diff --git a/rallly/Chart.yaml b/rallly/Chart.yaml
index 2aba2b7..15d8873 100644
--- a/rallly/Chart.yaml
+++ b/rallly/Chart.yaml
@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/lukevella/rallly/main/apps/landing/publi
 
 type: application
 
-version: 6.0.0+up4.12.3
+version: 7.0.0+up4.12.3
 appVersion: "4.12.3"
 
 maintainers:
diff --git a/rallly/templates/rallly.deployment.yaml b/rallly/templates/rallly.deployment.yaml
index ac4dfdf..d4bec3a 100644
--- a/rallly/templates/rallly.deployment.yaml
+++ b/rallly/templates/rallly.deployment.yaml
@@ -73,7 +73,12 @@ spec:
                   name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret
                   key: password
             - name: SMTP_REJECT_UNAUTHORIZED
-              value: "{{ .Values.rallly.smtp.rejectUnauthorized }}"
+              {{- /* Not "| default true": an explicit false is a zero value, and
+                     "default" would swallow it and silently re-enable the check
+                     the operator just switched off. A nil (erased key) falls back
+                     to the chart default true, so the variable can never reach
+                     the app as an empty string (issues #109, #99). */}}
+              value: "{{ if kindIs "invalid" .Values.rallly.smtp.rejectUnauthorized }}true{{ else }}{{ .Values.rallly.smtp.rejectUnauthorized }}{{ end }}"
             - name: SMTP_TLS_SERVERNAME
               valueFrom:
                 secretKeyRef:
diff --git a/rallly/values.schema.json b/rallly/values.schema.json
index 888a1e7..ed27e0e 100644
--- a/rallly/values.schema.json
+++ b/rallly/values.schema.json
@@ -46,8 +46,8 @@
               "type": "boolean"
             },
             "rejectUnauthorized": {
-              "description": "Passed to the app as SMTP_REJECT_UNAUTHORIZED. Read by the chart but deliberately without a default in values.yaml - see the note in the PR that introduced this schema.",
-              "type": ["boolean", "string", "null"]
+              "description": "Verify the mail server's TLS certificate; passed to the app as SMTP_REJECT_UNAUTHORIZED. Defaults to true (issue #109). Set false only for a mail server with a self-signed certificate. Strings are rejected: the env var is rendered from this value, and a string like \"yes\" would reach the app as a value it does not read as a boolean. Null means the chart default (true), as elsewhere in this chart (issue #99).",
+              "type": ["boolean", "null"]
             }
           }
         },
diff --git a/rallly/values.yaml b/rallly/values.yaml
index 7786c95..afb1ced 100644
--- a/rallly/values.yaml
+++ b/rallly/values.yaml
@@ -16,6 +16,17 @@ rallly:
   replicas: 1
   smtp:
     enabled: false
+    # Verify the mail server's TLS certificate (passed to the app as
+    # SMTP_REJECT_UNAUTHORIZED). Leave this at true.
+    #
+    # Set it to false ONLY for a mail server with a self-signed certificate.
+    # Without that hint the symptom is misleading: the send fails with a
+    # certificate error naming the mail server, so the search starts at the
+    # mail server or its CA chain rather than at this value.
+    #
+    # false disables the certificate check entirely and exposes the SMTP
+    # session to a man-in-the-middle; prefer trusting the CA over setting it.
+    rejectUnauthorized: true
   allowedEmails: '*'
   supportEmail: null
   oidc: