diff --git a/CHANGELOG.md b/CHANGELOG.md
index 44aba949d..392da3636 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,28 @@
 # Changelog - Veza
 
+## [v1.0.5.1] - 2026-04-16
+
+### Hotfix — dev SMTP ergonomics
+
+Follow-up to the v1.0.5 smoke test: a fresh clone + `cp .env.template .env`
++ `make dev-full` produced a backend with `SMTP_HOST=""`, which silently
+short-circuits `EmailService.sendEmail` to a log-only path. New
+contributors hit register → "where's my verification email?" and had no
+obvious cue that the SMTP hookup was missing.
+
+- `veza-backend-api/.env.template`: `SMTP_HOST` / `SMTP_PORT` now default
+  to the MailHog instance that ships with `make infra-up-dev`
+  (`localhost:1025`, UI on `:8025`). `FROM_EMAIL` / `FROM_NAME` seeded
+  with local-safe values. Comment rewritten to point at both the dev
+  path and the prod override.
+- Also exports the duplicate variable names (`SMTP_USERNAME`, `SMTP_FROM`,
+  `SMTP_FROM_NAME`) read by `internal/email/sender.go` — a TODO flagged
+  for v1.0.6 to reconcile the two email services onto a single env
+  schema. Until then both sets cover every code path.
+
+No code change, no migration, no version bump in the Go module. Pure
+config hotfix.
+
 ## [v1.0.5] - 2026-04-16
 
 ### Hardening sprint — seven critical-path fixes before public opening
diff --git a/VERSION b/VERSION
index 90a27f9ce..d9a082bd5 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.0.5
+1.0.5.1
diff --git a/veza-backend-api/.env.template b/veza-backend-api/.env.template
index 659077d2b..58e3765f0 100644
--- a/veza-backend-api/.env.template
+++ b/veza-backend-api/.env.template
@@ -113,13 +113,25 @@ FRONTEND_URL=http://veza.fr:5173
 # Public base URL of this backend (used for OAuth callbacks, etc.)
 BASE_URL=http://veza.fr:8080
 
-# --- EMAIL (OPTIONAL) ---
-# Required if email verification / password reset enabled
-SMTP_HOST=
-SMTP_PORT=587
+# --- EMAIL (REQUIRED for registration + password reset) ---
+# Local dev: MailHog ships with `make infra-up-dev` — the defaults below
+# point at it on localhost:1025, with the web UI at http://localhost:8025
+# to inspect captured emails.
+# Production: override with your SMTP provider (SendGrid, AWS SES, etc.).
+#
+# TODO(v1.0.6): internal/services/email_service.go and internal/email/sender.go
+# read different variable names for the same fields (`SMTP_USER` vs
+# `SMTP_USERNAME`, `FROM_EMAIL` vs `SMTP_FROM`, `FROM_NAME` vs `SMTP_FROM_NAME`).
+# Both sets are exported here until the two services are reconciled.
+SMTP_HOST=localhost
+SMTP_PORT=1025
+SMTP_USER=
 SMTP_USERNAME=
 SMTP_PASSWORD=
-SMTP_FROM=noreply@veza.com
+FROM_EMAIL=no-reply@veza.local
+FROM_NAME=Veza (dev)
+SMTP_FROM=no-reply@veza.local
+SMTP_FROM_NAME=Veza (dev)
 
 # --- MONITORING (OPTIONAL) ---
 PROMETHEUS_URL=