diff --git a/cluster/prod/app/email/deploy/email.hcl b/cluster/prod/app/email/deploy/email.hcl
index 7eea2ea..287cff3 100644
--- a/cluster/prod/app/email/deploy/email.hcl
+++ b/cluster/prod/app/email/deploy/email.hcl
@@ -383,15 +383,24 @@ job "email" {
       }
 
       template {
+        # Collect machine IPs from the cluster.
+        # We use intermediate maps to ensure we get a sorted list with no duplicates,
+        # so that it is robust wrt. changes in the order of the output of ls or
+        # addition of new machines in an existing site.
+        # (scratch.MapValues returns the list of *values* in the map, sorted by *key*)
         data = <<EOH
         {{- range ls "diplonat/autodiscovery/ipv4" }}
-          {{- with $a := .Value | parseJSON }} {{ $a.address }}
+          {{- with $a := .Value | parseJSON }}
+            {{- scratch.MapSet "ipv4" $a.address $a.address }}
           {{- end }}
-        {{- end }}
+        {{- end -}}
         {{- range ls "diplonat/autodiscovery/ipv6" }}
-          {{- with $a := .Value | parseJSON }} [{{ $a.address }}]
+          {{- with $a := .Value | parseJSON }}
+            {{- scratch.MapSet "ipv6" $a.address $a.address }}
           {{- end }}
-        {{- end }}
+        {{- end -}}
+        {{- range scratch.MapValues "ipv4" }}{{ . }} {{ end }}
+        {{- range scratch.MapValues "ipv6" }}[{{ . }}] {{ end }}
         EOH
         destination = "secrets/postfix/rate-limit-exceptions"
       }