diff --git a/.env.example b/.env.example
index e96774e..1e93f9e 100644
--- a/.env.example
+++ b/.env.example
@@ -26,6 +26,17 @@ BILLING_API_KEY_WOO=
 IDENTITY_API_URL=https://ladill.com/api
 IDENTITY_API_KEY_WOO=
 
+# SMTP — production deploy copies transport vars from /var/www/ladill.com/shared/.env
+MAIL_MAILER=log
+MAIL_SCHEME=null
+MAIL_ENCRYPTION=null
+MAIL_HOST=127.0.0.1
+MAIL_PORT=2525
+MAIL_USERNAME=null
+MAIL_PASSWORD=null
+MAIL_FROM_ADDRESS="noreply@ladill.com"
+MAIL_FROM_NAME="${APP_NAME}"
+
 WOO_MANAGER_PLUGIN_CLIENT_ID=
 WOO_MANAGER_PLUGIN_CLIENT_SECRET=
 
diff --git a/DEPLOY.md b/DEPLOY.md
index 9d7d896..d675d93 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -50,6 +50,13 @@ LADILL_WOO_MANAGER_APP_URL=https://woo.ladill.com
 
 Add `woo` to `config/pdns.php` service subdomains via `php artisan ladill:onboard-app woo --run-dns`.
 
+## 4b. SMTP (monolith)
+
+Production deploy syncs `MAIL_MAILER`, `MAIL_HOST`, `MAIL_PORT`, `MAIL_USERNAME`,
+`MAIL_PASSWORD`, and related transport vars from `/var/www/ladill.com/shared/.env`
+into this app's shared `.env` on each release. Set `MAIL_FROM_NAME` locally if you
+want a Woo-specific sender name; `config/mail.php` defaults to `APP_NAME`.
+
 ## 5. nginx + TLS
 
 ```bash
diff --git a/config/mail.php b/config/mail.php
index e32e88d..4df3820 100644
--- a/config/mail.php
+++ b/config/mail.php
@@ -1,5 +1,19 @@
 <?php
 
+// Normalise MAIL_SCHEME / MAIL_ENCRYPTION into a valid Symfony mailer scheme
+// (only "smtp"/"smtps" are valid). Mirrors the monolith so the same env works:
+// legacy MAIL_ENCRYPTION=tls or a stray MAIL_SCHEME=tls → null (STARTTLS on 587).
+$mailScheme = strtolower(trim((string) env('MAIL_SCHEME', '')));
+$mailEncryption = strtolower(trim((string) env('MAIL_ENCRYPTION', '')));
+
+$smtpScheme = match (true) {
+    in_array($mailScheme, ['smtp', 'smtps'], true) => $mailScheme,
+    $mailScheme !== '' => null,
+    in_array($mailEncryption, ['ssl', 'smtps'], true) => 'smtps',
+    in_array($mailEncryption, ['tls', 'starttls', 'smtp'], true) => 'smtp',
+    default => null,
+};
+
 return [
 
     /*
@@ -39,7 +53,7 @@ return [
 
         'smtp' => [
             'transport' => 'smtp',
-            'scheme' => env('MAIL_SCHEME'),
+            'scheme' => $smtpScheme,
             'url' => env('MAIL_URL'),
             'host' => env('MAIL_HOST', '127.0.0.1'),
             'port' => env('MAIL_PORT', 2525),
diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index 0e4d401..f85489d 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -34,6 +34,35 @@ bootstrap_shared_env() {
   return 1
 }
 
+sync_smtp_env_from_platform() {
+  local platform_env="${LADILL_PLATFORM_ENV:-/var/www/ladill.com/shared/.env}"
+  local target="$SHARED_DIR/.env"
+  local key_pattern='^(MAIL_MAILER|MAIL_SCHEME|MAIL_ENCRYPTION|MAIL_HOST|MAIL_PORT|MAIL_USERNAME|MAIL_PASSWORD|MAIL_URL|MAIL_EHLO_DOMAIN|MAIL_FROM_ADDRESS)='
+
+  if [ ! -f "$platform_env" ] || [ ! -f "$target" ]; then
+    log "Skipping SMTP env sync (platform or app .env missing)"
+    return 0
+  fi
+
+  local tmp merged
+  tmp="$(mktemp)"
+  merged="$(mktemp)"
+
+  grep -v -E "$key_pattern" "$target" > "$tmp" || true
+  grep -E "$key_pattern" "$platform_env" > "$merged" || true
+
+  if [ ! -s "$merged" ]; then
+    rm -f "$tmp" "$merged"
+    log "No MAIL_* transport vars in $platform_env — skipping SMTP sync"
+    return 0
+  fi
+
+  cat "$tmp" "$merged" > "${target}.new"
+  mv "${target}.new" "$target"
+  rm -f "$tmp" "$merged"
+  log "Synced SMTP settings from $platform_env"
+}
+
 ensure_writable_paths() {
   local paths=("$@")
 
@@ -143,6 +172,7 @@ mkdir -p "$SHARED_DIR/bootstrap-cache"
 normalize_shared_permissions
 
 if bootstrap_shared_env; then
+  sync_smtp_env_from_platform
   ln -sfn "$SHARED_DIR/.env" "$NEW_RELEASE/.env"
 else
   echo "Missing deployment environment file. Expected $SHARED_DIR/.env or an existing $CURRENT_LINK/.env / $APP_ROOT/.env to bootstrap from." >&2