diff --git a/setup/webmail.sh b/setup/webmail.sh
index e064a201..131f7aa5 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -141,6 +141,10 @@ cat > $RCM_CONFIG <<EOF;
 \$config['login_username_filter'] = 'email';
 \$config['password_charset'] = 'UTF-8';
 \$config['junk_mbox'] = 'Spam';
+/* ensure roudcube session id's aren't leaked to other parts of the server */
+\$config['session_path'] = '/mail/';
+/* prevent CSRF, requires php 7.3+ */
+\$config['session_samesite'] = 'Strict';
 ?>
 EOF