080 {
diff --git a/.gitea/workflows/lint-and-reload.yml b/.gitea/workflows/lint-and-reload.yml
index d94b63c..46fe83c 100644
--- a/.gitea/workflows/lint-and-reload.yml
+++ b/.gitea/workflows/lint-and-reload.yml
@@ -20,7 +20,7 @@ jobs:
       # (PORTAL_RELEASE in deploy.yml).
       - name: Lint questions
         env:
-          PORTAL_RELEASE: v0.6.15
+          PORTAL_RELEASE: v0.6.21
         run: |
           # The checkout is on a noexec mount for this runner; the cargo
           # target dir is where it may run what it fetched.
diff --git a/.well-known/security.txt b/.well-known/security.txt
new file mode 100644
index 0000000..65528b2
--- /dev/null
+++ b/.well-known/security.txt
@@ -0,0 +1,6 @@
+# How to report a security problem with uhhm.no, served from this repo's
+# .well-known/ by portal's static root overlay.
+Contact: mailto:bl@uhhm.no
+Expires: 2027-10-07T00:00:00.000Z
+Preferred-Languages: no, en
+Canonical: https://uhhm.no/.well-known/security.txt