diff --git a/apps/dashboard/src/app/(dashboard)/layout.tsx b/apps/dashboard/src/app/(dashboard)/layout.tsx
index 94e2a92..633f33a 100644
--- a/apps/dashboard/src/app/(dashboard)/layout.tsx
+++ b/apps/dashboard/src/app/(dashboard)/layout.tsx
@@ -4,18 +4,20 @@ import TopBar from '@/components/layout/TopBar'
 
 export default function DashboardLayout({ children }: { children: React.ReactNode }) {
   return (
-    <div className="fleet-dashboard-shell flex min-h-screen transition-colors print:block print:min-h-0 print:bg-white">
-      <div className="print:hidden">
-        <Sidebar />
-      </div>
-      <div className="ms-0 flex min-h-screen min-w-0 flex-1 flex-col lg:ms-64 print:ms-0 print:min-h-0 print:block">
+    <DashboardAccessGuard>
+      <div className="fleet-dashboard-shell flex min-h-screen transition-colors print:block print:min-h-0 print:bg-white">
         <div className="print:hidden">
-          <TopBar />
+          <Sidebar />
+        </div>
+        <div className="ms-0 flex min-h-screen min-w-0 flex-1 flex-col lg:ms-64 print:ms-0 print:min-h-0 print:block">
+          <div className="print:hidden">
+            <TopBar />
+          </div>
+          <main className="flex-1 overflow-y-auto p-6 print:p-0 print:overflow-visible">
+            {children}
+          </main>
         </div>
-        <main className="flex-1 overflow-y-auto p-6 print:p-0 print:overflow-visible">
-          <DashboardAccessGuard>{children}</DashboardAccessGuard>
-        </main>
       </div>
-    </div>
+    </DashboardAccessGuard>
   )
 }
diff --git a/production/dynamic/mail-certificate.yml b/production/dynamic/mail-certificate.yml
new file mode 100644
index 0000000..ab08614
--- /dev/null
+++ b/production/dynamic/mail-certificate.yml
@@ -0,0 +1,18 @@
+http:
+  routers:
+    mail-certificate:
+      rule: "Host(`mail.rentaldrivego.ma`)"
+      entryPoints:
+        - websecure
+      service: mail-certificate-placeholder
+      tls:
+        certResolver: letsencrypt
+        domains:
+          - main: "mail.rentaldrivego.ma"
+  services:
+    mail-certificate-placeholder:
+      loadBalancer:
+        servers:
+          # This router exists to request and renew the certificate.
+          # Mail protocols are not routed through this HTTP service.
+          - url: "http://127.0.0.1:65535"
diff --git a/production/traefik.yaml b/production/traefik.yaml
index e6fd4dc..2fa614f 100644
--- a/production/traefik.yaml
+++ b/production/traefik.yaml
@@ -1,6 +1,8 @@
 services:
   traefik:
-    image: traefik:latest
+    # Set TRAEFIK_VERSION in .env to the exact version you are running.
+    # Do not use "latest" in production.
+    image: traefik:${TRAEFIK_VERSION}
     command:
       - --api.dashboard=false
       - --api.insecure=false
@@ -29,6 +31,51 @@ services:
       - ./dynamic:/etc/traefik/dynamic:ro
     networks:
       - traefik-proxy
+
+  traefik-certs-dumper:
+    image: ldez/traefik-certs-dumper:v2.11.4
+    depends_on:
+      - traefik
+    restart: unless-stopped
+    # Wait for Traefik's ACME storage, then export certificates whenever
+    # acme.json changes.
+    entrypoint:
+      - /bin/sh
+      - -ec
+    command:
+      - |
+        until [ -s /data/acme.json ]; do
+          sleep 2
+        done
+
+        exec traefik-certs-dumper file \
+          --version v3 \
+          --watch \
+          --source /data/acme.json \
+          --dest /output \
+          --domain-subdir \
+          --crt-name fullchain \
+          --key-name privkey \
+          --crt-ext .pem \
+          --key-ext .pem
+    volumes:
+      # Existing Traefik ACME volume, mounted read-only.
+      - traefik-letsencrypt:/data:ro
+
+      # Normal certificate files will appear on the VPS here.
+      - ./exported-certs:/output
+    # The dumper only reads a local volume and writes exported files.
+    # It needs no network access.
+    network_mode: none
+    labels:
+      - "traefik.enable=false"
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    tmpfs:
+      - /tmp:size=16m,mode=1777
 networks:
   traefik-proxy:
     external: true