diff --git a/proxy/install.sh b/proxy/install.sh
index cfca993..7bffcdf 100644
--- a/proxy/install.sh
+++ b/proxy/install.sh
@@ -44,6 +44,10 @@ ACME_EMAIL="${ACME_EMAIL:-}"
 # Generate at https://login.tailscale.com/admin/settings/keys
 TS_AUTHKEY="${TS_AUTHKEY:-}"
 
+# Tailscale hostname of the SimpleLogin host (used for SMTP TCP passthrough).
+# Override via environment if the MagicDNS name differs.
+SIMPLELOGIN_TS_HOSTNAME="${SIMPLELOGIN_TS_HOSTNAME:-simplelogin}"
+
 main() {
     log_info "=== Proxy Server Deployment (Traefik v3) ==="
 
@@ -141,6 +145,15 @@ main() {
         log_info "UFW already configured, skipping reset."
     fi
 
+    # Independent idempotent check for port 25 — runs on every invocation so
+    # hosts provisioned before this rule was added also converge on re-run.
+    if ! sudo ufw status | grep -q "25/tcp"; then
+        log_info "Opening port 25/tcp for SMTP..."
+        sudo ufw allow 25/tcp > /dev/null
+    else
+        log_info "Port 25/tcp already allowed, skipping."
+    fi
+
     log_info "Configuring Fail2ban for Traefik..."
     # Create the log file and fail2ban socket dir now so:
     #  - fail2ban can open the log file when the jail loads.
@@ -198,6 +211,7 @@ services:
     ports:
       - "80:80"
       - "443:443"
+      - "25:25"
       # MUST stay on 127.0.0.1: dashboard is unauthenticated (see traefik.yml).
       - "127.0.0.1:8080:8080"
     volumes:
@@ -239,6 +253,9 @@ entryPoints:
   traefik:
     address: ":8080"
 
+  smtp:
+    address: ":25"
+
 certificatesResolvers:
   letsencrypt:
     acme:
@@ -290,6 +307,24 @@ http:
           - url: "http://gitea.taila5ad8.ts.net:3000"
 EOF
 
+    # --- conf.d/simplelogin-smtp.yml (dynamic config) ---
+    # Unquoted EOF: $SIMPLELOGIN_TS_HOSTNAME must expand at write time.
+    cat > "$TRAEFIK_DIR/conf.d/simplelogin-smtp.yml" << EOF
+tcp:
+  routers:
+    simplelogin-smtp:
+      rule: "HostSNI(\`*\`)"
+      entryPoints:
+        - smtp
+      service: simplelogin-smtp
+
+  services:
+    simplelogin-smtp:
+      loadBalancer:
+        servers:
+          - address: "${SIMPLELOGIN_TS_HOSTNAME}:25"
+EOF
+
     log_info "Starting Traefik stack..."
     # Use sg to apply the docker group without requiring a re-login.
     # cd into the dir so paths inside the command don't break on spaces in $HOME.