diff --git a/apps/portal/pages/index.vue b/apps/portal/pages/index.vue
index 6da2061..8558ecc 100644
--- a/apps/portal/pages/index.vue
+++ b/apps/portal/pages/index.vue
@@ -31,7 +31,7 @@ const { user, logout } = useOidcAuth()
           <span class="tile-name">Files</span>
           <span class="tile-meta">OCIS · S3-backed storage</span>
         </a>
-        <a href="https://mail.dezky.local" target="_blank" class="tile">
+        <a href="https://mail.dezky.local/admin/" target="_blank" class="tile">
           <span class="tile-name">Mail</span>
           <span class="tile-meta">Stalwart · JMAP/IMAP/SMTP</span>
         </a>
diff --git a/infrastructure/docker-compose/docker-compose.yml b/infrastructure/docker-compose/docker-compose.yml
index e4a4dab..3b4f5c3 100644
--- a/infrastructure/docker-compose/docker-compose.yml
+++ b/infrastructure/docker-compose/docker-compose.yml
@@ -203,6 +203,10 @@ services:
       - "4190:4190"   # ManageSieve
     environment:
       STALWART_FQDN: mail.dezky.local
+      # Pin the recovery admin so it survives restarts. Without this, Stalwart
+      # generates a one-time-shown password at first boot and discards it after
+      # initial setup.
+      STALWART_RECOVERY_ADMIN: admin:${STALWART_ADMIN_PASSWORD}
     volumes:
       - stalwart_data:/opt/stalwart
       - ./configs/stalwart/config.toml:/opt/stalwart/etc/config.toml:ro