diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index e1d9134d..830031fc 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -26,6 +26,7 @@ podop = socketmap:unix:/tmp/podop.socket:
 postscreen_upstream_proxy_protocol = haproxy
 compatibility_level=3.6
 smtpd_forbid_bare_newline=yes
+smtpd_forbid_unauth_pipelining=no
 
 # Only accept virtual emails
 mydestination =
diff --git a/towncrier/newsfragments/3322.bugfix b/towncrier/newsfragments/3322.bugfix
new file mode 100644
index 00000000..db17941c
--- /dev/null
+++ b/towncrier/newsfragments/3322.bugfix
@@ -0,0 +1 @@
+Postfix 3.9 has changed the default for smtpd_forbid_unauth_pipelining. We need it to be allowed for XCLIENT to work.