diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 79b5526..035ecaa 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -114,7 +114,32 @@ jobs:
           }
 
           {$DOMAIN} {
-          	reverse_proxy host.docker.internal:3010
+          	# Mail clients look for their configuration on the bare domain -
+          	# Thunderbird at /.well-known/autoconfig, Outlook by POSTing to
+          	# /Autodiscover. Stalwart already generates both, templated on the
+          	# address asked about, so these two paths go to it instead of being
+          	# copied into this repo: one source of truth, and no second
+          	# hostname to certify. Host is rewritten to the name Stalwart
+          	# answers for; it never sees a request for the bare domain
+          	# otherwise. (MTA-STS cannot be served here - RFC 8461 requires
+          	# mta-sts.<domain> - so it keeps its own record and route.)
+          	handle /.well-known/autoconfig/* {
+          		reverse_proxy stalwart:8080 {
+          			header_up Host mail.{$DOMAIN}
+          		}
+          	}
+
+          	@autodiscover path /Autodiscover/* /autodiscover/* /AutoDiscover/*
+          	handle @autodiscover {
+          		reverse_proxy stalwart:8080 {
+          			header_up Host mail.{$DOMAIN}
+          		}
+          	}
+
+          	handle {
+          		reverse_proxy host.docker.internal:3010
+          	}
+
           	log {
           		output file /var/log/caddy/www.log
           	}