diff --git a/apps/base/mail/stalwart-apply-job.yaml b/apps/base/mail/stalwart-apply-job.yaml
index 70059a3..79578f7 100644
--- a/apps/base/mail/stalwart-apply-job.yaml
+++ b/apps/base/mail/stalwart-apply-job.yaml
@@ -34,6 +34,9 @@ spec:
             - --file
             - /plan/plan.ndjson
           env:
+            # the cli caches the server schema under $HOME/.cache
+            - name: HOME
+              value: /tmp
             - name: STALWART_URL
               value: http://stalwart.mail.svc:8080
             - name: STALWART_USER
@@ -63,6 +66,8 @@ spec:
             - name: plan
               mountPath: /plan
               readOnly: true
+            - name: tmp
+              mountPath: /tmp
       containers:
         - name: restart
           image: registry.k8s.io/kubectl:v1.33.13
@@ -71,6 +76,9 @@ spec:
             - restart
             - statefulset/stalwart
             - --namespace=mail
+          env:
+            - name: HOME
+              value: /tmp
           securityContext:
             runAsUser: 65532
             runAsGroup: 65532
@@ -86,6 +94,9 @@ spec:
             requests:
               cpu: 50m
               memory: 32Mi
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
       volumes:
         - name: plan
           configMap:
@@ -93,3 +104,5 @@ spec:
             items:
               - key: plan.ndjson
                 path: plan.ndjson
+        - name: tmp
+          emptyDir: {}