diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 0460eba..bb833b6 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -123,6 +123,17 @@ jobs:
           	# answers for; it never sees a request for the bare domain
           	# otherwise. (MTA-STS cannot be served here - RFC 8461 requires
           	# mta-sts.<domain> - so it keeps its own record and route.)
+          	# PACC, the standard that replaces guessing at hostnames: one JSON
+          	# document on the mail domain itself advertising every protocol,
+          	# which is why it belongs here and not on a subdomain. Stalwart
+          	# generates it, and /.well-known/mail-v1.xml beside it.
+          	@pacc path /.well-known/user-agent-configuration.json /.well-known/mail-v1.xml
+          	handle @pacc {
+          		reverse_proxy stalwart:8080 {
+          			header_up Host mail.{$DOMAIN}
+          		}
+          	}
+
           	handle /.well-known/autoconfig/* {
           		reverse_proxy stalwart:8080 {
           			header_up Host mail.{$DOMAIN}