diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index be8463e..0460eba 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -133,7 +133,13 @@ jobs:
           	# these on the domain its address is in, and Stalwart answers
           	# each with a 307 to the collection. iOS uses these even though
           	# Apple Mail ignores autoconfig and Autodiscover entirely.
-          	@dav path /.well-known/caldav /.well-known/carddav
+          	# The collections the two redirects above point at. Stalwart builds
+          	# those Location headers from the forwarded host, not from the Host
+          	# this route rewrites, so they land on the bare domain - which means
+          	# the collections have to be reachable here too, or a client follows
+          	# a 307 into portal's catch-all. Keeping them on one host is the
+          	# better answer anyway: the client never changes origin.
+          	@dav path /.well-known/caldav /.well-known/carddav /dav/*
           	handle @dav {
           		reverse_proxy stalwart:8080 {
           			header_up Host mail.{$DOMAIN}