diff --git a/k8s/infra/iam/smtp-gotify.yaml b/k8s/infra/iam/smtp-gotify.yaml
index 6918f34..eeb174f 100644
--- a/k8s/infra/iam/smtp-gotify.yaml
+++ b/k8s/infra/iam/smtp-gotify.yaml
@@ -36,6 +36,9 @@ spec:
         runAsGroup: 65534
         seccompProfile:
           type: RuntimeDefault
+      volumes:
+        - name: tmp
+          emptyDir: {}
       containers:
         - name: smtp-gotify
           image: quay.io/reiml/smtp-gotify:latest
@@ -58,6 +61,12 @@ spec:
             - name: smtp
               containerPort: 2525
               protocol: TCP
+          volumeMounts:
+            # The relay stages each message in /tmp before the Gotify push.
+            # With readOnlyRootFilesystem it accepted SMTP (250 queued) and
+            # then silently dropped the message: no push, no error.
+            - name: tmp
+              mountPath: /tmp
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true