diff --git a/kubernetes/personal/openclaw/kustomization.yaml b/kubernetes/personal/openclaw/kustomization.yaml
index 9987a15..c6dc919 100644
--- a/kubernetes/personal/openclaw/kustomization.yaml
+++ b/kubernetes/personal/openclaw/kustomization.yaml
@@ -5,3 +5,4 @@ resources:
   - openclaw-instance.yaml
   - openclaw-secrets.yaml
   - networkpolicy.yaml
+  - networkpolicy-mail-egress.yaml
diff --git a/kubernetes/personal/openclaw/networkpolicy-mail-egress.yaml b/kubernetes/personal/openclaw/networkpolicy-mail-egress.yaml
new file mode 100644
index 0000000..196afba
--- /dev/null
+++ b/kubernetes/personal/openclaw/networkpolicy-mail-egress.yaml
@@ -0,0 +1,31 @@
+# Supplementary egress policy: the operator's managed default-deny NetworkPolicy
+# only allows DNS + TCP 443 outbound, which blocks IMAP/SMTP to Stalwart.
+# The CR field spec.networkPolicy.additionalEgress would be the native fix,
+# but it is not in the CRD bundled with chart 0.39.0 yet (silently pruned).
+# Revisit after upgrading the operator.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: openclaw-mail-egress
+  namespace: openclaw
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: openclaw
+      app.kubernetes.io/name: openclaw
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: stalwart
+      ports:
+        - port: 143
+          protocol: TCP
+        - port: 993
+          protocol: TCP
+        - port: 587
+          protocol: TCP
+        - port: 465
+          protocol: TCP
diff --git a/kubernetes/personal/openclaw/openclaw-secrets.yaml b/kubernetes/personal/openclaw/openclaw-secrets.yaml
index b02bf64..2f94d18 100644
--- a/kubernetes/personal/openclaw/openclaw-secrets.yaml
+++ b/kubernetes/personal/openclaw/openclaw-secrets.yaml
@@ -6,29 +6,32 @@ metadata:
     namespace: openclaw
 type: Opaque
 stringData:
-    CHUTES_API_KEY: ENC[AES256_GCM,data:yEvvMJI+FDrexqA3In9cRJrzF98Iya8LgTat+EAykn+I5vdEmhdozfesZ6ROyhwNfHYVjKXDegtSZhGhZ/unhqUHb0w/EIOEYe172HLZsnACYAgQ+RioXsYTO1TtFfNJRTCCzVKg,iv:gPFQkjeL+BWksziHminWeD19PoJQK3gk0tFpTvmMazU=,tag:m4qrl/TufcKdqPSG7OxKUQ==,type:str]
+    CHUTES_API_KEY: ENC[AES256_GCM,data:Q+rolk3ZLF3lIEcGUcQYrJe0G0Eq7o+aafqK3wZfKnNxi4UiB5NM6+KcKbKi7FL4UeoMC2MQ+HuszJWfC+X5i4ADGzW5y3CAqMoOblgmjvN1qDWRc7zog1bKBqeHuDfiJn3KjUXf,iv:KCwxCRZqjO9qz4mI7NvEiY44Evk2mPB2aiDwzhcV+PI=,tag:C4EyScSpzFIpTIYPt7nBgQ==,type:str]
+    #ENC[AES256_GCM,data:dMUyQ2WCohbYG03WYtOu7ifCobP/HacAO3ag+TWFYYTe9j3stuZb54MwfA==,iv:R4nhUGdCaWZOizJY8ggMNhQWi9f8p+KCqqSBUn8+yRY=,tag:hT6jS5kDLyBlat/LunpePQ==,type:comment]
+    EMAIL_ADDRESS: ENC[AES256_GCM,data:bW8Gn7DVlbWlouZWyhAsMsUc0Zk=,iv:PGY3U+wsMuy0yF51c6SpreDEGTismFZnmankuzXqMhM=,tag:9iD1Svx3ls6nw7cThojclg==,type:str]
+    EMAIL_PASSWORD: ENC[AES256_GCM,data:ssLNISDNPEdpHqKsutc=,iv:bETkOG2yKtm9PrSCh7VgUfjPXzeIW/yIdPEsrzT76yE=,tag:AdRW8jnr/+Nh1RoqbBHRAQ==,type:str]
 sops:
-    lastmodified: "2026-08-23T08:43:07Z"
-    mac: ENC[AES256_GCM,data:7sddfyesPNXDr2c937J3BSxZk16Dm02BLCvHcVTjPReOJSbkG4dNVuEKM4ThWvXG2tKJkYKwCDQbOvLDXBd6ksZebJ3vVSMna6ijURTiUtWf+Gz8rFJUoTSSEb9p42nV0ki1E3azgmkydJJFA8RvnmB7nmSJe423d4fGEcJi5Zs=,iv:Z1I3zzsP/3iCn64nH1LdNKaac2e5oKAWSRO0lWN99HA=,tag:sBMHlhqFDtHWC210cYEfDg==,type:str]
+    lastmodified: "2026-08-24T12:01:23Z"
+    mac: ENC[AES256_GCM,data:Rl1yVrIdYsBTaMMz0a9jEYQ7uVxvDBrmWCmFvGcyUQKr4Yfq56gaRMHItabgu2Vsch0o2X7ljeeTD75WoWeBhV51ne1TZo/E3x4fRl05Oz54bDF/59VUbP184ZqI9pw/WEVyumUtOyIwvBpsmkutryuE1aTzPMIz45YiwMctDrE=,iv:wwIVKBmxQiEauSeyUQ4F+oQHVKhcDDQDW4Kaxy0eVVA=,tag:Y4EmW0KjtGZsZ7vfDLCoWg==,type:str]
     pgp:
-        - created_at: "2026-08-23T08:43:07Z"
+        - created_at: "2026-08-24T12:01:23Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiARAAvlqjsVlnBSmoIfovSFZgNWvIbwbtYW7fpBcO6xUqtacs
-            lNS3tXElKiwpyj8Y6laePIoRzmah3H7qJGcK1JtEcL6EPYUw5HoVMgvn6wyiIdvx
-            0djAeOVsvU9VAxjsC5pwMGoFdMzLvFe2nSjRkggAf4rblYlFD0cCOqNLAHZyhjED
-            8DCC4hP7i15zcqwgdZ2fLTgYufJqefZcpLPmThp9ZTEqrVts8ieX9t+3IxlkznHo
-            FxP8gM9Hz+T9u/iWbshPRNZZYihaNIN/jsgWIMN8EZlJjS6B1z49pkNR/K0tmLwB
-            NUYcYqADyEJO+2mb4WsKh3Ljb7Bl7ki+0IgC6cIoHQ4U65+yUD3R9Hgx7QQd49Oq
-            +VoDV2K9R6zjbUTG+IuSBiAFZ8IgLp54ejUBtY3vPbVsz+xBW1OinFPw3uYbclJe
-            M5SRNq3VzqiQNn0CGVxt2DlMGIIrQtuyiMpWeucakfJNhTzESiwrTfGT8mSzor+A
-            XGfV9vwO4LgdiLk5vw3k03WMGfFQHZdRmg3wghQn7GWpfCI1mZZUvzyXAfmKmYbJ
-            EB+sgTctkb1+evGcpP9XOMvcdz5CUWkdv7pyDTJyyVA4cIiG+1nyHGDAqQW2hNCJ
-            rojj3R6NTjLyaEYXAlNc81dkVA3vT1fhjoMgLvcRx70Ytm9Qz0yyemTCYLfEeFjS
-            XgHzlwuM4zSITkJio00+8AqfKX/OWZKbKNqnuwMuFoX+PSNOHiWsywMuEskfFfni
-            HsvvQnmpFi2d7mr8bhNFdraeWnF4D/jJlpsNrnNDgYYVU6Ejv6GBH25FEpIDhQU=
-            =EAhW
+            hQIMA7uy4qQr71wiAQ//UJlw8rwq1mw4f6ePa3uCpVxTiCFFFjOdgOj0wsn1WXv6
+            k2fpGPV1JwIFj4Wj5AL7EqWH4iII5uxqft6XykjyhmXL2FHqO8ZN4Q/PIDpgakuF
+            le256k8KbhuVjUWjtZ73pGYUkB3X9ZBBIkh6XtHVtMaOpJc2mtekuZ5PWv3YhRGd
+            v/jswjzuVtjFoG4n4yimOXTQgN3HtiL08eznurRf9dz9X9s7pGI8pKqQk7cGiBv9
+            EnczRcXnTvJKVfjKAQeEsr4KGvhhrJMxtH4laSUu0xBabV8UEzuqC0q71gSBtmXr
+            5eHg5iFXjmcn1uXHYkKreEPkNTdh7hz3gW3qFJpRTtwYjTZzDjytoP6XVSq+avpS
+            kd4iqWeS4YFTFyMfPVRLZg9TJTTAXhSlhvx7qXUPOuKtuGaoEJY67F/tnIB2WEE+
+            WCgiWqsPGoXKEFI6Le7NrjsRnhJ3FLCnkd+kal8pypJOjgmJMEn8Jd1mfVxHY5gR
+            jk5wgRu38zUwnOSPiee2N1LsxphQCFazP3iNn3VXUyQ8hqAxilyD6gCUz2TNBEls
+            pZLFNrTdPb4Wz+hHyrXfMXW1zL5+1rUbdj6h1JFxJwg6ZC0togiFwIJrMgTexZE5
+            BLOM5xwqPEaXVe/0EdgHl2borMvhqLQkS1j8gOjMceH8hUPM6FWU/PxjvsfhlMbS
+            XgHJYRd0rrlzvBDh1AbAhzqo2kP01eLXEEnln6u54G70TuBxD752B2EsJRFII+ru
+            b/UgHWJtc+sAESED9bHzFCoTs9QXyMuAuRrMUHtpkSF8T4DyW7j8fFcS+C7FuDs=
+            =2HcA
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(data|stringData|.*key|.*crt)$