diff --git a/tasks/mail.yaml b/tasks/mail.yaml
index e5ed3a8..a3df119 100644
--- a/tasks/mail.yaml
+++ b/tasks/mail.yaml
@@ -142,7 +142,7 @@
           spec:
             containers:
               - name: mail
-                image: mailserver/docker-mailserver
+                image: mailserver/docker-mailserver:15.1.0  # pinned: v17 renamed LDAP env vars and breaks this config
                 securityContext:
                   # `allowPrivilegeEscalation: true` is required to support SGID via the `postdrop`
                   # executable in `/var/mail-state` for Postfix (maildrop + public dirs):
@@ -212,7 +212,8 @@
                   - name: LDAP_BIND_PW
                     value: "{{ openldap_readonly_password }}"
                   - name: LDAP_QUERY_FILTER_DOMAIN
-                    value: "(mail=*@%s)"
+                    # Only mailbox users define local domains; member accounts carry external addresses (e.g. @gmail.com).
+                    value: "(&(mail=*@%s)(memberOf=cn=Postfix Users,ou=Postfix,ou=Services,dc=eom,dc=dev))"
                   - name: LDAP_QUERY_FILTER_USER
                     value: "(&(mail=%s)(memberOf=cn=Postfix Users,ou=Postfix,ou=Services,dc=eom,dc=dev))"
                   - name: LDAP_QUERY_FILTER_ALIAS