diff --git a/stalwart/templates/configmap.yaml b/stalwart/templates/configmap.yaml
index 14cb689..3f22620 100644
--- a/stalwart/templates/configmap.yaml
+++ b/stalwart/templates/configmap.yaml
@@ -84,6 +84,11 @@ data:
     user = "%{env:STALWART_ADMIN_USER}%"
     secret = "%{env:STALWART_ADMIN_PASSWORD}%"
 
+    [certificate."default"]
+    cert = "file:///opt/stalwart/certs/tls.crt"
+    private-key = "file:///opt/stalwart/certs/tls.key"
+    default = true
+
     [tracer.log]
     type = "log"
     enable = true
diff --git a/stalwart/templates/deployment.yaml b/stalwart/templates/deployment.yaml
index 40179d9..22d4985 100644
--- a/stalwart/templates/deployment.yaml
+++ b/stalwart/templates/deployment.yaml
@@ -66,6 +66,9 @@ spec:
         - name: config
           mountPath: /opt/stalwart/etc/config.toml
           subPath: config.toml
+        - name: tls-certs
+          mountPath: /opt/stalwart/certs
+          readOnly: true
       volumes:
       - name: stalwart-volume
         persistentVolumeClaim:
@@ -73,3 +76,6 @@ spec:
       - name: config
         configMap:
           name: {{ include "stalwart.fullname" . }}-config
+      - name: tls-certs
+        secret:
+          secretName: {{ .Values.tls.secretName }}
diff --git a/stalwart/values.yaml b/stalwart/values.yaml
index eb0ac51..ab6f6c9 100644
--- a/stalwart/values.yaml
+++ b/stalwart/values.yaml
@@ -24,6 +24,9 @@ persistence:
 
 replicaCount: 1
 
+tls:
+  secretName: letsencrypt-prod
+
 config:
   hostname: "mail.hensen.io"
   # Whitelist cluster IPs to prevent ingress from being banned