diff --git a/templates/calcom/.felhom.yml b/templates/calcom/.felhom.yml
index 718b525..1c7edd9 100644
--- a/templates/calcom/.felhom.yml
+++ b/templates/calcom/.felhom.yml
@@ -81,3 +81,17 @@ healthcheck:
       path: "/api/health"
       expect:
         status: 200
+
+# --- App-email mapping (apps → in-controller shim → hub → Resend) ---
+# Cal.com (Nodemailer) hard-codes TLS rejectUnauthorized=true with no skip flag and opportunistically
+# STARTTLS-upgrades whenever the server offers it — so it cannot use the self-signed :2525 listener.
+# tls_mode=plaintext points it at the :2526 listener, which does NOT advertise STARTTLS, so Cal.com never
+# attempts TLS (plaintext on the single-tenant app bridge — accepted posture). secure is inferred from the
+# port (≠465 → plaintext). EMAIL_SERVER_USER/PASSWORD stay unset (the shim accepts no-auth).
+smtp_mapping:
+  tls_mode: plaintext
+  host_var: EMAIL_SERVER_HOST
+  port_var: EMAIL_SERVER_PORT
+  from_var: EMAIL_FROM
+  from_name_var: EMAIL_FROM_NAME
+  from_local: calcom
diff --git a/templates/calcom/docker-compose.yml b/templates/calcom/docker-compose.yml
index 08c1237..5cfefd9 100644
--- a/templates/calcom/docker-compose.yml
+++ b/templates/calcom/docker-compose.yml
@@ -23,6 +23,13 @@ services:
       - DATABASE_URL=postgresql://calcom:${DB_PASSWORD}@calcom-postgres:5432/calcom
       - NEXT_PUBLIC_WEBAPP_URL=https://${SUBDOMAIN}.${DOMAIN}
       - NEXTAUTH_URL=https://${SUBDOMAIN}.${DOMAIN}
+      # App-email (managed relay). Injected by the controller only when app-email is on (global + per-app);
+      # empty EMAIL_SERVER_HOST keeps Cal.com mail disabled. Cal.com uses the plaintext :2526 listener
+      # (tls_mode=plaintext) — it can't accept the self-signed STARTTLS cert. See .felhom.yml smtp_mapping.
+      - EMAIL_FROM=${EMAIL_FROM:-}
+      - EMAIL_FROM_NAME=${EMAIL_FROM_NAME:-Felhom}
+      - EMAIL_SERVER_HOST=${EMAIL_SERVER_HOST:-}
+      - EMAIL_SERVER_PORT=${EMAIL_SERVER_PORT:-587}
     networks:
       - traefik-public
       - calcom-internal
diff --git a/templates/nextcloud/.felhom.yml b/templates/nextcloud/.felhom.yml
index 410a7d7..d536a08 100644
--- a/templates/nextcloud/.felhom.yml
+++ b/templates/nextcloud/.felhom.yml
@@ -99,3 +99,18 @@ healthcheck:
       expect:
         status: 200
         body_contains: "installed"
+
+# --- App-email mapping (apps → in-controller shim → hub → Resend) ---
+# Nextcloud (Symfony Mailer) has no env to skip TLS cert verification and opportunistically STARTTLS-upgrades,
+# so it can't use the self-signed :2525 listener → tls_mode=plaintext points it at :2526 (STARTTLS NOT
+# advertised → no upgrade attempted; plaintext on the single-tenant app bridge — accepted posture).
+# Nextcloud SPLITS the From into local-part + domain, so from_var=MAIL_FROM_ADDRESS (local) +
+# from_domain_var=MAIL_DOMAIN → nextcloud@felhom.eu. No security_var (SMTP_SECURE stays empty = no TLS);
+# SMTP_NAME/PASSWORD unset (no auth). The official image reads these via getenv() on every boot.
+smtp_mapping:
+  tls_mode: plaintext
+  host_var: SMTP_HOST
+  port_var: SMTP_PORT
+  from_var: MAIL_FROM_ADDRESS
+  from_domain_var: MAIL_DOMAIN
+  from_local: nextcloud
diff --git a/templates/nextcloud/docker-compose.yml b/templates/nextcloud/docker-compose.yml
index 85a430e..5c1f0c2 100644
--- a/templates/nextcloud/docker-compose.yml
+++ b/templates/nextcloud/docker-compose.yml
@@ -33,6 +33,15 @@ services:
       - OVERWRITEPROTOCOL=https
       - OVERWRITEHOST=${SUBDOMAIN}.${DOMAIN}
       - REDIS_HOST=nextcloud-redis
+      # App-email (managed relay). Injected by the controller only when app-email is on (global + per-app);
+      # empty SMTP_HOST keeps Nextcloud mail disabled. Nextcloud uses the plaintext :2526 listener
+      # (tls_mode=plaintext, SMTP_SECURE empty = no TLS) — it can't skip the self-signed STARTTLS cert.
+      # From is split: MAIL_FROM_ADDRESS=nextcloud + MAIL_DOMAIN=felhom.eu. See .felhom.yml smtp_mapping.
+      - SMTP_HOST=${SMTP_HOST:-}
+      - SMTP_PORT=${SMTP_PORT:-25}
+      - SMTP_SECURE=${SMTP_SECURE:-}
+      - MAIL_FROM_ADDRESS=${MAIL_FROM_ADDRESS:-}
+      - MAIL_DOMAIN=${MAIL_DOMAIN:-}
     volumes:
       - nextcloud_html:/var/www/html
       - ${HDD_PATH}/appdata/nextcloud:/var/www/html/data