diff --git a/k8s/argocd/secrets/secret-generator.yaml b/k8s/argocd/secrets/secret-generator.yaml
index 7313d38..77211d2 100644
--- a/k8s/argocd/secrets/secret-generator.yaml
+++ b/k8s/argocd/secrets/secret-generator.yaml
@@ -35,6 +35,7 @@ files:
     - pi-sandbox-secrets.enc.yaml
     - etcd-defrag-creds.enc.yaml
     - zitadel-masterkey.enc.yaml
+    - smtp-gotify-secrets.enc.yaml
     # Login UI RSA keypair, adopted from the chart-generated Secret so ArgoCD
     # owns it. Without this, the chart re-generates the keypair on every render,
     # which changes checksum/secret-login-service-key and leaves both Zitadel
diff --git a/k8s/infra/iam/smtp-gotify.yaml b/k8s/infra/iam/smtp-gotify.yaml
index 38a2949..6918f34 100644
--- a/k8s/infra/iam/smtp-gotify.yaml
+++ b/k8s/infra/iam/smtp-gotify.yaml
@@ -42,7 +42,7 @@ spec:
           imagePullPolicy: IfNotPresent
           env:
             - name: GOTIFY_URL
-              value: "http://gotify.notifications.svc.cluster.local"
+              value: "http://gotify.notifications.svc.cluster.local/"
             - name: GOTIFY_TOKEN
               valueFrom:
                 secretKeyRef:
@@ -50,10 +50,10 @@ spec:
                   key: token
             - name: GOTIFY_PRIORITY
               value: "5"
-            # ZITADEL sends "ZITADEL - Verify email" style subjects; keep them
-            # so the phone notification says what it is.
-            - name: GOTIFY_TITLE_TEMPLATE
-              value: "{{.Subject}}"
+            # No title template: the relay's default title already carries
+            # the mail subject, and a wrong template field fails the push
+            # silently (the SMTP side still answers 250, so the sender thinks
+            # the message was delivered).
           ports:
             - name: smtp
               containerPort: 2525