diff --git a/apps/hub/package.json b/apps/hub/package.json
index ee9656570..7e30e827f 100644
--- a/apps/hub/package.json
+++ b/apps/hub/package.json
@@ -21,7 +21,7 @@
     "@corbits/mailbox": "github:corbitsdev/corbits-mailbox#65590a85fa143251b3ac20ba2eca92fc35e70e51",
     "@corbits/memory": "github:corbitsdev/corbits-memory#e74da20f148a302dff5400915fe504ee2395e913",
     "@corbits/url-path": "workspace:*",
-    "@corbits/webhooks": "github:corbitsdev/webhooks#5c9e7d8fad13ebfbc747d01981ed4b0b44b810cd",
+    "@corbits/webhooks": "github:corbitsdev/webhooks#936cae080deb6a4259927900471dbb584d73eb73",
     "@corbits/workflows": "workspace:*",
     "@corbits/xai-provider": "github:corbitsdev/corbits-xai-provider#9f2d4bac40ea075df092fef807404a13c638cf14",
     "@intx/authz": "0.3.0",
diff --git a/apps/hub/src/server.ts b/apps/hub/src/server.ts
index 4e68962dd..0e5a45382 100644
--- a/apps/hub/src/server.ts
+++ b/apps/hub/src/server.ts
@@ -64,7 +64,12 @@ import {
 } from "./mailbox-persist";
 import { captureMailboxRequest, createMailboxDeliver } from "./mailbox-send";
 import { reportError } from "@corbits/error-sink";
-import { createRunTriggerDeliverer, installWebhooks, type HookMailRouter } from "@corbits/webhooks";
+import {
+  createRunTriggerDeliverer,
+  createTenantSystemSender,
+  installWebhooks,
+  type HookMailRouter,
+} from "@corbits/webhooks";
 import {
   createProcessSidecarProvisioner,
   readProcessProvisionerConfig,
@@ -601,6 +606,9 @@ export async function createHubServer({
             return tenantRow.domain;
           },
           senderLocalPart: "cron",
+          // A durable per-tenant key the recipient can verify against;
+          // the sidecar rejects trigger mail from an unknown sender.
+          systemSender: createTenantSystemSender({ db, principalKeyStore }),
         }),
       ),
       onDeliveryError: (error, schedule) => {
diff --git a/bun.lock b/bun.lock
index a24cb6462..b78b49410 100644
--- a/bun.lock
+++ b/bun.lock
@@ -62,7 +62,7 @@
         "@corbits/mailbox": "github:corbitsdev/corbits-mailbox#65590a85fa143251b3ac20ba2eca92fc35e70e51",
         "@corbits/memory": "github:corbitsdev/corbits-memory#e74da20f148a302dff5400915fe504ee2395e913",
         "@corbits/url-path": "workspace:*",
-        "@corbits/webhooks": "github:corbitsdev/webhooks#5c9e7d8fad13ebfbc747d01981ed4b0b44b810cd",
+        "@corbits/webhooks": "github:corbitsdev/webhooks#936cae080deb6a4259927900471dbb584d73eb73",
         "@corbits/workflows": "workspace:*",
         "@corbits/xai-provider": "github:corbitsdev/corbits-xai-provider#9f2d4bac40ea075df092fef807404a13c638cf14",
         "@intx/authz": "0.3.0",
@@ -645,7 +645,7 @@
 
     "@corbits/url-path": ["@corbits/url-path@workspace:packages/url-path"],
 
-    "@corbits/webhooks": ["@corbits/webhooks@github:corbitsdev/webhooks#5c9e7d8", { "dependencies": { "@intx/crypto": "^0.3.0", "@intx/db": "^0.3.0", "@intx/hub-api": "^0.3.0", "@intx/mime": "^0.3.0", "@intx/types": "^0.3.0", "hono": "4.11.9" } }, "corbitsdev-webhooks-5c9e7d8", "sha512-Zk3f6nhXwJ8NWrmMLd12+ypDJyAXfuR9/c14UT+n49MC3BTVavzzppcZK6TPQ5XnLtypfYDmOoHTWC+EwgNjDA=="],
+    "@corbits/webhooks": ["@corbits/webhooks@github:corbitsdev/webhooks#936cae0", { "dependencies": { "@intx/crypto": "^0.3.0", "@intx/db": "^0.3.0", "@intx/hub-api": "^0.3.0", "@intx/hub-common": "^0.3.0", "@intx/mime": "^0.3.0", "@intx/types": "^0.3.0", "hono": "4.11.9" } }, "corbitsdev-webhooks-936cae0", "sha512-2lZfaWSgQJaEChH6p8Dq+CqXU+vlt3IdZ3XR5WigYUha8/sgt3XMfAsNw8czCWjkvWZJs06YCgIAVCA/VYwftQ=="],
 
     "@corbits/workflows": ["@corbits/workflows@workspace:packages/workflows"],