diff --git a/apps/base/mail/smarthost-statefulset.yaml b/apps/base/mail/smarthost-statefulset.yaml
index 2bd4527..0a0a278 100644
--- a/apps/base/mail/smarthost-statefulset.yaml
+++ b/apps/base/mail/smarthost-statefulset.yaml
@@ -6,6 +6,7 @@ metadata:
   namespace: mail
   annotations:
     configmap.reloader.stakater.com/reload: "smarthost-config"
+    secret.reloader.stakater.com/reload: "vault-ca-cert"
 spec:
   serviceName: smarthost
   replicas: 2
@@ -71,6 +72,9 @@ spec:
             - name: tls
               mountPath: /etc/postfix/tls
               readOnly: true
+            - name: vault-ca-cert
+              mountPath: /etc/postfix/edge-ca
+              readOnly: true
             - name: config
               mountPath: /etc/postfix/main.cf
               subPath: main.cf
@@ -106,6 +110,12 @@ spec:
         - name: tls
           secret:
             secretName: wildcard-main-unkin-net-tls
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
   volumeClaimTemplates:
     - metadata:
         name: spool
diff --git a/apps/base/mail/smarthost/tls_policy b/apps/base/mail/smarthost/tls_policy
index dd1481a..b6b192f 100644
--- a/apps/base/mail/smarthost/tls_policy
+++ b/apps/base/mail/smarthost/tls_policy
@@ -1,2 +1,2 @@
-[mta1.edge.unkin.net]:25 secure match=hostname
-[mta2.edge.unkin.net]:25 secure match=hostname
+[mta1.edge.unkin.net]:25 secure match=hostname tafile=/etc/postfix/edge-ca/ca.crt
+[mta2.edge.unkin.net]:25 secure match=hostname tafile=/etc/postfix/edge-ca/ca.crt