diff --git a/infra/k8s/network-policies/stalwart.yaml b/infra/k8s/network-policies/stalwart.yaml
index 88a224659..01fdf2e4c 100644
--- a/infra/k8s/network-policies/stalwart.yaml
+++ b/infra/k8s/network-policies/stalwart.yaml
@@ -36,6 +36,10 @@ spec:
           protocol: UDP
         - port: 53
           protocol: TCP
+    # HTTPS out — webadmin bundle + spam model downloads from GitHub
+    - ports:
+        - port: 443
+          protocol: TCP
     # No outbound SMTP — internal-only for now.
     # To add SCW TEM relay later:
     #   - ports:
diff --git a/infra/k8s/stalwart/stalwart.yaml b/infra/k8s/stalwart/stalwart.yaml
index db22eb60c..aa40f67e9 100644
--- a/infra/k8s/stalwart/stalwart.yaml
+++ b/infra/k8s/stalwart/stalwart.yaml
@@ -62,8 +62,8 @@ data:
     store = "rocksdb"
 
     [certificate.default]
-    cert = "/opt/stalwart/tls/tls.crt"
-    private-key = "/opt/stalwart/tls/tls.key"
+    cert = "%{file:/opt/stalwart/tls/tls.crt}%"
+    private-key = "%{file:/opt/stalwart/tls/tls.key}%"
 ---
 apiVersion: apps/v1
 kind: Deployment