diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/session.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/session.nix
index 65f73d71..cdcc7abe 100644
--- a/systems/x86_64-linux/prefect/services/mailserver/stalwart/session.nix
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/session.nix
@@ -28,14 +28,16 @@
   };
   auth = {
     mechanisms = [
-      (ifThen "protocol != 'smtp'" "[plain, login]")
+      (ifThen "local_port != 40025 && is_tls" "[plain, login, oauthbearer, xoauth2]")
+      (ifThen "local_port != 40025" "[oauthbearer, xoauth2]")
       (otherwise false)
     ];
     directory = "'default'";
     require = [
-      (ifThen "protocol != 'smtp'" true)
+      (ifThen "local_port != 40025" true)
       (otherwise false)
     ];
+    must-match-sender = true;
   };
   extensions =
     let