diff --git a/conf/nginx-primaryonly.conf b/conf/nginx-primaryonly.conf
index 7c9bb7b7..31e50d5b 100644
--- a/conf/nginx-primaryonly.conf
+++ b/conf/nginx-primaryonly.conf
@@ -16,6 +16,30 @@
 		add_header Content-Security-Policy "frame-ancestors 'none';";
 	}
 
+	# Roundcube Webmail configuration.
+	rewrite ^/mail$ /mail/ redirect;
+	rewrite ^/mail/$ /mail/index.php;
+	location /mail/ {
+		index index.php;
+		alias /usr/local/lib/roundcubemail/;
+	}
+	location ~ /mail/config/.* {
+		# A ~-style location is needed to give this precedence over the next block.
+		return 403;
+	}
+	location ~ /mail/.*\.php {
+		# note: ~ has precendence over a regular location block
+		include fastcgi_params;
+		fastcgi_split_path_info ^/mail(/.*)()$;
+		fastcgi_index index.php;
+		fastcgi_param SCRIPT_FILENAME /usr/local/lib/roundcubemail/$fastcgi_script_name;
+		fastcgi_pass php-fpm;
+
+		# Outgoing mail also goes through this endpoint, so increase the maximum
+		# file upload limit to match the corresponding Postfix limit.
+		client_max_body_size 128M;
+	}
+
 	# Nextcloud configuration.
 	rewrite ^/cloud$ /cloud/ redirect;
 	rewrite ^/cloud/$ /cloud/index.php;