diff --git a/wildduck/webmail.yaml b/wildduck/webmail.yaml
index a7dd8eb..ae306bb 100644
--- a/wildduck/webmail.yaml
+++ b/wildduck/webmail.yaml
@@ -6,9 +6,10 @@ metadata:
 spec:
   displayName: Wildduck Webmail
   uri: 'https://webmail.k-space.ee'
-  allowedGroups:
+  allowedGroups: # duplicated by wildduck-operator StatefulSet
     - k-space:floor
     - k-space:friends
+    - k-space:mailservice # wildduck-only, for info@k-space.ee et. al.
   headerMapping:
     user: Remote-Username
 ---
diff --git a/wildduck/wildduck-operator.yaml b/wildduck/wildduck-operator.yaml
index c98ae58..d0b5c15 100644
--- a/wildduck/wildduck-operator.yaml
+++ b/wildduck/wildduck-operator.yaml
@@ -21,8 +21,8 @@ spec:
           env:
             - name: MANAGED_DOMAIN
               value: k-space.ee
-            - name: ALLOWED_GROUPS
-              value: k-space:friends,k-space:floor
+            - name: ALLOWED_GROUPS # also duplicated by OIDCMiddlewareClient
+              value: k-space:friends,k-space:floor,k-space:mailservice
             - name: WILDDUCK_API_URL
               value: http://wildduck-api:8080
             - name: WILDDUCK_API_TOKEN