diff --git a/deploy/all-in-one/entrypoint.sh b/deploy/all-in-one/entrypoint.sh
index 569f9d6..8b73053 100644
--- a/deploy/all-in-one/entrypoint.sh
+++ b/deploy/all-in-one/entrypoint.sh
@@ -23,6 +23,14 @@ elif id rspamd >/dev/null 2>&1; then
   chown -R rspamd:rspamd /run/rspamd /var/lib/rspamd 2>/dev/null || true
 fi
 
+AUTH_POLICY_NONCE_FILE="${LANQIN_AUTH_POLICY_NONCE_FILE:-/data/dovecot-auth-policy-nonce}"
+mkdir -p "$(dirname "$AUTH_POLICY_NONCE_FILE")"
+if [ ! -s "$AUTH_POLICY_NONCE_FILE" ]; then
+  od -An -tx1 -N32 /dev/urandom | tr -d ' \n' > "$AUTH_POLICY_NONCE_FILE"
+fi
+chmod 600 "$AUTH_POLICY_NONCE_FILE" 2>/dev/null || true
+AUTH_POLICY_HASH_NONCE="$(cat "$AUTH_POLICY_NONCE_FILE")"
+
 TLS_CERT=/etc/ssl/certs/ssl-cert-snakeoil.pem
 TLS_KEY=/etc/ssl/private/ssl-cert-snakeoil.key
 if [ -n "$LANQIN_TLS_CERT_FILE" ] || [ -n "$LANQIN_TLS_KEY_FILE" ]; then
@@ -45,6 +53,7 @@ postconf -e "smtpd_milters = inet:127.0.0.1:11332"
 postconf -e "non_smtpd_milters = inet:127.0.0.1:11332"
 sed -i "s#^ssl_cert = <.*#ssl_cert = <${TLS_CERT}#" /etc/dovecot/dovecot.conf
 sed -i "s#^ssl_key = <.*#ssl_key = <${TLS_KEY}#" /etc/dovecot/dovecot.conf
+sed -i "s#^auth_policy_hash_nonce = .*#auth_policy_hash_nonce = ${AUTH_POLICY_HASH_NONCE}#" /etc/dovecot/dovecot.conf
 
 # Rspamd DKIM keys are exported after API seed/migrations create the SQLite DB.
 /usr/local/bin/lanqin-api >/tmp/lanqin-api-bootstrap.log 2>&1 &
diff --git a/deploy/dovecot/dovecot.conf b/deploy/dovecot/dovecot.conf
index b2600a8..3dc4345 100644
--- a/deploy/dovecot/dovecot.conf
+++ b/deploy/dovecot/dovecot.conf
@@ -23,7 +23,8 @@ auth_policy_server_url = http://127.0.0.1:8080/auth-policy
 auth_policy_server_api_header = Content-Type: application/json
 auth_policy_hash_mech = sha256
 auth_policy_hash_truncate = 12
-auth_policy_request_fields = protocol=imap username=user
+auth_policy_hash_nonce = __LANQIN_AUTH_POLICY_HASH_NONCE__
+auth_policy_request_attributes = protocol=imap username=user
 
 namespace inbox {
   inbox = yes
diff --git a/deploy/dovecot/entrypoint.sh b/deploy/dovecot/entrypoint.sh
index dbe2ae4..22d9f5d 100644
--- a/deploy/dovecot/entrypoint.sh
+++ b/deploy/dovecot/entrypoint.sh
@@ -4,8 +4,15 @@ set -eu
 : "${LANQIN_TLS_KEY_FILE:=}"
 addgroup --system --gid 5000 vmail 2>/dev/null || true
 adduser --system --uid 5000 --gid 5000 --home /var/mail/vhosts --no-create-home vmail 2>/dev/null || true
-mkdir -p /var/mail/vhosts
+mkdir -p /data /var/mail/vhosts
 chown -R 5000:5000 /var/mail/vhosts
+AUTH_POLICY_NONCE_FILE="${LANQIN_AUTH_POLICY_NONCE_FILE:-/data/dovecot-auth-policy-nonce}"
+mkdir -p "$(dirname "$AUTH_POLICY_NONCE_FILE")"
+if [ ! -s "$AUTH_POLICY_NONCE_FILE" ]; then
+  od -An -tx1 -N32 /dev/urandom | tr -d ' \n' > "$AUTH_POLICY_NONCE_FILE"
+fi
+chmod 600 "$AUTH_POLICY_NONCE_FILE" 2>/dev/null || true
+AUTH_POLICY_HASH_NONCE="$(cat "$AUTH_POLICY_NONCE_FILE")"
 TLS_CERT=/etc/ssl/certs/ssl-cert-snakeoil.pem
 TLS_KEY=/etc/ssl/private/ssl-cert-snakeoil.key
 if [ -n "$LANQIN_TLS_CERT_FILE" ] || [ -n "$LANQIN_TLS_KEY_FILE" ]; then
@@ -18,4 +25,5 @@ if [ -n "$LANQIN_TLS_CERT_FILE" ] || [ -n "$LANQIN_TLS_KEY_FILE" ]; then
 fi
 sed -i "s#^ssl_cert = <.*#ssl_cert = <${TLS_CERT}#" /etc/dovecot/dovecot.conf
 sed -i "s#^ssl_key = <.*#ssl_key = <${TLS_KEY}#" /etc/dovecot/dovecot.conf
+sed -i "s#^auth_policy_hash_nonce = .*#auth_policy_hash_nonce = ${AUTH_POLICY_HASH_NONCE}#" /etc/dovecot/dovecot.conf
 exec dovecot -F