diff --git a/setup/functions-downloads.sh b/setup/functions-downloads.sh
index 347b78f4..8fb504cb 100644
--- a/setup/functions-downloads.sh
+++ b/setup/functions-downloads.sh
@@ -318,3 +318,16 @@ get_nc_download_url() {
     DOWNLOAD_URL_CACHE_ID="$url_cache_id"
     return 0
 }
+
+
+
+install_composer() {
+    if [ ! -x /usr/local/bin/composer ]; then
+        pushd /usr/local/bin >/dev/null
+        curl -sS https://getcomposer.org/installer | hide_output php${PHP_VER}
+        mv composer.phar composer
+        popd >/dev/null
+    else
+        hide_output /usr/local/bin/composer selfupdate
+    fi
+}
diff --git a/setup/webmail.sh b/setup/webmail.sh
index 6609d0c9..a92f6417 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -3,6 +3,7 @@
 # ----------------------
 
 source setup/functions.sh # load our functions
+source setup/functions-downloads.sh
 source /etc/mailinabox.conf # load global vars
 source ${STORAGE_ROOT}/ldap/miab_ldap.conf
 
@@ -38,12 +39,13 @@ apt_install php${PHP_VER}-ldap
 #   https://github.com/mstilkerich/rcmcarddav/releases
 # The easiest way to get the package hashes is to run this script and get the hash from
 # the error message.
-VERSION=1.5.2
-HASH=208ce4ca0be423cc0f7070ff59bd03588b4439bf
+VERSION=1.6-rc
+HASH=c44c683a06117162f4fccf5bd5883d4ed3595e45
 PERSISTENT_LOGIN_VERSION=59ca1b0d3a02cff5fa621c1ad581d15f9d642fe8
 HTML5_NOTIFIER_VERSION=68d9ca194212e15b3c7225eb6085dbcf02fd13d7 # version 0.6.4+
-CARDDAV_VERSION=4.3.0
-CARDDAV_HASH=4ad7df8843951062878b1375f77c614f68bc5c61
+CARDDAV_VERSION=4.4.1
+CARDDAV_VERSION_AND_VARIANT=4.4.1-roundcube16
+CARDDAV_HASH=4992577d40c56ca1636ee92519b3c571eda21ae6
 
 UPDATE_KEY=$VERSION:$PERSISTENT_LOGIN_VERSION:$HTML5_NOTIFIER_VERSION:$CARDDAV_VERSION
 
@@ -86,7 +88,7 @@ if [ $needs_update == 1 ]; then
 
 	# download and verify the full release of the carddav plugin
 	wget_verify \
-		https://github.com/mstilkerich/rcmcarddav/releases/download/v${CARDDAV_VERSION}/carddav-v${CARDDAV_VERSION}.tar.gz \
+		https://github.com/mstilkerich/rcmcarddav/releases/download/v${CARDDAV_VERSION}/carddav-v${CARDDAV_VERSION_AND_VARIANT}.tar.gz \
 		$CARDDAV_HASH \
 		/tmp/carddav.tar.gz
 
@@ -94,6 +96,18 @@ if [ $needs_update == 1 ]; then
 	tar -C ${RCM_PLUGIN_DIR} -zxf /tmp/carddav.tar.gz
 	rm -f /tmp/carddav.tar.gz
 
+    # fix rcmcarddav dependencies
+    # 1. remove rcmcarddav/vendor/guzzlehttp and update autoload
+    if [ -d ${RCM_PLUGIN_DIR}/carddav/vendor/guzzlehttp ]; then
+        install_composer
+        pushd ${RCM_PLUGIN_DIR}/carddav >/dev/null
+        rm -rf vendor/.x_guzzlehttp
+        mv vendor/guzzlehttp vendor/.x_guzzlehttp
+        hide_output /usr/local/bin/composer dump-autoload -q -n --ignore-platform-req=php
+        popd >/dev/null
+    fi
+
+
 	# record the version we've installed
 	echo $UPDATE_KEY > ${RCM_DIR}/version
 fi