diff --git a/hosts/carrot/authentik.nix b/hosts/carrot/authentik.nix
index aa26f5f..fb18019 100644
--- a/hosts/carrot/authentik.nix
+++ b/hosts/carrot/authentik.nix
@@ -25,11 +25,11 @@
         paths.media = "/var/lib/authentik/media";
         media.enable_upload = true;
         email = {
-          host = "smtp.mailbox.org";
-          port = 587;
-          username = "alex@xanderio.de";
-          use_tls = true;
-          use_ssl = false;
+          host = "mail.xanderio.de";
+          port = 465;
+          username = "authentik";
+          use_tls = false; # STARTTLS
+          use_ssl = true; # implicited SSL/TLS
           from = "authentik@xanderio.de";
         };
       };
diff --git a/hosts/carrot/mail.nix b/hosts/carrot/mail.nix
index 1461c0b..54c8ea7 100644
--- a/hosts/carrot/mail.nix
+++ b/hosts/carrot/mail.nix
@@ -8,7 +8,7 @@ in
     x.sops.secrets."services/stalwart/adminPwd" = { };
 
     security.acme.certs."${domain}" = {
-      extraDomainNames = [ "autoconfig.bitflip.jetzt" "autodiscovery.bitflip.jetzt" ];
+      extraDomainNames = [ "autoconfig.bitflip.jetzt" "autodiscovery.bitflip.jetzt" "autoconfig.xanderio.de" "autodiscovery.xanderio.de" ];
     };
 
     systemd.services.stalwart-mail = {
diff --git a/secrets/services/authentik.yaml b/secrets/services/authentik.yaml
index 62907ae..9e8cc53 100644
--- a/secrets/services/authentik.yaml
+++ b/secrets/services/authentik.yaml
@@ -1,7 +1,7 @@
 services:
     authentik:
         secret_key: ENC[AES256_GCM,data:5Uh8y9ovTl0Izdls1hlJs6FumYwWQyrmu1IUkcJrkcdMGYVXKcPcA78B1KM=,iv:Cc7MnJFa7sCPaVEm+51kXjFtIK6FUhewxGMaEGLuR7w=,tag:inrgX3NnUEzIcZozjoJZwA==,type:str]
-        email_password: ENC[AES256_GCM,data:362IPpOnA6pCRgXv03w=,iv:t0JMTOE+KF1lnMINJt8I9VzdOwf+vYR5OUbIrmxtr5w=,tag:59606yqHamSWyd6QQ9b5zw==,type:str]
+        email_password: ENC[AES256_GCM,data:1f/V5WqZrNDcr8XXg1RowI5gUg==,iv:e+K9Ux2Ggl/tpRPrbw66OfVIc7TuS0GVXb+OU6maMAc=,tag:xKhFMvgDkcjlOttHab7Eig==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -35,8 +35,8 @@ sops:
             TzdiVkJ1ejl6Syt2bE8xNXltVWd3UG8KeqODNxL+gLI3kJvd8x4czKq8MNf4itT/
             98QYI1FI+Ag2j4Vf5RMmRtmQfFOrcv8r7oETiyskhLQF6f5aypttww==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-12-25T12:21:52Z"
-    mac: ENC[AES256_GCM,data:DB+WjlAE39OP/TAXcomPy3Sp9JxeTur6MouP5wwj55urBf/I6+OfpFSiZiIMQ3h1TdrGLD629Mjm4QAKL8gXNci1bADwQe4W3Q9S5AwxIpXtp86DOoSkVcUJkUMO+adhArgJXIIq8Wq0KOsXWf0mm/NR5pDlQNpbHAPuIsE8vsc=,iv:Nlq066DkvueEuaK6B49ommk11UZZ1GozrMxOXVKTHu4=,tag:6ds8ccDiWNCI6jbfGtOvaA==,type:str]
+    lastmodified: "2024-06-07T12:43:02Z"
+    mac: ENC[AES256_GCM,data:7FdnNDCcMosKctWPGQFG1r2h/QHB6ivJRadcWDkOYYOykG/6ogEBW0SToZHG81iVRFYLlY6O0SWhYfUtArtYnMYlmruPVoGIjdSP/lkEmJ3cnL7BIXdxaQKCXEfeu4jBF0I1a7abQVy5AJgGw5pUgcVUN+mcZvBNCYG1eJaEcY0=,iv:rOXp5kJu69e2T1Utsx6GhSseAVqUNvWi9WJ4e2nE3p0=,tag:1ofLr2AYMSrZjIs2nAwaHQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1