diff --git a/bundles/dovecot/files/dovecot-sql.conf b/bundles/dovecot/files/dovecot-sql.conf
deleted file mode 100644
index 8f26825..0000000
--- a/bundles/dovecot/files/dovecot-sql.conf
+++ /dev/null
@@ -1,17 +0,0 @@
-connect = host=${host} dbname=${name} user=${user} password=${password}
-driver = pgsql
-default_pass_scheme = ARGON2ID
-
-user_query = SELECT '/var/vmail/%u' AS home, 'vmail' AS uid, 'vmail' AS gid
-
-iterate_query = SELECT CONCAT(users.name, '@', domains.name) AS user \
-  FROM users \
-  LEFT JOIN domains ON users.domain_id = domains.id \
-  WHERE redirect IS NULL
-
-password_query = SELECT CONCAT(users.name, '@', domains.name) AS user, password \
-  FROM users \
-  LEFT JOIN domains ON users.domain_id = domains.id \
-  WHERE redirect IS NULL \
-  AND users.name = SPLIT_PART('%u', '@', 1) \
-  AND domains.name = SPLIT_PART('%u', '@', 2)
diff --git a/bundles/dovecot/files/dovecot.conf b/bundles/dovecot/files/dovecot.conf
index 2051535..95871f5 100644
--- a/bundles/dovecot/files/dovecot.conf
+++ b/bundles/dovecot/files/dovecot.conf
@@ -1,12 +1,17 @@
+dovecot_config_version = ${config_version}
+dovecot_storage_version = ${storage_version}
+
 protocols = imap lmtp sieve
 auth_mechanisms = plain login
 mail_privileged_group = mail
 ssl = required
-ssl_cert = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/fullchain.pem
-ssl_key = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/privkey.pem
-ssl_dh = </etc/dovecot/dhparam.pem
+ssl_server_cert_file = /var/lib/dehydrated/certs/${hostname}/fullchain.pem
+ssl_server_key_file = /var/lib/dehydrated/certs/${hostname}/privkey.pem
+ssl_server_dh_file = /etc/dovecot/dhparam.pem
 ssl_client_ca_dir = /etc/ssl/certs
-mail_location = maildir:${node.metadata.get('mailserver/maildir')}/%u:INDEX=${node.metadata.get('mailserver/maildir')}/index/%u
+mail_driver     = maildir
+mail_path       = ${maildir}/%{user}
+mail_index_path = ${maildir}/index/%{user}
 mail_plugins = fts fts_xapian
 
 namespace inbox {
@@ -30,14 +35,47 @@ namespace inbox {
   }
 }
 
-passdb {
-  driver = sql
-  args = /etc/dovecot/dovecot-sql.conf
+
+sql_driver = pgsql
+
+pgsql main {
+  parameters {
+    host     = ${db_host}
+    dbname   = ${db_name}
+    user     = ${db_user}
+    password = ${db_password}
+  }
 }
-# use sql for userdb too, to enable iterate_query
-userdb {
-  driver = sql
-  args = /etc/dovecot/dovecot-sql.conf
+
+# postgres passdb userdb
+
+passdb sql {
+  passdb_default_password_scheme = ARGON2ID
+
+  query = SELECT \
+            CONCAT(users.name, '@', domains.name) AS "user", \
+            password \
+          FROM users \
+          LEFT JOIN domains ON users.domain_id = domains.id \
+          WHERE redirect IS NULL \
+            AND users.name   = SPLIT_PART('%{user}', '@', 1) \
+            AND domains.name = SPLIT_PART('%{user}', '@', 2)
+}
+
+mail_uid = vmail
+mail_gid = vmail
+
+userdb sql {
+  query = SELECT \
+            '/var/vmail/%{user}' AS home, \
+            'vmail'              AS uid, \
+            'vmail'              AS gid
+
+  iterate_query = SELECT \
+                    CONCAT(users.name, '@', domains.name) AS username \
+                  FROM users \
+                  LEFT JOIN domains ON users.domain_id = domains.id \
+                  WHERE redirect IS NULL
 }
 
 service auth {
@@ -70,7 +108,8 @@ service managesieve-login {
   inet_listener sieve {
   }
   process_min_avail = 0
-  service_count = 1
+  process_min_avail = 1
+  process_limit = 1
   vsz_limit = 64 M
 }
 service managesieve {
@@ -86,21 +125,18 @@ protocol lmtp {
    mail_plugins = $mail_plugins sieve
 }
 protocol sieve {
-  plugin {
-    sieve = /var/vmail/sieve/%u.sieve
-    sieve_storage = /var/vmail/sieve/%u/
-  }
+  sieve = /var/vmail/sieve/%u.sieve
+  sieve_storage = /var/vmail/sieve/%u/
 }
 
 # fulltext search
-plugin {
-    fts = xapian
-    fts_xapian = partial=3 full=20 verbose=0
-    fts_autoindex = yes
-    fts_enforced = yes
-    # Index attachements
-    fts_decoder = decode2text
-}
+fts = xapian
+fts_xapian = partial=3 full=20 verbose=0
+fts_autoindex = yes
+fts_enforced = yes
+# Index attachements
+fts_decoder = decode2text
+
 service indexer-worker {
     vsz_limit = ${indexer_ram}
 }
@@ -113,23 +149,21 @@ service decode2text {
 }
 
 # spam filter
-plugin {
-  sieve_plugins = sieve_imapsieve sieve_extprograms
-  sieve_dir = /var/vmail/sieve/%u/
-  sieve = /var/vmail/sieve/%u.sieve
-  sieve_pipe_bin_dir = /var/vmail/sieve/bin
-  sieve_extensions = +vnd.dovecot.pipe
+sieve_plugins = sieve_imapsieve sieve_extprograms
+sieve_dir = /var/vmail/sieve/%u/
+sieve = /var/vmail/sieve/%u.sieve
+sieve_pipe_bin_dir = /var/vmail/sieve/bin
+sieve_extensions = +vnd.dovecot.pipe
 
-  sieve_after = /var/vmail/sieve/global/spam-to-folder.sieve
+sieve_after = /var/vmail/sieve/global/spam-to-folder.sieve
 
-  # From elsewhere to Spam folder
-  imapsieve_mailbox1_name = Junk
-  imapsieve_mailbox1_causes = COPY
-  imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve
+# From elsewhere to Spam folder
+imapsieve_mailbox1_name = Junk
+imapsieve_mailbox1_causes = COPY
+imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve
 
-  # From Spam folder to elsewhere
-  imapsieve_mailbox2_name = *
-  imapsieve_mailbox2_from = Junk
-  imapsieve_mailbox2_causes = COPY
-  imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve
-}
+# From Spam folder to elsewhere
+imapsieve_mailbox2_name = *
+imapsieve_mailbox2_from = Junk
+imapsieve_mailbox2_causes = COPY
+imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve
diff --git a/bundles/dovecot/items.py b/bundles/dovecot/items.py
index de1791f..7ea127c 100644
--- a/bundles/dovecot/items.py
+++ b/bundles/dovecot/items.py
@@ -44,6 +44,14 @@ files = {
         'context': {
             'admin_email': node.metadata.get('mailserver/admin_email'),
             'indexer_ram': node.metadata.get('dovecot/indexer_ram'),
+            'config_version': node.metadata.get('dovecot/config_version'),
+            'storage_version': node.metadata.get('dovecot/storage_version'),
+            'maildir': node.metadata.get('mailserver/maildir'),
+            'hostname': node.metadata.get('mailserver/hostname'),
+            'db_host': node.metadata.get('mailserver/database/host'),
+            'db_name': node.metadata.get('mailserver/database/name'),
+            'db_user': node.metadata.get('mailserver/database/user'),
+            'db_password': node.metadata.get('mailserver/database/password'),
         },
         'needs': {
             'pkg_apt:'
@@ -52,29 +60,9 @@ files = {
             'svc_systemd:dovecot:restart',
         },
     },
-    '/etc/dovecot/dovecot-sql.conf': {
-        'content_type': 'mako',
-        'context': node.metadata.get('mailserver/database'),
-        'needs': {
-            'pkg_apt:'
-        },
-        'triggers': {
-            'svc_systemd:dovecot:restart',
-        },
-    },
     '/etc/dovecot/dhparam.pem': {
         'content_type': 'any',
     },
-    '/etc/dovecot/dovecot-sql.conf': {
-        'content_type': 'mako',
-        'context': node.metadata.get('mailserver/database'),
-        'needs': {
-            'pkg_apt:'
-        },
-        'triggers': {
-            'svc_systemd:dovecot:restart',
-        },
-    },
     '/var/vmail/sieve/global/spam-to-folder.sieve': {
         'owner': 'vmail',
         'group': 'vmail',
@@ -131,7 +119,6 @@ svc_systemd = {
             'action:letsencrypt_update_certificates',
             'action:dovecot_generate_dhparam',
             'file:/etc/dovecot/dovecot.conf',
-            'file:/etc/dovecot/dovecot-sql.conf',
         },
     },
 }
diff --git a/bundles/redis/items.py b/bundles/redis/items.py
index 12b8a6e..3192d5e 100644
--- a/bundles/redis/items.py
+++ b/bundles/redis/items.py
@@ -9,6 +9,7 @@ directories = {
     },
     '/var/lib/redis': {
         'owner': 'redis',
+        'group': 'redis',
         'mode': '0750',
         'needs': [
             'pkg_apt:redis-server',
diff --git a/nodes/htz.mails.py b/nodes/htz.mails.py
index a00a874..f65354d 100644
--- a/nodes/htz.mails.py
+++ b/nodes/htz.mails.py
@@ -2,7 +2,7 @@
     'hostname': '49.12.184.229',
     'groups': [
         'backup',
-        'debian-12',
+        'debian-13',
         'hetzner-cloud',
         'mailserver',
         'monitored',
@@ -108,6 +108,10 @@
                 'elimu-kwanza.de',
             },
         },
+        'dovecot': {
+            'config_version': '2.4.1',
+            'storage_version': '2.4.1',
+        },
         'rspamd': {
             'hostname': 'rspamd.sublimity.de',
         },