diff --git a/config/permissions/akP-mail-user.yaml b/config/permissions/akP-mail-user.yaml
new file mode 100644
index 0000000..8d78fd6
--- /dev/null
+++ b/config/permissions/akP-mail-user.yaml
@@ -0,0 +1,3 @@
+# Permission group akP-mail-user (name = filename). Grants mailbox access:
+# bound to the stalwart application, gating mail.unkin.net logins.
+application: stalwart
diff --git a/config/providers_oauth2/stalwart.yaml b/config/providers_oauth2/stalwart.yaml
new file mode 100644
index 0000000..e35a8bf
--- /dev/null
+++ b/config/providers_oauth2/stalwart.yaml
@@ -0,0 +1,20 @@
+# OAuth2/OIDC provider + application for Stalwart (mail server, web UI/JMAP at
+# https://mail.unkin.net in the mail namespace). Stalwart's OIDC directory
+# validates access tokens (JWT, userinfo fallback) and requires aud=stalwart
+# plus the openid+email scopes; it maps preferred_username/name from profile.
+# public, no secret: the web UI uses PKCE; the strict redirect URIs are the control.
+name: stalwart
+authorization_flow: default-provider-authorization-implicit-consent
+invalidation_flow: default-provider-invalidation-flow
+client_type: public
+client_id: stalwart
+launch_url: https://mail.unkin.net/
+scope_mappings:
+  - goauthentik.io/providers/oauth2/scope-openid
+  - goauthentik.io/providers/oauth2/scope-email
+  - goauthentik.io/providers/oauth2/scope-profile
+redirect_uris:
+  - matching_mode: strict
+    url: https://mail.unkin.net/account/oauth/callback
+  - matching_mode: strict
+    url: https://mail.unkin.net/admin/oauth/callback
diff --git a/config/roles/akR-global-admin.yaml b/config/roles/akR-global-admin.yaml
index d378b75..9f5c90c 100644
--- a/config/roles/akR-global-admin.yaml
+++ b/config/roles/akR-global-admin.yaml
@@ -10,6 +10,7 @@ permissions:
   - akP-traefik-admin
   - akP-logviewer-admin
   - akP-vlogs-admin
+  - akP-mail-user
   - akP-watchstate-admin
   - akP-repospawner-admin
   - akP-vault-admin