diff --git a/.agents/docs/packages/libnest.md b/.agents/docs/packages/libnest.md
index 82cba18ca..341c6547c 100644
--- a/.agents/docs/packages/libnest.md
+++ b/.agents/docs/packages/libnest.md
@@ -22,7 +22,15 @@ Generic NestJS decorators, pipes, modules, and utilities used across DNP project
 | `./testing/plugin` | Vitest plugin (path aliases, env)         | `apps/api/vitest.config.ts`                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `./user-config`    | User-supplied app config typing           | `defineUserConfig` in `apps/api/libnest.config.ts`                                                                                                                                                                                                                                                                                                                                                                               |
 
-`MailModule`/`MailService` are available but not currently used here.
+**`MailModule`/`MailService` are deliberately not used.** `apps/api/src/mail/` builds its own
+nodemailer transporter instead, because libnest's `MailService` constructs `this.transporter` in
+its constructor from `MAIL_MODULE_OPTIONS_TOKEN` — so the SMTP options resolve once at boot. The
+configuration here is admin-editable and stored on `SetupState`, and `POST /v1/mail/test` has to
+send with settings that have not been saved yet; neither works with a transporter fixed at
+startup, and `forRootAsync` does not help because the limitation is the transporter's lifetime
+rather than where the options come from. libnest is expected to gain a lazily-derived transporter
+and a per-call transport override, at which point this app should consume it and drop the local
+copy.
 
 The root subpath is the only fully re-exporting barrel; its `index.ts` is ~38 lines and lists the entire public surface.
 
diff --git a/apps/api/package.json b/apps/api/package.json
index 6db82b501..ed90a00fe 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -53,6 +53,7 @@
     "mongodb": "^6.15.0",
     "msgpackr": "catalog:",
     "neverthrow": "catalog:",
+    "nodemailer": "catalog:",
     "passport": "^0.7.0",
     "passport-jwt": "^4.0.1",
     "reflect-metadata": "^0.1.14",
@@ -63,6 +64,7 @@
   "devDependencies": {
     "@nestjs/testing": "^11.0.11",
     "@types/express": "^5.0.0",
+    "@types/nodemailer": "catalog:",
     "@types/passport": "^1.0.17",
     "@types/passport-jwt": "^4.0.1",
     "mongodb-memory-server": "^10.3.0",
diff --git a/apps/api/prisma/schema.prisma b/apps/api/prisma/schema.prisma
index 2c409954e..86ba46969 100644
--- a/apps/api/prisma/schema.prisma
+++ b/apps/api/prisma/schema.prisma
@@ -32,6 +32,7 @@ enum AuditLogAction {
   UPDATE
   DELETE
   LOGIN
+  SEND_EMAIL
 }
 
 enum AuditLogEntity {
@@ -102,6 +103,21 @@ type GroupSettings {
   minimumAge                    Int?
 }
 
+// Mirrors $LocalizedString in @opendatacapture/schemas/core; each field is optional so
+// content can be authored in a single language without requiring all of them.
+type LocalizedString {
+  en String?
+  fr String?
+}
+
+// A group-manager-authored remote-assignment email template for a group's participants.
+type GroupEmailTemplate {
+  id      String
+  name    String
+  subject LocalizedString?
+  body    LocalizedString?
+}
+
 model Group {
   createdAt               DateTime               @default(now()) @db.Date
   updatedAt               DateTime               @updatedAt @db.Date
@@ -124,6 +140,9 @@ model Group {
   userIds                 String[]               @db.ObjectId
   users                   User[]                 @relation(fields: [userIds], references: [id])
 
+  emailTemplates                  GroupEmailTemplate[]
+  activeAssignmentEmailTemplateId String?
+
   @@map("GroupModel")
 }
 
@@ -381,6 +400,26 @@ type BrandingConfig {
   taglineFontSize          Int?
 }
 
+// The admin-configurable SMTP settings used to send outgoing email. The `password`
+// is stored here so the server can authenticate to the SMTP server; it is never
+// returned to clients (see the mail endpoints, which strip it).
+type MailConfig {
+  enabled       Boolean
+  encryption    String
+  host          String
+  password      String
+  port          Int
+  senderAddress String
+  senderName    String?
+  username      String
+}
+
+// An editable email template whose body may contain {{variable}} placeholders.
+type MailTemplate {
+  body    LocalizedString?
+  subject LocalizedString?
+}
+
 model SetupState {
   createdAt                     DateTime        @default(now()) @db.Date
   updatedAt                     DateTime        @updatedAt @db.Date
@@ -390,6 +429,8 @@ model SetupState {
   isDemo                        Boolean
   isExperimentalFeaturesEnabled Boolean?
   isSetup                       Boolean
+  mailConfig                    MailConfig?
+  newUserEmailTemplate          MailTemplate?
 
   @@map("SetupStateModel")
 }
diff --git a/apps/api/src/assignments/__tests__/assignments.controller.spec.ts b/apps/api/src/assignments/__tests__/assignments.controller.spec.ts
new file mode 100644
index 000000000..31618d4ef
--- /dev/null
+++ b/apps/api/src/assignments/__tests__/assignments.controller.spec.ts
@@ -0,0 +1,155 @@
+import type { RequestUser } from '@douglasneuroinformatics/libnest';
+import { MockFactory } from '@douglasneuroinformatics/libnest/testing';
+import type { MockedInstance } from '@douglasneuroinformatics/libnest/testing';
+import { Test } from '@nestjs/testing';
+import type { Language } from '@opendatacapture/schemas/core';
+import { DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE } from '@opendatacapture/schemas/mail';
+import { beforeEach, describe, expect, it } from 'vitest';
+
+import { AuditLogger } from '@/audit/audit.logger';
+import type { AppAbility } from '@/auth/auth.types';
+import { GroupsService } from '@/groups/groups.service';
+import { MailService } from '@/mail/mail.service';
+
+import { AssignmentsController } from '../assignments.controller';
+import { AssignmentsService } from '../assignments.service';
+
+const currentUser = { ability: {} as AppAbility, id: 'user-1' } as RequestUser;
+
+const assignment = {
+  expiresAt: new Date('2026-08-01T12:00:00.000Z'),
+  groupId: 'group-1',
+  id: 'assignment-1',
+  url: 'https://gateway.example.org/assignments/abc'
+};
+
+const customTemplate = {
+  body: { en: 'Custom body {{url}}', fr: 'Corps personnalisé {{url}}' },
+  id: 'tpl-1',
+  name: 'Custom',
+  subject: { en: 'Custom subject', fr: 'Objet personnalisé' }
+};
+
+describe('AssignmentsController', () => {
+  let assignmentsController: AssignmentsController;
+  let assignmentsService: MockedInstance<AssignmentsService>;
+  let auditLogger: MockedInstance<AuditLogger>;
+  let groupsService: MockedInstance<GroupsService>;
+  let mailService: MockedInstance<MailService>;
+
+  beforeEach(async () => {
+    const moduleRef = await Test.createTestingModule({
+      controllers: [AssignmentsController],
+      providers: [
+        MockFactory.createForService(AssignmentsService),
+        MockFactory.createForService(AuditLogger),
+        MockFactory.createForService(GroupsService),
+        MockFactory.createForService(MailService)
+      ]
+    }).compile();
+    assignmentsController = moduleRef.get(AssignmentsController);
+    assignmentsService = moduleRef.get(AssignmentsService);
+    auditLogger = moduleRef.get(AuditLogger);
+    groupsService = moduleRef.get(GroupsService);
+    mailService = moduleRef.get(MailService);
+  });
+
+  it('should be defined', () => {
+    expect(assignmentsController).toBeDefined();
+  });
+
+  describe('sendEmail', () => {
+    const sendEmail = (body: { language: Language; recipient: string; templateId?: null | string }) =>
+      assignmentsController.sendEmail('assignment-1', body, currentUser);
+
+    it('uses the built-in default template when the assignment has no group', async () => {
+      assignmentsService.findById.mockResolvedValueOnce({ ...assignment, groupId: null });
+      await sendEmail({ language: 'en', recipient: 'p@x.org' });
+      expect(groupsService.findById).not.toHaveBeenCalled();
+      expect(mailService.sendAssignmentEmail.mock.lastCall?.[0]).toMatchObject({
+        recipient: 'p@x.org',
+        template: DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE,
+        url: `${assignment.url}?lang=en`
+      });
+    });
+
+    // Rendering is the mail service's job, so the raw date has to survive the hand-off — a
+    // pre-formatted string here would be formatted twice.
+    it('forwards the raw expiry rather than a formatted date', async () => {
+      assignmentsService.findById.mockResolvedValueOnce({ ...assignment, groupId: null });
+      await sendEmail({ language: 'en', recipient: 'p@x.org' });
+      expect(mailService.sendAssignmentEmail.mock.lastCall?.[0]).toMatchObject({
+        expiresAt: assignment.expiresAt
+      });
+    });
+
+    it("uses the group's active template when no template id is given", async () => {
+      assignmentsService.findById.mockResolvedValueOnce(assignment);
+      groupsService.findById.mockResolvedValueOnce({
+        activeAssignmentEmailTemplateId: 'tpl-1',
+        emailTemplates: [customTemplate]
+      });
+      await sendEmail({ language: 'en', recipient: 'p@x.org' });
+      expect(mailService.sendAssignmentEmail.mock.lastCall?.[0]).toMatchObject({
+        template: { body: customTemplate.body, subject: customTemplate.subject }
+      });
+    });
+
+    it('uses the explicitly requested template over the active one', async () => {
+      assignmentsService.findById.mockResolvedValueOnce(assignment);
+      groupsService.findById.mockResolvedValueOnce({
+        activeAssignmentEmailTemplateId: 'tpl-other',
+        emailTemplates: [customTemplate]
+      });
+      await sendEmail({ language: 'en', recipient: 'p@x.org', templateId: 'tpl-1' });
+      expect(mailService.sendAssignmentEmail.mock.lastCall?.[0]).toMatchObject({
+        template: { body: customTemplate.body, subject: customTemplate.subject }
+      });
+    });
+
+    it('uses the default template when the template id is null, even if an active template is set', async () => {
+      assignmentsService.findById.mockResolvedValueOnce(assignment);
+      groupsService.findById.mockResolvedValueOnce({
+        activeAssignmentEmailTemplateId: 'tpl-1',
+        emailTemplates: [customTemplate]
+      });
+      await sendEmail({ language: 'en', recipient: 'p@x.org', templateId: null });
+      expect(mailService.sendAssignmentEmail.mock.lastCall?.[0]).toMatchObject({
+        template: DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE
+      });
+    });
+
+    it('passes the requested language through for the mail service to render', async () => {
+      assignmentsService.findById.mockResolvedValueOnce(assignment);
+      groupsService.findById.mockResolvedValueOnce({
+        activeAssignmentEmailTemplateId: 'tpl-1',
+        emailTemplates: [customTemplate]
+      });
+      await sendEmail({ language: 'fr', recipient: 'p@x.org' });
+      expect(mailService.sendAssignmentEmail.mock.lastCall?.[0]).toMatchObject({
+        language: 'fr',
+        url: `${assignment.url}?lang=fr`
+      });
+    });
+
+    it('records an audit log entry against the assignment group', async () => {
+      assignmentsService.findById.mockResolvedValueOnce(assignment);
+      groupsService.findById.mockResolvedValueOnce({ emailTemplates: [] });
+      await sendEmail({ language: 'en', recipient: 'p@x.org' });
+      expect(auditLogger.log).toHaveBeenCalledWith('SEND_EMAIL', 'ASSIGNMENT', {
+        groupId: 'group-1',
+        userId: 'user-1'
+      });
+    });
+
+    it('returns the delivery result from the mail service', async () => {
+      assignmentsService.findById.mockResolvedValueOnce({ ...assignment, groupId: null });
+      mailService.sendAssignmentEmail.mockResolvedValueOnce({
+        message: 'rendered',
+        recipient: 'p@x.org',
+        status: 'SENT'
+      });
+      await expect(sendEmail({ language: 'en', recipient: 'p@x.org' })).resolves.toMatchObject({ status: 'SENT' });
+    });
+  });
+});
diff --git a/apps/api/src/assignments/assignments.controller.ts b/apps/api/src/assignments/assignments.controller.ts
index e46bf351c..60ba9e442 100644
--- a/apps/api/src/assignments/assignments.controller.ts
+++ b/apps/api/src/assignments/assignments.controller.ts
@@ -2,18 +2,31 @@ import { CurrentUser } from '@douglasneuroinformatics/libnest';
 import type { RequestUser } from '@douglasneuroinformatics/libnest';
 import { Body, Controller, Get, Param, Patch, Post, Query } from '@nestjs/common';
 import { ApiOperation } from '@nestjs/swagger';
+import { Throttle } from '@nestjs/throttler';
 import type { Assignment } from '@opendatacapture/schemas/assignment';
+import { DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE } from '@opendatacapture/schemas/mail';
+import type { EmailDeliveryResult, MailTemplate } from '@opendatacapture/schemas/mail';
 
+import { AuditLogger } from '@/audit/audit.logger';
 import type { AppAbility } from '@/auth/auth.types';
+import { ASSIGNMENT_EMAIL_THROTTLER_LIMIT, ASSIGNMENT_EMAIL_THROTTLER_TTL } from '@/core/constants';
 import { RouteAccess } from '@/core/decorators/route-access.decorator';
+import { GroupsService } from '@/groups/groups.service';
+import { MailService } from '@/mail/mail.service';
 
 import { AssignmentsService } from './assignments.service';
 import { CreateAssignmentDto } from './dto/create-assignment.dto';
+import { SendAssignmentEmailDto } from './dto/send-assignment-email.dto';
 import { UpdateAssignmentDto } from './dto/update-assignment.dto';
 
 @Controller('assignments')
 export class AssignmentsController {
-  constructor(private readonly assignmentsService: AssignmentsService) {}
+  constructor(
+    private readonly assignmentsService: AssignmentsService,
+    private readonly auditLogger: AuditLogger,
+    private readonly groupsService: GroupsService,
+    private readonly mailService: MailService
+  ) {}
 
   @ApiOperation({ summary: 'Create Assignment' })
   @Post()
@@ -29,6 +42,44 @@ export class AssignmentsController {
     return this.assignmentsService.find({ subjectId }, { ability });
   }
 
+  @ApiOperation({ summary: 'Email Assignment Link' })
+  @Post(':id/email')
+  @RouteAccess({ action: 'update', subject: 'Assignment' })
+  // This route makes the instance's mail identity deliver a live assignment credential to a
+  // caller-supplied address, so it is bounded independently of the global default.
+  @Throttle({ long: { limit: ASSIGNMENT_EMAIL_THROTTLER_LIMIT, ttl: ASSIGNMENT_EMAIL_THROTTLER_TTL } })
+  async sendEmail(
+    @Param('id') id: string,
+    @Body() { language, recipient, templateId }: SendAssignmentEmailDto,
+    @CurrentUser() currentUser: RequestUser
+  ): Promise<EmailDeliveryResult> {
+    const { ability } = currentUser;
+    const assignment = await this.assignmentsService.findById(id, { ability });
+    // Choose the requested template if given, else the group's active one; either way falling back
+    // to the built-in default when the id resolves to nothing (e.g. null selects the default).
+    let template: MailTemplate = { ...DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE };
+    if (assignment.groupId) {
+      const group = await this.groupsService.findById(assignment.groupId, { ability });
+      const targetId = templateId === undefined ? group.activeAssignmentEmailTemplateId : templateId;
+      const chosen = group.emailTemplates?.find(({ id }) => id === targetId);
+      if (chosen?.body && chosen.subject) {
+        template = { body: chosen.body, subject: chosen.subject };
+      }
+    }
+    const result = await this.mailService.sendAssignmentEmail({
+      expiresAt: assignment.expiresAt,
+      language,
+      recipient,
+      template,
+      url: `${assignment.url}?lang=${language}`
+    });
+    await this.auditLogger.log('SEND_EMAIL', 'ASSIGNMENT', {
+      groupId: assignment.groupId ?? null,
+      userId: currentUser.id
+    });
+    return result;
+  }
+
   @ApiOperation({ summary: 'Update Assignment' })
   @Patch(':id')
   @RouteAccess({ action: 'update', subject: 'Assignment' })
diff --git a/apps/api/src/assignments/assignments.module.ts b/apps/api/src/assignments/assignments.module.ts
index a2f59f5e1..122fdce46 100644
--- a/apps/api/src/assignments/assignments.module.ts
+++ b/apps/api/src/assignments/assignments.module.ts
@@ -1,6 +1,8 @@
 import { forwardRef, Module } from '@nestjs/common';
 
 import { GatewayModule } from '@/gateway/gateway.module';
+import { GroupsModule } from '@/groups/groups.module';
+import { MailModule } from '@/mail/mail.module';
 
 import { AssignmentsController } from './assignments.controller';
 import { AssignmentsService } from './assignments.service';
@@ -8,7 +10,7 @@ import { AssignmentsService } from './assignments.service';
 @Module({
   controllers: [AssignmentsController],
   exports: [AssignmentsService],
-  imports: [forwardRef(() => GatewayModule)],
+  imports: [forwardRef(() => GatewayModule), GroupsModule, MailModule],
   providers: [AssignmentsService]
 })
 export class AssignmentsModule {}
diff --git a/apps/api/src/assignments/dto/send-assignment-email.dto.ts b/apps/api/src/assignments/dto/send-assignment-email.dto.ts
new file mode 100644
index 000000000..992d27030
--- /dev/null
+++ b/apps/api/src/assignments/dto/send-assignment-email.dto.ts
@@ -0,0 +1,20 @@
+import { ValidationSchema } from '@douglasneuroinformatics/libnest';
+import { ApiProperty } from '@nestjs/swagger';
+import type { Language } from '@opendatacapture/schemas/core';
+import { $SendAssignmentEmailData } from '@opendatacapture/schemas/mail';
+import type { SendAssignmentEmailData } from '@opendatacapture/schemas/mail';
+
+@ValidationSchema($SendAssignmentEmailData)
+export class SendAssignmentEmailDto implements SendAssignmentEmailData {
+  @ApiProperty({ description: 'The language to send the email in', enum: ['en', 'fr'] })
+  language: Language;
+
+  @ApiProperty({ description: "The participant's email address" })
+  recipient: string;
+
+  @ApiProperty({
+    description: 'Template id to use; null for the built-in default, omitted to use the group active template',
+    required: false
+  })
+  templateId?: null | string;
+}
diff --git a/apps/api/src/core/__tests__/secret-cipher.spec.ts b/apps/api/src/core/__tests__/secret-cipher.spec.ts
new file mode 100644
index 000000000..98ae35bc9
--- /dev/null
+++ b/apps/api/src/core/__tests__/secret-cipher.spec.ts
@@ -0,0 +1,45 @@
+import { describe, expect, it } from 'vitest';
+
+import { decryptSecret, encryptSecret } from '../secret-cipher';
+
+const SECRET_KEY = '2622d72669dd194b98cffd9098b0d04b';
+
+describe('secret-cipher', () => {
+  it('should round-trip a secret', () => {
+    expect(decryptSecret(encryptSecret('hunter2', SECRET_KEY), SECRET_KEY)).toBe('hunter2');
+  });
+
+  it('should round-trip a non-ASCII secret', () => {
+    const secret = 'pässwörd–✓';
+    expect(decryptSecret(encryptSecret(secret, SECRET_KEY), SECRET_KEY)).toBe(secret);
+  });
+
+  // A fresh IV per call, so the same secret never produces the same stored value twice.
+  it('should produce a different ciphertext each time', () => {
+    expect(encryptSecret('hunter2', SECRET_KEY)).not.toBe(encryptSecret('hunter2', SECRET_KEY));
+  });
+
+  it('should not contain the plaintext', () => {
+    expect(encryptSecret('hunter2', SECRET_KEY)).not.toContain('hunter2');
+  });
+
+  it('should throw when the key differs, which is what a rotated SECRET_KEY looks like', () => {
+    const encrypted = encryptSecret('hunter2', SECRET_KEY);
+    expect(() => decryptSecret(encrypted, 'a-completely-different-key')).toThrow();
+  });
+
+  it.each(['not-dot-separated', 'only.two', '', 'aaa.bbb.not-base64-ciphertext'])(
+    'should throw on the malformed payload %s',
+    (value) => {
+      expect(() => decryptSecret(value, SECRET_KEY)).toThrow();
+    }
+  );
+
+  // GCM authenticates the ciphertext, so a tampered payload must not decrypt to anything.
+  it('should throw when the ciphertext has been tampered with', () => {
+    const [iv, authTag, ciphertext] = encryptSecret('hunter2', SECRET_KEY).split('.') as [string, string, string];
+    const flipped = Buffer.from(ciphertext, 'base64');
+    flipped[0] = (flipped[0] ?? 0) ^ 0xff;
+    expect(() => decryptSecret([iv, authTag, flipped.toString('base64')].join('.'), SECRET_KEY)).toThrow();
+  });
+});
diff --git a/apps/api/src/core/constants.ts b/apps/api/src/core/constants.ts
index a377c0370..fa771af4e 100644
--- a/apps/api/src/core/constants.ts
+++ b/apps/api/src/core/constants.ts
@@ -1,3 +1,8 @@
 export const DEFAULT_LOGIN_REQUEST_THROTTLER_LIMIT = 50;
 
 export const DEFAULT_LOGIN_REQUEST_THROTTLER_TTL = 60_000;
+
+/** Assignment emails a single client may send per {@link ASSIGNMENT_EMAIL_THROTTLER_TTL}. */
+export const ASSIGNMENT_EMAIL_THROTTLER_LIMIT = 20;
+
+export const ASSIGNMENT_EMAIL_THROTTLER_TTL = 60_000;
diff --git a/apps/api/src/core/secret-cipher.ts b/apps/api/src/core/secret-cipher.ts
new file mode 100644
index 000000000..8a0269a54
--- /dev/null
+++ b/apps/api/src/core/secret-cipher.ts
@@ -0,0 +1,35 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+
+/** Derive a 32-byte AES key from the server `SECRET_KEY`. */
+function encryptionKey(secretKey: string): Buffer {
+  return createHash('sha256').update(secretKey).digest();
+}
+
+/**
+ * Encrypt a secret with AES-256-GCM under a key derived from the server `SECRET_KEY`, returning
+ * `iv.authTag.ciphertext` (all base64) so a database dump yields no usable credential.
+ */
+export function encryptSecret(plaintext: string, secretKey: string): string {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv('aes-256-gcm', encryptionKey(secretKey), iv);
+  const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  return [iv.toString('base64'), authTag.toString('base64'), ciphertext.toString('base64')].join('.');
+}
+
+/**
+ * Reverse {@link encryptSecret}.
+ *
+ * Throws when the payload is malformed or fails authentication — which is what rotating
+ * `SECRET_KEY` looks like. Callers decide whether that is fatal: losing a mail password should
+ * surface, while a GitHub token that no longer decrypts is recoverable by re-entering it.
+ */
+export function decryptSecret(value: string, secretKey: string): string {
+  const [ivB64, authTagB64, ciphertextB64] = value.split('.');
+  if (!ivB64 || !authTagB64 || !ciphertextB64) {
+    throw new Error('Malformed encrypted secret: expected iv.authTag.ciphertext');
+  }
+  const decipher = createDecipheriv('aes-256-gcm', encryptionKey(secretKey), Buffer.from(ivB64, 'base64'));
+  decipher.setAuthTag(Buffer.from(authTagB64, 'base64'));
+  return Buffer.concat([decipher.update(Buffer.from(ciphertextB64, 'base64')), decipher.final()]).toString('utf8');
+}
diff --git a/apps/api/src/groups/__tests__/groups.service.spec.ts b/apps/api/src/groups/__tests__/groups.service.spec.ts
index 58276fab4..de96524d5 100644
--- a/apps/api/src/groups/__tests__/groups.service.spec.ts
+++ b/apps/api/src/groups/__tests__/groups.service.spec.ts
@@ -2,8 +2,9 @@ import type { Model } from '@douglasneuroinformatics/libnest';
 import { getModelToken } from '@douglasneuroinformatics/libnest';
 import { MockFactory } from '@douglasneuroinformatics/libnest/testing';
 import type { MockedInstance } from '@douglasneuroinformatics/libnest/testing';
-import { ConflictException, NotFoundException } from '@nestjs/common';
+import { BadRequestException, ConflictException, NotFoundException } from '@nestjs/common';
 import { Test } from '@nestjs/testing';
+import { PrismaClientKnownRequestError } from '@prisma/client/runtime/library';
 import { beforeEach, describe, expect, it } from 'vitest';
 
 import { GroupsService } from '../groups.service';
@@ -89,6 +90,120 @@ describe('GroupsService', () => {
       expect(groupModel.update).toHaveBeenCalled();
     });
 
+    it('should write the email template list as a composite set', async () => {
+      const templates = [{ body: { en: 'Link {{url}}' }, id: 'tpl-1', name: 'One', subject: { en: 'Subject' } }];
+      groupModel.findFirst.mockResolvedValueOnce({ settings: {}, updatedAt: new Date('2026-07-01T00:00:00Z') });
+      await groupsService.updateById('123', {
+        activeAssignmentEmailTemplateId: 'tpl-1',
+        emailTemplates: templates,
+        expectedUpdatedAt: new Date('2026-07-01T00:00:00Z')
+      });
+      expect(groupModel.update.mock.lastCall?.[0]).toMatchObject({ data: { emailTemplates: { set: templates } } });
+    });
+
+    // A duplicate id makes `find()` shadow every match after the first.
+    it('should reject duplicate template ids', async () => {
+      groupModel.findFirst.mockResolvedValueOnce({ settings: {}, updatedAt: new Date('2026-07-01T00:00:00Z') });
+      await expect(
+        groupsService.updateById('123', {
+          emailTemplates: [
+            { id: 'tpl-1', name: 'One' },
+            { id: 'tpl-1', name: 'Two' }
+          ],
+          expectedUpdatedAt: new Date('2026-07-01T00:00:00Z')
+        })
+      ).rejects.toBeInstanceOf(BadRequestException);
+    });
+
+    // A dangling active id makes participants silently receive the built-in wording.
+    it('should reject an active template id that resolves to nothing', async () => {
+      groupModel.findFirst.mockResolvedValueOnce({ settings: {}, updatedAt: new Date('2026-07-01T00:00:00Z') });
+      await expect(
+        groupsService.updateById('123', {
+          activeAssignmentEmailTemplateId: 'tpl-gone',
+          emailTemplates: [{ id: 'tpl-1', name: 'One' }],
+          expectedUpdatedAt: new Date('2026-07-01T00:00:00Z')
+        })
+      ).rejects.toBeInstanceOf(BadRequestException);
+    });
+
+    it('should accept a null active id, which selects the built-in default', async () => {
+      groupModel.findFirst.mockResolvedValueOnce({ settings: {}, updatedAt: new Date('2026-07-01T00:00:00Z') });
+      await groupsService.updateById('123', {
+        activeAssignmentEmailTemplateId: null,
+        emailTemplates: [{ id: 'tpl-1', name: 'One' }],
+        expectedUpdatedAt: new Date('2026-07-01T00:00:00Z')
+      });
+      expect(groupModel.update).toHaveBeenCalled();
+    });
+
+    // The stored active id has to stay resolvable when only the list is replaced.
+    it('should reject a list that drops the currently active template', async () => {
+      groupModel.findFirst.mockResolvedValueOnce({
+        activeAssignmentEmailTemplateId: 'tpl-1',
+        settings: {},
+        updatedAt: new Date('2026-07-01T00:00:00Z')
+      });
+      await expect(
+        groupsService.updateById('123', {
+          emailTemplates: [{ id: 'tpl-2', name: 'Two' }],
+          expectedUpdatedAt: new Date('2026-07-01T00:00:00Z')
+        })
+      ).rejects.toBeInstanceOf(BadRequestException);
+    });
+
+    // `emailTemplates` is replaced wholesale from the client's cached copy, so a concurrent edit
+    // has to be rejected rather than silently overwritten.
+    it('should reject an update composed against a stale revision', async () => {
+      groupModel.findFirst.mockResolvedValueOnce({ settings: {}, updatedAt: new Date('2026-07-02T00:00:00Z') });
+      await expect(
+        groupsService.updateById('123', {
+          emailTemplates: [],
+          expectedUpdatedAt: new Date('2026-07-01T00:00:00Z')
+        })
+      ).rejects.toBeInstanceOf(ConflictException);
+      expect(groupModel.update).not.toHaveBeenCalled();
+    });
+
+    // The pre-check is a separate read, so the revision has to constrain the write itself too.
+    it('should carry the expected revision into the update where clause', async () => {
+      const expectedUpdatedAt = new Date('2026-07-01T00:00:00Z');
+      groupModel.findFirst.mockResolvedValueOnce({ settings: {}, updatedAt: expectedUpdatedAt });
+      await groupsService.updateById('123', { emailTemplates: [], expectedUpdatedAt });
+      expect(groupModel.update.mock.lastCall?.[0]).toMatchObject({ where: { updatedAt: expectedUpdatedAt } });
+    });
+
+    // The pre-check can pass and the conditional write still lose, when another writer commits
+    // in between. Prisma reports that as P2025, which has to read as a conflict rather than a 500.
+    it('should map a lost conditional write to a conflict', async () => {
+      const expectedUpdatedAt = new Date('2026-07-01T00:00:00Z');
+      groupModel.findFirst.mockResolvedValueOnce({ settings: {}, updatedAt: expectedUpdatedAt });
+      groupModel.update.mockRejectedValueOnce(
+        new PrismaClientKnownRequestError('No record was found for an update', {
+          clientVersion: '6.19.3',
+          code: 'P2025'
+        })
+      );
+      await expect(groupsService.updateById('123', { emailTemplates: [], expectedUpdatedAt })).rejects.toBeInstanceOf(
+        ConflictException
+      );
+    });
+
+    it('should not disguise an unrelated database error as a conflict', async () => {
+      const expectedUpdatedAt = new Date('2026-07-01T00:00:00Z');
+      groupModel.findFirst.mockResolvedValueOnce({ settings: {}, updatedAt: expectedUpdatedAt });
+      groupModel.update.mockRejectedValueOnce(new Error('connection lost'));
+      await expect(groupsService.updateById('123', { emailTemplates: [], expectedUpdatedAt })).rejects.toThrow(
+        'connection lost'
+      );
+    });
+
+    it('should leave the where clause unconstrained when no revision is supplied', async () => {
+      groupModel.findFirst.mockResolvedValueOnce({ settings: {} });
+      await groupsService.updateById('123', { name: 'Test Group' });
+      expect(groupModel.update.mock.lastCall?.[0].where).not.toHaveProperty('updatedAt');
+    });
+
     it('should throw a ConflictException when renaming to an existing name', async () => {
       groupModel.findFirst.mockResolvedValueOnce({ name: 'Old Name', settings: {} });
       groupModel.exists.mockResolvedValueOnce(true);
diff --git a/apps/api/src/groups/dto/update-group.dto.ts b/apps/api/src/groups/dto/update-group.dto.ts
index d123fa040..373e3260d 100644
--- a/apps/api/src/groups/dto/update-group.dto.ts
+++ b/apps/api/src/groups/dto/update-group.dto.ts
@@ -1,10 +1,13 @@
 import { ValidationSchema } from '@douglasneuroinformatics/libnest';
 import { $UpdateGroupData } from '@opendatacapture/schemas/group';
-import type { GroupSettings, GroupType, UpdateGroupData } from '@opendatacapture/schemas/group';
+import type { GroupEmailTemplate, GroupSettings, GroupType, UpdateGroupData } from '@opendatacapture/schemas/group';
 
 @ValidationSchema($UpdateGroupData)
 export class UpdateGroupDto implements UpdateGroupData {
   accessibleInstrumentIds?: string[];
+  activeAssignmentEmailTemplateId?: null | string;
+  emailTemplates?: GroupEmailTemplate[];
+  expectedUpdatedAt?: Date;
   instrumentRepoIds?: string[];
   name?: string;
   settings?: Partial<GroupSettings>;
diff --git a/apps/api/src/groups/groups.service.ts b/apps/api/src/groups/groups.service.ts
index b6ae1b87b..f02a23de3 100644
--- a/apps/api/src/groups/groups.service.ts
+++ b/apps/api/src/groups/groups.service.ts
@@ -1,7 +1,9 @@
 import { InjectModel } from '@douglasneuroinformatics/libnest';
 import type { Model } from '@douglasneuroinformatics/libnest';
-import { ConflictException, Injectable, NotFoundException } from '@nestjs/common';
+import { BadRequestException, ConflictException, Injectable, NotFoundException } from '@nestjs/common';
+import type { GroupEmailTemplate } from '@opendatacapture/schemas/group';
 import type { Prisma } from '@prisma/client';
+import { PrismaClientKnownRequestError } from '@prisma/client/runtime/library';
 
 import { accessibleQuery } from '@/auth/ability.utils';
 import type { EntityOperationOptions } from '@/core/types';
@@ -69,7 +71,14 @@ export class GroupsService {
 
   async updateById(
     id: string,
-    { accessibleInstrumentIds, instrumentRepoIds, settings, ...data }: UpdateGroupDto,
+    {
+      accessibleInstrumentIds,
+      emailTemplates,
+      expectedUpdatedAt,
+      instrumentRepoIds,
+      settings,
+      ...data
+    }: UpdateGroupDto,
     { ability }: EntityOperationOptions = {}
   ) {
     const where: Prisma.GroupWhereInput = { AND: [accessibleQuery(ability, 'update', 'Group')], id };
@@ -77,6 +86,13 @@ export class GroupsService {
     if (!group) {
       throw new NotFoundException(`Failed to find group with ID: ${id}`);
     }
+    if (expectedUpdatedAt && group.updatedAt.getTime() !== expectedUpdatedAt.getTime()) {
+      throw new ConflictException(`Group with ID '${id}' has been modified since it was loaded`);
+    }
+    // The check above is only a fast, friendly rejection — it is a separate read, so two writers
+    // can both pass it. `expectedUpdatedAt` therefore also goes in the update's own `where`, which
+    // is what actually makes the write conditional.
+    const revisionGuard: { updatedAt?: Date } = expectedUpdatedAt ? { updatedAt: expectedUpdatedAt } : {};
     // Only guard against a genuine rename collision: check the requested name (not the current one,
     // which would always match this same group) and skip the check when the name is unchanged.
     const exists =
@@ -84,6 +100,7 @@ export class GroupsService {
     if (exists) {
       throw new ConflictException(`Group with name '${data.name}' already exists!`);
     }
+    this.validateEmailTemplates(emailTemplates, data.activeAssignmentEmailTemplateId, group);
 
     // Guard against stale client state: an instrument may have been deleted since the client loaded the
     // group (the deleted id can linger in the client's accessible list). Connecting a non-existent
@@ -100,25 +117,62 @@ export class GroupsService {
       validInstrumentIds = existingInstruments.map(({ id }) => id);
     }
 
-    return this.groupModel.update({
-      data: {
-        accessibleInstruments: validInstrumentIds
-          ? {
-              set: validInstrumentIds.map((id) => ({ id }))
-            }
-          : undefined,
-        instrumentRepos: instrumentRepoIds
-          ? {
-              set: instrumentRepoIds.map((id) => ({ id }))
-            }
-          : undefined,
-        settings: {
-          ...group.settings,
-          ...settings
+    try {
+      return await this.groupModel.update({
+        data: {
+          accessibleInstruments: validInstrumentIds
+            ? {
+                set: validInstrumentIds.map((id) => ({ id }))
+              }
+            : undefined,
+          // Composite list fields must be replaced via `set` in the MongoDB connector.
+          emailTemplates: emailTemplates ? { set: emailTemplates } : undefined,
+          instrumentRepos: instrumentRepoIds
+            ? {
+                set: instrumentRepoIds.map((id) => ({ id }))
+              }
+            : undefined,
+          settings: {
+            ...group.settings,
+            ...settings
+          },
+          ...data
         },
-        ...data
-      },
-      where: { AND: [accessibleQuery(ability, 'update', 'Group')], id }
-    });
+        where: { AND: [accessibleQuery(ability, 'update', 'Group')], id, ...revisionGuard }
+      });
+    } catch (err) {
+      // P2025 is "no record matched the where clause". The findFirst above already matched on id
+      // and ability, so the revision guard is the only filter that can have started failing —
+      // i.e. a concurrent edit. Anything else is a real fault and has to surface.
+      if (revisionGuard.updatedAt && err instanceof PrismaClientKnownRequestError && err.code === 'P2025') {
+        throw new ConflictException(`Group with ID '${id}' has been modified since it was loaded`);
+      }
+      throw err;
+    }
+  }
+
+  /**
+   * Reject a template list that cannot be resolved later. A duplicate id makes `find()` shadow
+   * every match after the first, and an active id pointing at nothing makes the assignment
+   * controller fall back to the built-in wording — so participants silently receive the wrong
+   * message with nothing logged.
+   */
+  private validateEmailTemplates(
+    emailTemplates: GroupEmailTemplate[] | undefined,
+    activeId: null | string | undefined,
+    group: { activeAssignmentEmailTemplateId?: null | string; emailTemplates?: GroupEmailTemplate[] }
+  ): void {
+    const templates = emailTemplates ?? group.emailTemplates ?? [];
+    if (emailTemplates) {
+      const ids = emailTemplates.map((template) => template.id);
+      if (new Set(ids).size !== ids.length) {
+        throw new BadRequestException('Each email template must have a unique id');
+      }
+    }
+    // `undefined` leaves the stored value alone; `null` deliberately selects the built-in default.
+    const nextActiveId = activeId === undefined ? group.activeAssignmentEmailTemplateId : activeId;
+    if (nextActiveId && !templates.some((template) => template.id === nextActiveId)) {
+      throw new BadRequestException(`No email template with id '${nextActiveId}' exists in this group`);
+    }
   }
 }
diff --git a/apps/api/src/instrument-repos/instrument-repos.service.ts b/apps/api/src/instrument-repos/instrument-repos.service.ts
index 3055e038c..e49e51fe6 100644
--- a/apps/api/src/instrument-repos/instrument-repos.service.ts
+++ b/apps/api/src/instrument-repos/instrument-repos.service.ts
@@ -1,4 +1,3 @@
-import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
@@ -18,6 +17,7 @@ import type { BundlerInput } from '@opendatacapture/instrument-bundler';
 import JSZip from 'jszip';
 
 import { accessibleQuery } from '@/auth/ability.utils';
+import { decryptSecret, encryptSecret } from '@/core/secret-cipher';
 import type { EntityOperationOptions } from '@/core/types';
 import { InstrumentsService } from '@/instruments/instruments.service';
 
@@ -152,17 +152,13 @@ export class InstrumentReposService implements OnModuleInit {
     return this.stripSecrets(updated);
   }
 
-  /** Reverse {@link encrypt}. Returns undefined if the value cannot be decrypted. */
+  /**
+   * Reverse {@link encrypt}. Returns undefined if the value cannot be decrypted: a repository whose
+   * token is unreadable is still usable if it is public, so this stays recoverable rather than fatal.
+   */
   private decrypt(value: string): string | undefined {
     try {
-      const [ivB64, authTagB64, ciphertextB64] = value.split('.');
-      if (!ivB64 || !authTagB64 || !ciphertextB64) {
-        return undefined;
-      }
-      const decipher = createDecipheriv('aes-256-gcm', this.encryptionKey(), Buffer.from(ivB64, 'base64'));
-      decipher.setAuthTag(Buffer.from(authTagB64, 'base64'));
-      const plaintext = Buffer.concat([decipher.update(Buffer.from(ciphertextB64, 'base64')), decipher.final()]);
-      return plaintext.toString('utf8');
+      return decryptSecret(value, this.configService.getOrThrow('SECRET_KEY'));
     } catch (err) {
       this.loggingService.error(`Failed to decrypt stored access token: ${String(err)}`);
       return undefined;
@@ -242,19 +238,8 @@ export class InstrumentReposService implements OnModuleInit {
     throw new BadGatewayException(`Failed to download repository ${owner}/${repoName}. ${hint}`);
   }
 
-  /** Encrypt a secret with AES-256-GCM, returning `iv.authTag.ciphertext` (all base64). */
   private encrypt(plaintext: string): string {
-    const iv = randomBytes(12);
-    const cipher = createCipheriv('aes-256-gcm', this.encryptionKey(), iv);
-    const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
-    const authTag = cipher.getAuthTag();
-    return [iv.toString('base64'), authTag.toString('base64'), ciphertext.toString('base64')].join('.');
-  }
-
-  /** Derive a 32-byte AES key from the server SECRET_KEY. */
-  private encryptionKey(): Buffer {
-    const secret = this.configService.getOrThrow('SECRET_KEY');
-    return createHash('sha256').update(secret).digest();
+    return encryptSecret(plaintext, this.configService.getOrThrow('SECRET_KEY'));
   }
 
   // Unpack a GitHub zipball into `destDir`, returning the single top-level directory the archive wraps
diff --git a/apps/api/src/mail/__tests__/mail.controller.spec.ts b/apps/api/src/mail/__tests__/mail.controller.spec.ts
new file mode 100644
index 000000000..37139ac05
--- /dev/null
+++ b/apps/api/src/mail/__tests__/mail.controller.spec.ts
@@ -0,0 +1,57 @@
+import { MockFactory } from '@douglasneuroinformatics/libnest/testing';
+import type { MockedInstance } from '@douglasneuroinformatics/libnest/testing';
+import { Test } from '@nestjs/testing';
+import { beforeEach, describe, expect, it } from 'vitest';
+
+import { MailController } from '../mail.controller';
+import { MailService } from '../mail.service';
+
+const settings = { config: null, newUserEmailTemplate: { body: {}, subject: {} } };
+
+describe('MailController', () => {
+  let mailController: MailController;
+  let mailService: MockedInstance<MailService>;
+
+  beforeEach(async () => {
+    const moduleRef = await Test.createTestingModule({
+      controllers: [MailController],
+      providers: [MockFactory.createForService(MailService)]
+    }).compile();
+    mailController = moduleRef.get(MailController);
+    mailService = moduleRef.get(MailService);
+  });
+
+  it('should be defined', () => {
+    expect(mailController).toBeDefined();
+  });
+
+  describe('getSettings', () => {
+    it('returns the settings from the service', async () => {
+      mailService.getSettings.mockResolvedValueOnce(settings);
+      await expect(mailController.getSettings()).resolves.toBe(settings);
+    });
+  });
+
+  describe('test', () => {
+    it('forwards the supplied configuration so unsaved settings can be tested', async () => {
+      mailService.test.mockResolvedValueOnce({ success: true });
+      const data = { recipient: 'p@x.org' };
+      await mailController.test(data);
+      expect(mailService.test).toHaveBeenCalledWith(data);
+    });
+
+    it('returns the failure code unchanged for the client to localize', async () => {
+      mailService.test.mockResolvedValueOnce({ error: 'AUTHENTICATION_FAILED', success: false });
+      await expect(mailController.test({})).resolves.toMatchObject({ error: 'AUTHENTICATION_FAILED' });
+    });
+  });
+
+  describe('updateSettings', () => {
+    it('forwards the payload to the service', async () => {
+      mailService.updateSettings.mockResolvedValueOnce(settings);
+      const data = { newUserEmailTemplate: { body: { en: 'Hi' }, subject: { en: 'Hello' } } };
+      await mailController.updateSettings(data);
+      expect(mailService.updateSettings).toHaveBeenCalledWith(data);
+    });
+  });
+});
diff --git a/apps/api/src/mail/__tests__/mail.service.spec.ts b/apps/api/src/mail/__tests__/mail.service.spec.ts
new file mode 100644
index 000000000..15b9e3574
--- /dev/null
+++ b/apps/api/src/mail/__tests__/mail.service.spec.ts
@@ -0,0 +1,323 @@
+import { ConfigService, getModelToken, LoggingService } from '@douglasneuroinformatics/libnest';
+import type { Model } from '@douglasneuroinformatics/libnest';
+import { MockFactory } from '@douglasneuroinformatics/libnest/testing';
+import type { MockedInstance } from '@douglasneuroinformatics/libnest/testing';
+import { BadRequestException, ServiceUnavailableException } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import type { UpdateMailConfigData } from '@opendatacapture/schemas/mail';
+import { createTransport } from 'nodemailer';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { Mock } from 'vitest';
+
+import { decryptSecret, encryptSecret } from '@/core/secret-cipher';
+
+import { MailService } from '../mail.service';
+
+vi.mock('nodemailer', () => ({ createTransport: vi.fn() }));
+
+const SECRET_KEY = 'test-secret-key';
+
+/** The shape of the Prisma update this service issues, narrowed for assertions. */
+type PersistedUpdate = { data: { mailConfig: { set: { password: string } } } };
+
+/** What Mongo holds: everything as configured, but with the password encrypted at rest. */
+const stored = (config: UpdateMailConfigData, password = 'secret') => ({
+  ...config,
+  password: encryptSecret(password, SECRET_KEY)
+});
+
+const validConfig: UpdateMailConfigData = {
+  enabled: true,
+  encryption: 'starttls',
+  host: 'smtp.example.org',
+  password: 'secret',
+  port: 587,
+  senderAddress: 'noreply@example.org',
+  senderName: 'ODC',
+  username: 'user'
+};
+
+const newUserArgs = {
+  email: 'u@x.org',
+  firstName: 'Jane',
+  group: 'G',
+  lastName: 'Doe',
+  url: 'https://x',
+  username: 'jdoe'
+};
+
+describe('MailService', () => {
+  let mailService: MailService;
+  let setupStateModel: MockedInstance<Model<'SetupState'>>;
+  let transporter: { sendMail: Mock; verify: Mock };
+
+  /** The password as it would come back out of the database. */
+  const persistedPassword = () =>
+    decryptSecret(
+      (setupStateModel.update.mock.lastCall?.[0] as PersistedUpdate).data.mailConfig.set.password,
+      SECRET_KEY
+    );
+
+  beforeEach(async () => {
+    // `createTransport` is a module-level mock, so its call history outlives the testing module.
+    vi.clearAllMocks();
+    const moduleRef = await Test.createTestingModule({
+      providers: [
+        MailService,
+        MockFactory.createForModelToken(getModelToken('SetupState')),
+        MockFactory.createForService(ConfigService),
+        MockFactory.createForService(LoggingService)
+      ]
+    }).compile();
+    moduleRef.get<MockedInstance<ConfigService>>(ConfigService).getOrThrow.mockReturnValue(SECRET_KEY);
+    setupStateModel = moduleRef.get(getModelToken('SetupState'));
+    mailService = moduleRef.get(MailService);
+    transporter = { sendMail: vi.fn().mockResolvedValue({}), verify: vi.fn().mockResolvedValue(true) };
+    (createTransport as Mock).mockReturnValue(transporter);
+  });
+
+  // A config that stops validating must not silently mute all mail.
+  describe('a stored configuration that no longer parses', () => {
+    it('throws rather than reporting mail as unconfigured', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: { ...stored(validConfig), port: 'not-a-port' } });
+      await expect(mailService.getSettings()).rejects.toThrow();
+    });
+  });
+
+  // Two empty objects are truthy, so `body && subject` alone would persist an empty template.
+  describe('an empty stored new-user template', () => {
+    it('falls back to the built-in default rather than sending an empty message', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ newUserEmailTemplate: { body: {}, subject: {} } });
+      const { newUserEmailTemplate } = await mailService.getSettings();
+      expect(newUserEmailTemplate.subject.en).toBeTruthy();
+      expect(newUserEmailTemplate.body.en).toContain('{{username}}');
+    });
+  });
+
+  describe('getSettings', () => {
+    it('strips the password and exposes a has-flag', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: stored(validConfig) });
+      const settings = await mailService.getSettings();
+      expect(settings.config).toMatchObject({ hasPassword: true, host: 'smtp.example.org' });
+      expect(settings.config).not.toHaveProperty('password');
+    });
+
+    it('returns null config and a default template when nothing is stored', async () => {
+      setupStateModel.findFirst.mockResolvedValue(null);
+      const settings = await mailService.getSettings();
+      expect(settings.config).toBeNull();
+      expect(settings.newUserEmailTemplate.subject).toBeTruthy();
+    });
+  });
+
+  describe('updateSettings', () => {
+    it('throws before setup is complete', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ isSetup: false });
+      await expect(mailService.updateSettings({ config: { ...validConfig } })).rejects.toBeInstanceOf(
+        ServiceUnavailableException
+      );
+    });
+
+    it('keeps the stored password when the update omits it for the same server', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ id: '1', isSetup: true, mailConfig: stored(validConfig) });
+      await mailService.updateSettings({ config: { ...validConfig, password: undefined } });
+      expect(persistedPassword()).toBe('secret');
+    });
+
+    // A Mongo dump must not yield a working mail credential.
+    it('encrypts the password before it reaches the database', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ id: '1', isSetup: true, mailConfig: stored(validConfig) });
+      await mailService.updateSettings({ config: { ...validConfig, password: 'new-secret' } });
+      const written = (setupStateModel.update.mock.lastCall?.[0] as PersistedUpdate).data.mailConfig.set.password;
+      expect(written).not.toBe('new-secret');
+      expect(written).not.toContain('new-secret');
+      expect(decryptSecret(written, SECRET_KEY)).toBe('new-secret');
+    });
+
+    // Inheriting across servers would let the stored secret be aimed at a host the admin chose;
+    // blanking it instead would silently break a working configuration on an unrelated edit.
+    it('refuses to save a different host without a password rather than inheriting or blanking it', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ id: '1', isSetup: true, mailConfig: stored(validConfig) });
+      await expect(
+        mailService.updateSettings({
+          config: { ...validConfig, host: 'smtp.attacker.example', password: undefined }
+        })
+      ).rejects.toBeInstanceOf(BadRequestException);
+      expect(setupStateModel.update).not.toHaveBeenCalled();
+    });
+
+    it('keeps the stored password when only a non-server field changes', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ id: '1', isSetup: true, mailConfig: stored(validConfig) });
+      await mailService.updateSettings({
+        config: { ...validConfig, password: undefined, senderName: 'New Name' }
+      });
+      expect(persistedPassword()).toBe('secret');
+      expect(setupStateModel.update.mock.lastCall?.[0]).toMatchObject({
+        data: { mailConfig: { set: { senderName: 'New Name' } } }
+      });
+    });
+
+    // Same host, but downgrading encryption would otherwise reuse the password in the clear.
+    it('refuses to reuse the stored password when the encryption changes', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ id: '1', isSetup: true, mailConfig: stored(validConfig) });
+      await expect(
+        mailService.updateSettings({ config: { ...validConfig, encryption: 'none', password: undefined } })
+      ).rejects.toBeInstanceOf(BadRequestException);
+    });
+  });
+
+  describe('test', () => {
+    it('returns success when the connection verifies', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: stored(validConfig) });
+      expect(await mailService.test({})).toEqual({ success: true });
+      expect(transporter.verify).toHaveBeenCalled();
+    });
+
+    it('returns a friendly error when verification fails', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: stored(validConfig) });
+      transporter.verify.mockRejectedValueOnce({ code: 'EAUTH' });
+      const result = await mailService.test({});
+      expect(result.success).toBe(false);
+      expect(result.error).toBe('AUTHENTICATION_FAILED');
+    });
+
+    it('delivers a message when a recipient is supplied', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: stored(validConfig) });
+      const result = await mailService.test({ recipient: 'p@x.org' });
+      expect(result).toEqual({ success: true });
+      expect(transporter.sendMail).toHaveBeenCalled();
+    });
+
+    // Otherwise the stored credential could be read back off an SMTP AUTH to a chosen host.
+    it('refuses to connect to a different host without being given that host’s password', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: stored(validConfig) });
+      const result = await mailService.test({
+        config: { ...validConfig, host: 'smtp.attacker.example', password: undefined }
+      });
+      expect(result.success).toBe(false);
+      expect(createTransport).not.toHaveBeenCalled();
+    });
+
+    it('reports when mail has not been configured', async () => {
+      setupStateModel.findFirst.mockResolvedValue(null);
+      expect(await mailService.test({})).toMatchObject({ success: false });
+    });
+  });
+
+  describe('sendNewUserEmail', () => {
+    it('is DISABLED (with a copy-pasteable message) when mail is off', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: { ...stored(validConfig), enabled: false } });
+      const result = await mailService.sendNewUserEmail(newUserArgs);
+      expect(result.status).toBe('DISABLED');
+      expect(result.message).toContain('Jane');
+    });
+
+    it('is NO_RECIPIENT when enabled but the user has no email', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: stored(validConfig) });
+      const result = await mailService.sendNewUserEmail({ ...newUserArgs, email: null });
+      expect(result.status).toBe('NO_RECIPIENT');
+    });
+
+    it('is SENT when delivery succeeds', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: stored(validConfig) });
+      const result = await mailService.sendNewUserEmail(newUserArgs);
+      expect(result.status).toBe('SENT');
+      expect(transporter.sendMail).toHaveBeenCalled();
+    });
+
+    it('never includes a password in the rendered message', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: stored(validConfig) });
+      const result = await mailService.sendNewUserEmail(newUserArgs);
+      expect(result.message).not.toMatch(/password:/i);
+      expect(result.message).not.toMatch(/\{\{password\}\}/);
+    });
+
+    it('renders the French content when language is fr', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: stored(validConfig) });
+      const result = await mailService.sendNewUserEmail({ ...newUserArgs, language: 'fr' });
+      expect(result.status).toBe('SENT');
+      expect(result.message).toContain('Bonjour');
+    });
+
+    it('is FAILED with a friendly error when delivery throws', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: stored(validConfig) });
+      transporter.sendMail.mockRejectedValueOnce({ code: 'ECONNREFUSED' });
+      const result = await mailService.sendNewUserEmail(newUserArgs);
+      expect(result.status).toBe('FAILED');
+      expect(result.error).toBe('CONNECTION_REFUSED');
+    });
+  });
+
+  describe('sendAssignmentEmail', () => {
+    const template = (body: string) => ({ body: { en: body }, subject: { en: 'Assignment' } });
+
+    const assignmentArgs = {
+      expiresAt: new Date('2026-01-01T12:00:00.000Z'),
+      language: 'en' as const,
+      recipient: 'p@x.org',
+      template: template('Link: {{url}}'),
+      url: 'https://assign'
+    };
+
+    // The rendered message still comes back so the clinician can send it by hand.
+    it('is DISABLED without attempting delivery when mail is off', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: { ...stored(validConfig), enabled: false } });
+      const result = await mailService.sendAssignmentEmail(assignmentArgs);
+      expect(result.status).toBe('DISABLED');
+      expect(result.message).toContain('https://assign');
+      expect(transporter.sendMail).not.toHaveBeenCalled();
+    });
+
+    it('is FAILED with a code when delivery throws', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: stored(validConfig) });
+      transporter.sendMail.mockRejectedValueOnce({ code: 'EAUTH' });
+      const result = await mailService.sendAssignmentEmail(assignmentArgs);
+      expect(result.status).toBe('FAILED');
+      expect(result.error).toBe('AUTHENTICATION_FAILED');
+    });
+
+    it('substitutes url/expiresAt and sends when enabled', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: stored(validConfig) });
+      const result = await mailService.sendAssignmentEmail({
+        ...assignmentArgs,
+        template: template('Link: {{url}} (expires {{expiresAt}})')
+      });
+      expect(result.status).toBe('SENT');
+      expect(result.message).toContain('Link: https://assign (expires ');
+    });
+
+    // Truncating to a bare UTC date shifts the day for anyone west of UTC.
+    it('renders the expiry with a time rather than a bare date', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: stored(validConfig) });
+      const result = await mailService.sendAssignmentEmail({
+        ...assignmentArgs,
+        template: template('{{url}} expires {{expiresAt}}')
+      });
+      expect(result.message).not.toContain('2026-01-01');
+      expect(result.message).toMatch(/\d{1,2}:\d{2}/);
+    });
+
+    it('renders the French body when language is fr', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: stored(validConfig) });
+      const result = await mailService.sendAssignmentEmail({
+        ...assignmentArgs,
+        language: 'fr',
+        template: { body: { en: 'Link {{url}}', fr: 'Lien {{url}}' }, subject: { en: 'Assignment', fr: 'Évaluation' } }
+      });
+      expect(result.status).toBe('SENT');
+      expect(result.message).toContain('Lien');
+      expect(transporter.sendMail.mock.lastCall?.[0]).toMatchObject({ subject: 'Évaluation' });
+    });
+
+    it('appends the link when the template body omits {{url}}', async () => {
+      setupStateModel.findFirst.mockResolvedValue({ mailConfig: stored(validConfig) });
+      const result = await mailService.sendAssignmentEmail({
+        ...assignmentArgs,
+        template: template('Please complete your assignment.'),
+        url: 'https://assign/xyz'
+      });
+      expect(result.status).toBe('SENT');
+      expect(result.message).toContain('https://assign/xyz');
+    });
+  });
+});
diff --git a/apps/api/src/mail/__tests__/mail.utils.spec.ts b/apps/api/src/mail/__tests__/mail.utils.spec.ts
new file mode 100644
index 000000000..556183423
--- /dev/null
+++ b/apps/api/src/mail/__tests__/mail.utils.spec.ts
@@ -0,0 +1,118 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  describeMailError,
+  encryptionToTransportFlags,
+  formatExpiryDate,
+  formatSender,
+  pickLocale,
+  renderTemplate
+} from '../mail.utils';
+
+describe('renderTemplate', () => {
+  it('substitutes known placeholders', () => {
+    expect(
+      renderTemplate('Hello {{firstName}}, your username is {{username}}', { firstName: 'Jane', username: 'jdoe' })
+    ).toBe('Hello Jane, your username is jdoe');
+  });
+
+  it('tolerates surrounding whitespace in the placeholder', () => {
+    expect(renderTemplate('{{ url }}', { url: 'https://x' })).toBe('https://x');
+  });
+
+  it('leaves unknown placeholders untouched', () => {
+    expect(renderTemplate('Hi {{missing}}', { name: 'x' })).toBe('Hi {{missing}}');
+  });
+});
+
+describe('pickLocale', () => {
+  it('returns the requested language', () => {
+    expect(pickLocale({ en: 'Hello', fr: 'Bonjour' }, 'fr')).toBe('Bonjour');
+    expect(pickLocale({ en: 'Hello', fr: 'Bonjour' }, 'en')).toBe('Hello');
+  });
+
+  it('falls back to the other language when the requested one is empty', () => {
+    expect(pickLocale({ en: 'Hello', fr: '' }, 'fr')).toBe('Hello');
+    expect(pickLocale({ en: '', fr: 'Bonjour' }, 'en')).toBe('Bonjour');
+  });
+});
+
+describe('formatExpiryDate', () => {
+  it('includes the time and zone rather than truncating to a UTC date', () => {
+    const formatted = formatExpiryDate('2026-08-01T02:00:00Z', 'en');
+    expect(formatted).not.toBe('2026-08-01');
+    expect(formatted).toMatch(/\d{1,2}:\d{2}/);
+  });
+
+  it('renders in the requested language', () => {
+    const date = '2026-08-01T12:00:00Z';
+    expect(formatExpiryDate(date, 'fr')).not.toBe(formatExpiryDate(date, 'en'));
+  });
+});
+
+describe('formatSender', () => {
+  it('uses just the address when no name is set', () => {
+    expect(formatSender({ senderAddress: 'a@b.org', senderName: null })).toBe('a@b.org');
+  });
+
+  it('quotes the name when present', () => {
+    expect(formatSender({ senderAddress: 'a@b.org', senderName: 'ODC' })).toBe('"ODC" <a@b.org>');
+  });
+
+  it('escapes double quotes and backslashes in the name', () => {
+    expect(formatSender({ senderAddress: 'a@b.org', senderName: 'Douglas "DNI" Lab' })).toBe(
+      '"Douglas \\"DNI\\" Lab" <a@b.org>'
+    );
+    expect(formatSender({ senderAddress: 'a@b.org', senderName: 'back\\slash' })).toBe('"back\\\\slash" <a@b.org>');
+  });
+});
+
+describe('encryptionToTransportFlags', () => {
+  it('maps ssl to implicit TLS', () => {
+    expect(encryptionToTransportFlags('ssl')).toEqual({ requireTLS: false, secure: true });
+  });
+
+  it('maps starttls to requireTLS', () => {
+    expect(encryptionToTransportFlags('starttls')).toEqual({ requireTLS: true, secure: false });
+  });
+
+  it('maps none to a plain connection', () => {
+    expect(encryptionToTransportFlags('none')).toEqual({ requireTLS: false, secure: false });
+  });
+});
+
+// A code, not prose: the server cannot know what language the admin reads.
+describe('describeMailError', () => {
+  it('maps auth failures', () => {
+    expect(describeMailError({ code: 'EAUTH' })).toBe('AUTHENTICATION_FAILED');
+  });
+
+  it('maps unknown host (by code or message)', () => {
+    expect(describeMailError({ code: 'ENOTFOUND' })).toBe('HOST_NOT_FOUND');
+    expect(describeMailError({ message: 'getaddrinfo ENOTFOUND smtp.bad' })).toBe('HOST_NOT_FOUND');
+  });
+
+  it('maps a refused connection', () => {
+    expect(describeMailError({ code: 'ECONNREFUSED' })).toBe('CONNECTION_REFUSED');
+  });
+
+  it('maps TLS/version mismatch to an encryption hint', () => {
+    expect(describeMailError({ code: 'ESOCKET' })).toBe('INSECURE_CONNECTION');
+    expect(describeMailError({ message: 'SSL routines:tls_validate_record_header:wrong version number' })).toBe(
+      'INSECURE_CONNECTION'
+    );
+  });
+
+  it('maps a rejected sender address', () => {
+    expect(describeMailError({ code: 'EENVELOPE' })).toBe('SENDER_REJECTED');
+  });
+
+  it('collapses timeouts to UNKNOWN', () => {
+    expect(describeMailError({ code: 'ETIMEDOUT', message: 'Connection timeout' })).toBe('UNKNOWN');
+  });
+
+  it('never leaks a raw error, returning only a known code', () => {
+    expect(describeMailError(new Error('0FC2C9C667C0000:error:0A00010B:SSL routines'))).not.toContain('0FC2C9');
+    expect(describeMailError('something weird')).toBe('UNKNOWN');
+  });
+});
diff --git a/apps/api/src/mail/dto/test-mail.dto.ts b/apps/api/src/mail/dto/test-mail.dto.ts
new file mode 100644
index 000000000..89928fdc1
--- /dev/null
+++ b/apps/api/src/mail/dto/test-mail.dto.ts
@@ -0,0 +1,16 @@
+import { ValidationSchema } from '@douglasneuroinformatics/libnest';
+import { ApiProperty } from '@nestjs/swagger';
+import { $TestMailData } from '@opendatacapture/schemas/mail';
+import type { TestMailData, UpdateMailConfigData } from '@opendatacapture/schemas/mail';
+
+@ValidationSchema($TestMailData)
+export class TestMailDto implements TestMailData {
+  @ApiProperty({
+    description: 'The (possibly unsaved) configuration to test; omit to test the saved one',
+    required: false
+  })
+  config?: UpdateMailConfigData;
+
+  @ApiProperty({ description: 'If provided, a real test email is delivered to this address', required: false })
+  recipient?: string;
+}
diff --git a/apps/api/src/mail/dto/update-mail-settings.dto.ts b/apps/api/src/mail/dto/update-mail-settings.dto.ts
new file mode 100644
index 000000000..a570b09b2
--- /dev/null
+++ b/apps/api/src/mail/dto/update-mail-settings.dto.ts
@@ -0,0 +1,13 @@
+import { ValidationSchema } from '@douglasneuroinformatics/libnest';
+import { ApiProperty } from '@nestjs/swagger';
+import { $UpdateMailSettingsData } from '@opendatacapture/schemas/mail';
+import type { MailTemplate, UpdateMailConfigData, UpdateMailSettingsData } from '@opendatacapture/schemas/mail';
+
+@ValidationSchema($UpdateMailSettingsData)
+export class UpdateMailSettingsDto implements UpdateMailSettingsData {
+  @ApiProperty({ required: false })
+  config?: UpdateMailConfigData;
+
+  @ApiProperty({ required: false })
+  newUserEmailTemplate?: MailTemplate;
+}
diff --git a/apps/api/src/mail/mail.controller.ts b/apps/api/src/mail/mail.controller.ts
new file mode 100644
index 000000000..45dc8e749
--- /dev/null
+++ b/apps/api/src/mail/mail.controller.ts
@@ -0,0 +1,39 @@
+import { Body, Controller, Get, Patch, Post } from '@nestjs/common';
+import { ApiOperation, ApiTags } from '@nestjs/swagger';
+import type { MailSettings, TestMailResult } from '@opendatacapture/schemas/mail';
+
+import { RouteAccess } from '@/core/decorators/route-access.decorator';
+
+import { TestMailDto } from './dto/test-mail.dto';
+import { UpdateMailSettingsDto } from './dto/update-mail-settings.dto';
+import { MailService } from './mail.service';
+
+@ApiTags('Mail')
+@Controller({ path: 'mail' })
+export class MailController {
+  constructor(private readonly mailService: MailService) {}
+
+  @ApiOperation({
+    description: 'Get the mail configuration (without the SMTP password) and templates',
+    summary: 'Get Mail Settings'
+  })
+  @Get('settings')
+  @RouteAccess({ action: 'manage', subject: 'all' })
+  getSettings(): Promise<MailSettings> {
+    return this.mailService.getSettings();
+  }
+
+  @ApiOperation({ description: 'Verify the SMTP connection and optionally send a test email', summary: 'Test Mail' })
+  @Post('test')
+  @RouteAccess({ action: 'manage', subject: 'all' })
+  test(@Body() data: TestMailDto): Promise<TestMailResult> {
+    return this.mailService.test(data);
+  }
+
+  @ApiOperation({ description: 'Update the mail configuration and/or templates', summary: 'Update Mail Settings' })
+  @Patch('settings')
+  @RouteAccess({ action: 'manage', subject: 'all' })
+  updateSettings(@Body() data: UpdateMailSettingsDto): Promise<MailSettings> {
+    return this.mailService.updateSettings(data);
+  }
+}
diff --git a/apps/api/src/mail/mail.module.ts b/apps/api/src/mail/mail.module.ts
new file mode 100644
index 000000000..6d58b5934
--- /dev/null
+++ b/apps/api/src/mail/mail.module.ts
@@ -0,0 +1,11 @@
+import { Module } from '@nestjs/common';
+
+import { MailController } from './mail.controller';
+import { MailService } from './mail.service';
+
+@Module({
+  controllers: [MailController],
+  exports: [MailService],
+  providers: [MailService]
+})
+export class MailModule {}
diff --git a/apps/api/src/mail/mail.service.ts b/apps/api/src/mail/mail.service.ts
new file mode 100644
index 000000000..4bf5d5295
--- /dev/null
+++ b/apps/api/src/mail/mail.service.ts
@@ -0,0 +1,310 @@
+import { ConfigService, InjectModel, LoggingService } from '@douglasneuroinformatics/libnest';
+import type { Model } from '@douglasneuroinformatics/libnest';
+import {
+  BadRequestException,
+  Injectable,
+  InternalServerErrorException,
+  ServiceUnavailableException
+} from '@nestjs/common';
+import type { Language } from '@opendatacapture/schemas/core';
+import {
+  $MailConfig,
+  DEFAULT_NEW_USER_EMAIL_TEMPLATE,
+  isMailEnabled,
+  isSameMailServer
+} from '@opendatacapture/schemas/mail';
+import type {
+  EmailDeliveryResult,
+  MailConfig,
+  MailSettings,
+  MailTemplate,
+  TestMailData,
+  TestMailResult,
+  UpdateMailConfigData,
+  UpdateMailSettingsData
+} from '@opendatacapture/schemas/mail';
+import type { SetupState } from '@prisma/client';
+import { createTransport } from 'nodemailer';
+import type { Transporter } from 'nodemailer';
+
+import { decryptSecret, encryptSecret } from '@/core/secret-cipher';
+
+import {
+  describeMailError,
+  encryptionToTransportFlags,
+  formatExpiryDate,
+  formatSender,
+  pickLocale,
+  renderTemplate
+} from './mail.utils';
+
+/** A message whose content is already rendered, ready to hand to a transporter. */
+type MailMessage = {
+  body: string;
+  subject: string;
+  to: string;
+};
+
+/** Everything the service reads off `SetupState`, validated and decrypted. */
+type MailState = {
+  config: MailConfig | null;
+  isEnabled: boolean;
+  newUserEmailTemplate: MailTemplate;
+};
+
+/**
+ * Handles all outgoing email for the application.
+ *
+ * Unlike libnest's `MailModule`, which binds a single transporter from static options at boot,
+ * the SMTP configuration here is owned by the admin and stored in the database (on
+ * `SetupState`). We therefore build a fresh nodemailer transporter from the current
+ * configuration whenever we send, so changes take effect without a restart and a "test
+ * connection" button can validate unsaved settings. We still reuse the same underlying library
+ * (nodemailer) that libnest depends on.
+ */
+@Injectable()
+export class MailService {
+  constructor(
+    @InjectModel('SetupState') private readonly setupStateModel: Model<'SetupState'>,
+    private readonly configService: ConfigService,
+    private readonly loggingService: LoggingService
+  ) {}
+
+  /** Admin-facing settings: the password is replaced by a `hasPassword` flag. */
+  async getSettings(): Promise<MailSettings> {
+    return this.toSettings(await this.readState());
+  }
+
+  /**
+   * Email a remote-assignment link to a participant, rendering the chosen template in the
+   * requested language.
+   */
+  async sendAssignmentEmail({
+    expiresAt,
+    language,
+    recipient,
+    template,
+    url
+  }: {
+    expiresAt: Date | number | string;
+    language: Language;
+    recipient: string;
+    template: MailTemplate;
+    url: string;
+  }): Promise<EmailDeliveryResult> {
+    const variables = { expiresAt: formatExpiryDate(expiresAt, language), url };
+    const rendered = renderTemplate(pickLocale(template.body, language), variables);
+    return this.deliver(await this.readState(), {
+      // The assignment link is the whole point of this email, so if a custom template omits the
+      // {{url}} placeholder we append the link rather than send a message the recipient can't act on.
+      message: rendered.includes(url) ? rendered : `${rendered}\n\n${url}`,
+      recipient,
+      subject: renderTemplate(pickLocale(template.subject, language), variables)
+    });
+  }
+
+  /** Build and send the welcome email for a newly created user, in the requested language. */
+  async sendNewUserEmail({
+    email,
+    firstName,
+    group,
+    language = 'en',
+    lastName,
+    url,
+    username
+  }: {
+    email?: null | string;
+    firstName: string;
+    group: string;
+    language?: Language;
+    lastName: string;
+    url: string;
+    username: string;
+  }): Promise<EmailDeliveryResult> {
+    const state = await this.readState();
+    const { body, subject } = state.newUserEmailTemplate;
+    const variables = { firstName, group, lastName, url, username };
+    return this.deliver(state, {
+      message: renderTemplate(pickLocale(body, language), variables),
+      recipient: email,
+      subject: renderTemplate(pickLocale(subject, language), variables)
+    });
+  }
+
+  /**
+   * Test the SMTP connection, optionally sending a real message to `recipient`. When `config` is
+   * supplied the (possibly unsaved) values are tested; otherwise the saved configuration is used.
+   */
+  async test({ config, recipient }: TestMailData): Promise<TestMailResult> {
+    const { config: saved } = await this.readState();
+    if (this.requiresNewPassword(config, saved)) {
+      // The client already blocks this, so a code the UI maps to "check your credentials" is enough.
+      return { error: 'AUTHENTICATION_FAILED', success: false };
+    }
+    const resolved = this.resolveConfig(config, saved);
+    if (!resolved) {
+      return { error: 'UNKNOWN', success: false };
+    }
+    try {
+      const transporter = this.createTransporter(resolved);
+      await transporter.verify();
+      if (recipient) {
+        await this.send(transporter, resolved, {
+          body: 'This is a test email from Open Data Capture. Your mail server is configured correctly.',
+          subject: 'Open Data Capture — test email',
+          to: recipient
+        });
+      }
+      return { success: true };
+    } catch (err) {
+      return { error: describeMailError(err), success: false };
+    }
+  }
+
+  /**
+   * Persist the mail configuration and/or new-user template. A blank/omitted `password`
+   * preserves the stored one so the secret never has to leave the server. Returns the
+   * admin-facing settings (password stripped).
+   */
+  async updateSettings(data: UpdateMailSettingsData): Promise<MailSettings> {
+    const setupState = await this.setupStateModel.findFirst();
+    if (!setupState?.isSetup) {
+      throw new ServiceUnavailableException('Cannot update mail settings before setup');
+    }
+    const { config: saved } = this.parseState(setupState);
+    if (this.requiresNewPassword(data.config, saved)) {
+      throw new BadRequestException('A password is required when changing the mail server');
+    }
+    const resolved = data.config ? this.resolveConfig(data.config, saved) : undefined;
+    const nextConfig = resolved ? { ...resolved, password: this.encryptPassword(resolved.password) } : undefined;
+    const updated = await this.setupStateModel.update({
+      data: {
+        ...(nextConfig ? { mailConfig: { set: nextConfig } } : {}),
+        ...(data.newUserEmailTemplate ? { newUserEmailTemplate: { set: data.newUserEmailTemplate } } : {})
+      },
+      where: { id: setupState.id }
+    });
+    return this.toSettings(this.parseState(updated));
+  }
+
+  private createTransporter(config: MailConfig): Transporter {
+    return createTransport({
+      auth: { pass: config.password, user: config.username },
+      // Fail fast (e.g. on a wrong port) so the API returns a clear error rather than
+      // hanging until the client request times out.
+      connectionTimeout: 15_000,
+      greetingTimeout: 15_000,
+      host: config.host,
+      port: config.port,
+      socketTimeout: 20_000,
+      ...encryptionToTransportFlags(config.encryption)
+    });
+  }
+
+  /** Reverse {@link encryptPassword}. Propagates, so a key rotation surfaces instead of muting mail. */
+  private decryptPassword(stored: string): string {
+    return stored ? decryptSecret(stored, this.configService.getOrThrow('SECRET_KEY')) : '';
+  }
+
+  /**
+   * Hand a rendered message to a transporter, collapsing every outcome into a delivery result.
+   * The message comes back whatever happens, so the UI can offer it for manual sending.
+   */
+  private async deliver(
+    { config, isEnabled }: MailState,
+    { message, recipient, subject }: { message: string; recipient?: null | string; subject: string }
+  ): Promise<EmailDeliveryResult> {
+    if (!isEnabled || !config) {
+      return { message, recipient, status: 'DISABLED' };
+    }
+    if (!recipient) {
+      return { message, recipient: null, status: 'NO_RECIPIENT' };
+    }
+    try {
+      await this.send(this.createTransporter(config), config, { body: message, subject, to: recipient });
+      return { message, recipient, status: 'SENT' };
+    } catch (err) {
+      this.loggingService.error(`Failed to send "${subject}" to ${recipient}: ${String(err)}`);
+      return { error: describeMailError(err), message, recipient, status: 'FAILED' };
+    }
+  }
+
+  /** Encrypt the SMTP password so a database dump yields no working mail credential. */
+  private encryptPassword(plaintext: string): string {
+    return plaintext ? encryptSecret(plaintext, this.configService.getOrThrow('SECRET_KEY')) : '';
+  }
+
+  /**
+   * Validate and decrypt the two mail fields off a `SetupState` row.
+   *
+   * A stored configuration that no longer validates, or whose password no longer decrypts, is a
+   * hard failure rather than "not configured": treating it as the latter makes every send return
+   * `DISABLED` while the admin looks at a configured mail page, with nothing to explain it.
+   */
+  private parseState(setupState: null | Pick<SetupState, 'mailConfig' | 'newUserEmailTemplate'>): MailState {
+    const stored = setupState?.mailConfig;
+    // Validate so scalar columns (e.g. `encryption`) narrow from `string` to their literal unions.
+    const parsed = stored ? $MailConfig.safeParse(stored) : null;
+    if (parsed && !parsed.success) {
+      this.loggingService.error(`Stored mail configuration is invalid: ${parsed.error.message}`);
+      throw new InternalServerErrorException('The stored mail configuration is invalid');
+    }
+    const { body, subject } = setupState?.newUserEmailTemplate ?? {};
+    // Two empty objects are truthy, so check for actual content before preferring the stored one.
+    const hasStoredTemplate = Boolean(body && subject && pickLocale(body, 'en') && pickLocale(subject, 'en'));
+    return {
+      config: parsed?.success ? { ...parsed.data, password: this.decryptPassword(parsed.data.password) } : null,
+      isEnabled: isMailEnabled(stored),
+      newUserEmailTemplate:
+        hasStoredTemplate && body && subject ? { body, subject } : { ...DEFAULT_NEW_USER_EMAIL_TEMPLATE }
+    };
+  }
+
+  private async readState(): Promise<MailState> {
+    return this.parseState(await this.setupStateModel.findFirst());
+  }
+
+  /**
+   * Whether the caller has to supply a password rather than inheriting the stored one. Inheritance
+   * is confined to the server the password belongs to — see {@link isSameMailServer}.
+   */
+  private requiresNewPassword(partial: undefined | UpdateMailConfigData, saved: MailConfig | null): boolean {
+    if (!partial || partial.password) {
+      return false;
+    }
+    return !saved || !isSameMailServer(saved, partial);
+  }
+
+  /**
+   * Resolve a (possibly partial) update payload into a complete config. Callers reject the
+   * payload with {@link requiresNewPassword} first, which is what makes inheriting a blank
+   * password below safe.
+   */
+  private resolveConfig(partial: undefined | UpdateMailConfigData, saved: MailConfig | null): MailConfig | null {
+    if (!partial) {
+      return saved;
+    }
+    return {
+      enabled: partial.enabled,
+      encryption: partial.encryption,
+      host: partial.host,
+      password: partial.password ?? saved?.password ?? '',
+      port: partial.port,
+      senderAddress: partial.senderAddress,
+      senderName: partial.senderName ?? null,
+      username: partial.username
+    };
+  }
+
+  private async send(transporter: Transporter, config: MailConfig, { body, subject, to }: MailMessage): Promise<void> {
+    await transporter.sendMail({ from: formatSender(config), subject, text: body, to });
+  }
+
+  private toSettings({ config, newUserEmailTemplate }: MailState): MailSettings {
+    if (!config) {
+      return { config: null, newUserEmailTemplate };
+    }
+    const { password, ...rest } = config;
+    return { config: { ...rest, hasPassword: Boolean(password) }, newUserEmailTemplate };
+  }
+}
diff --git a/apps/api/src/mail/mail.utils.ts b/apps/api/src/mail/mail.utils.ts
new file mode 100644
index 000000000..9a6864765
--- /dev/null
+++ b/apps/api/src/mail/mail.utils.ts
@@ -0,0 +1,90 @@
+import type { Language, LocalizedString } from '@opendatacapture/schemas/core';
+import type { MailConfig, MailEncryption, MailErrorCode } from '@opendatacapture/schemas/mail';
+
+/**
+ * Substitute `{{key}}` placeholders in a template with the provided values.
+ * Unknown placeholders are left untouched so a malformed template degrades
+ * gracefully rather than throwing.
+ */
+export function renderTemplate(template: string, variables: { [key: string]: string }): string {
+  return template.replace(/\{\{\s*(\w+)\s*\}\}/g, (match, key: string) => {
+    return Object.prototype.hasOwnProperty.call(variables, key) ? variables[key]! : match;
+  });
+}
+
+/** Format the RFC 5322 "from" header from the configured sender name/address. */
+export function formatSender({ senderAddress, senderName }: Pick<MailConfig, 'senderAddress' | 'senderName'>): string {
+  if (!senderName) {
+    return senderAddress;
+  }
+  const escaped = senderName.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+  return `"${escaped}" <${senderAddress}>`;
+}
+
+/**
+ * Format an assignment's expiry for a recipient. Truncating to a bare UTC date shifts the day for
+ * anyone west of UTC — an assignment expiring at 02:00Z reads as the next day in Montréal, where
+ * it has in fact already expired — so the time and zone are rendered rather than dropped.
+ */
+export function formatExpiryDate(expiresAt: Date | number | string, language: Language): string {
+  // Explicit components rather than dateStyle/timeStyle, which cannot be combined with timeZoneName.
+  return new Intl.DateTimeFormat(language, {
+    day: 'numeric',
+    hour: 'numeric',
+    minute: '2-digit',
+    month: 'long',
+    timeZoneName: 'short',
+    year: 'numeric'
+  }).format(new Date(expiresAt));
+}
+
+/** Pick a language from a localized string, falling back to any available language when the requested one is empty. */
+export function pickLocale(localized: LocalizedString, language: Language): string {
+  // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing -- empty strings mean "no translation"; fall back intentionally
+  return localized[language] || Object.values(localized).find((v) => v) || '';
+}
+
+/**
+ * Classify a nodemailer/SMTP error — matching on the error code and, as a fallback, the message
+ * text (SMTP libraries are inconsistent about codes).
+ *
+ * Returns a {@link MailErrorCode} rather than prose: the server does not know what language the
+ * admin reads, so the client renders the message. The raw technical error is never surfaced, and
+ * anything unrecognized (including timeouts) collapses to `UNKNOWN`.
+ */
+export function describeMailError(err: unknown): MailErrorCode {
+  const e = (err ?? {}) as { code?: unknown; message?: unknown };
+  const code = typeof e.code === 'string' ? e.code : '';
+  const message = typeof e.message === 'string' ? e.message.toLowerCase() : '';
+  const matches = (codes: string[], pattern: RegExp) => codes.includes(code) || pattern.test(message);
+
+  if (matches(['EAUTH'], /invalid login|authentication failed|535|credentials|username and password/)) {
+    return 'AUTHENTICATION_FAILED';
+  }
+  if (matches(['EDNS', 'ENOTFOUND'], /getaddrinfo|enotfound|not be found|unknown host/)) {
+    return 'HOST_NOT_FOUND';
+  }
+  if (matches(['ECONNREFUSED'], /econnrefused|refused/)) {
+    return 'CONNECTION_REFUSED';
+  }
+  if (matches(['ESOCKET'], /wrong version number|ssl routines|tls|certificate|self[- ]signed|esocket/)) {
+    return 'INSECURE_CONNECTION';
+  }
+  if (matches(['EENVELOPE'], /envelope|sender address|from address|mail from/)) {
+    return 'SENDER_REJECTED';
+  }
+  return 'UNKNOWN';
+}
+
+/**
+ * Map our user-facing `encryption` choice onto the nodemailer transport flags.
+ * - `ssl`      → implicit TLS (`secure: true`, typically port 465)
+ * - `starttls` → upgrade a plain connection (`requireTLS: true`, typically port 587)
+ * - `none`     → plain connection (typically port 25)
+ */
+export function encryptionToTransportFlags(encryption: MailEncryption): { requireTLS: boolean; secure: boolean } {
+  return {
+    requireTLS: encryption === 'starttls',
+    secure: encryption === 'ssl'
+  };
+}
diff --git a/apps/api/src/main.ts b/apps/api/src/main.ts
index f7bb48b04..c2745450e 100644
--- a/apps/api/src/main.ts
+++ b/apps/api/src/main.ts
@@ -10,6 +10,7 @@ import { GroupsModule } from './groups/groups.module';
 import { InstrumentRecordsModule } from './instrument-records/instrument-records.module';
 import { InstrumentReposModule } from './instrument-repos/instrument-repos.module';
 import { InstrumentsModule } from './instruments/instruments.module';
+import { MailModule } from './mail/mail.module';
 import { SessionsModule } from './sessions/sessions.module';
 import { SetupModule } from './setup/setup.module';
 import { StorageModule } from './storage/storage.module';
@@ -35,7 +36,7 @@ export default AppFactory.create({
       url: 'https://www.apache.org/licenses/LICENSE-2.0'
     },
     path: '/',
-    tags: ['Authentication', 'Groups', 'Instruments', 'Instrument Records', 'Subjects', 'Users'],
+    tags: ['Authentication', 'Groups', 'Instruments', 'Instrument Records', 'Mail', 'Subjects', 'Users'],
     title: 'Open Data Capture'
   },
   envSchema: $Env,
@@ -46,6 +47,7 @@ export default AppFactory.create({
     InstrumentRecordsModule,
     InstrumentReposModule,
     InstrumentsModule,
+    MailModule,
     PrismaModule.forRootAsync({
       useClass: PrismaModuleOptionsFactory
     }),
diff --git a/apps/api/src/setup/setup.service.ts b/apps/api/src/setup/setup.service.ts
index a719710a5..a07298e0d 100644
--- a/apps/api/src/setup/setup.service.ts
+++ b/apps/api/src/setup/setup.service.ts
@@ -7,6 +7,7 @@ import {
   InternalServerErrorException,
   ServiceUnavailableException
 } from '@nestjs/common';
+import { isMailEnabled } from '@opendatacapture/schemas/mail';
 import { $BrandingConfig } from '@opendatacapture/schemas/setup';
 import type { CreateAdminData, InitAppOptions, SetupState, UpdateSetupStateData } from '@opendatacapture/schemas/setup';
 
@@ -56,6 +57,9 @@ export class SetupService {
       isDemo: Boolean(savedOptions?.isDemo),
       isExperimentalFeaturesEnabled: Boolean(savedOptions?.isExperimentalFeaturesEnabled),
       isGatewayEnabled: this.configService.get('GATEWAY_ENABLED'),
+      // Non-secret flag so the client can hide email UI when mail is off. The SMTP
+      // configuration itself is never exposed here (this is a public route).
+      isMailEnabled: isMailEnabled(savedOptions?.mailConfig),
       isSetup: Boolean(savedOptions?.isSetup),
       release: __RELEASE__,
       uptime: Math.round(process.uptime())
diff --git a/apps/api/src/users/__tests__/users.controller.spec.ts b/apps/api/src/users/__tests__/users.controller.spec.ts
new file mode 100644
index 000000000..41f49d322
--- /dev/null
+++ b/apps/api/src/users/__tests__/users.controller.spec.ts
@@ -0,0 +1,134 @@
+import { MockFactory } from '@douglasneuroinformatics/libnest/testing';
+import type { MockedInstance } from '@douglasneuroinformatics/libnest/testing';
+import { NotFoundException } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import { beforeEach, describe, expect, it } from 'vitest';
+
+import type { AppAbility } from '@/auth/auth.types';
+import { GroupsService } from '@/groups/groups.service';
+import { MailService } from '@/mail/mail.service';
+
+import { UsersController } from '../users.controller';
+import { UsersService } from '../users.service';
+
+const ability = {} as AppAbility;
+
+const createUserData = {
+  basePermissionLevel: 'STANDARD' as const,
+  email: 'jane@example.org',
+  firstName: 'Jane',
+  groupIds: ['group-1', 'group-2'],
+  lastName: 'Doe',
+  password: 'Password123',
+  username: 'jane.doe'
+};
+
+describe('UsersController', () => {
+  let usersController: UsersController;
+  let usersService: MockedInstance<UsersService>;
+  let groupsService: MockedInstance<GroupsService>;
+  let mailService: MockedInstance<MailService>;
+
+  beforeEach(async () => {
+    const moduleRef = await Test.createTestingModule({
+      controllers: [UsersController],
+      providers: [
+        MockFactory.createForService(UsersService),
+        MockFactory.createForService(GroupsService),
+        MockFactory.createForService(MailService)
+      ]
+    }).compile();
+    usersController = moduleRef.get(UsersController);
+    usersService = moduleRef.get(UsersService);
+    groupsService = moduleRef.get(GroupsService);
+    mailService = moduleRef.get(MailService);
+  });
+
+  it('should be defined', () => {
+    expect(usersController).toBeDefined();
+  });
+
+  describe('create', () => {
+    beforeEach(() => {
+      usersService.create.mockResolvedValue({ id: 'user-1', username: createUserData.username });
+      groupsService.findById.mockImplementation((id: string, _options?: unknown) =>
+        Promise.resolve({ id, name: `Name of ${id}` })
+      );
+      mailService.sendNewUserEmail.mockResolvedValue({
+        message: 'rendered',
+        recipient: createUserData.email,
+        status: 'SENT'
+      });
+    });
+
+    it('returns the created user together with the welcome email result', async () => {
+      await expect(usersController.create(createUserData, ability)).resolves.toMatchObject({
+        id: 'user-1',
+        welcomeEmail: { status: 'SENT' }
+      });
+    });
+
+    it('sends the welcome email with the login url derived from the request origin', async () => {
+      await usersController.create(createUserData, ability, 'https://odc.example.org');
+      expect(mailService.sendNewUserEmail.mock.lastCall?.[0]).toMatchObject({
+        email: createUserData.email,
+        url: 'https://odc.example.org/auth/login',
+        username: createUserData.username
+      });
+    });
+
+    it('never hands the password to the welcome email', async () => {
+      await usersController.create(createUserData, ability, 'https://odc.example.org');
+      expect(mailService.sendNewUserEmail.mock.lastCall?.[0]).not.toHaveProperty('password');
+    });
+
+    it('sends an empty url when the origin header is absent', async () => {
+      await usersController.create(createUserData, ability);
+      expect(mailService.sendNewUserEmail.mock.lastCall?.[0]).toMatchObject({ url: '' });
+    });
+
+    // The controller forwards whatever was asked for and leaves the default to the mail service.
+    it('passes the language query param through to sendNewUserEmail', async () => {
+      await usersController.create(createUserData, ability);
+      expect(mailService.sendNewUserEmail.mock.lastCall?.[0]).toMatchObject({ language: undefined });
+      await usersController.create(createUserData, ability, undefined, 'fr');
+      expect(mailService.sendNewUserEmail.mock.lastCall?.[0]).toMatchObject({ language: 'fr' });
+    });
+
+    it('joins the names of the resolved groups', async () => {
+      await usersController.create(createUserData, ability);
+      expect(mailService.sendNewUserEmail.mock.lastCall?.[0]).toMatchObject({
+        group: 'Name of group-1, Name of group-2'
+      });
+    });
+
+    // Without this, dropping `{ ability }` from the service calls would leave every other test
+    // green while the lookups silently read across every group.
+    it('scopes both the create and the group lookups to the caller ability', async () => {
+      await usersController.create(createUserData, ability);
+      expect(usersService.create).toHaveBeenCalledWith(createUserData, { ability });
+      expect(groupsService.findById).toHaveBeenCalledWith('group-1', { ability });
+      expect(groupsService.findById).toHaveBeenCalledWith('group-2', { ability });
+    });
+
+    it('omits groups the creator cannot read', async () => {
+      groupsService.findById.mockImplementation((id: string) =>
+        id === 'group-1' ? Promise.reject(new NotFoundException()) : Promise.resolve({ id, name: `Name of ${id}` })
+      );
+      await usersController.create(createUserData, ability);
+      expect(mailService.sendNewUserEmail.mock.lastCall?.[0]).toMatchObject({ group: 'Name of group-2' });
+    });
+
+    it('propagates a group lookup failure that is not a permission denial', async () => {
+      groupsService.findById.mockRejectedValue(new Error('connection lost'));
+      await expect(usersController.create(createUserData, ability)).rejects.toThrow('connection lost');
+      expect(mailService.sendNewUserEmail).not.toHaveBeenCalled();
+    });
+
+    it('passes an empty group name when the user has no groups', async () => {
+      await usersController.create({ ...createUserData, groupIds: [] }, ability);
+      expect(groupsService.findById).not.toHaveBeenCalled();
+      expect(mailService.sendNewUserEmail.mock.lastCall?.[0]).toMatchObject({ group: '' });
+    });
+  });
+});
diff --git a/apps/api/src/users/users.controller.ts b/apps/api/src/users/users.controller.ts
index 730980550..5ca5bab65 100644
--- a/apps/api/src/users/users.controller.ts
+++ b/apps/api/src/users/users.controller.ts
@@ -1,11 +1,15 @@
-import { CurrentUser } from '@douglasneuroinformatics/libnest';
+import { CurrentUser, ParseSchemaPipe } from '@douglasneuroinformatics/libnest';
 import type { RequestUser } from '@douglasneuroinformatics/libnest';
-import { Body, Controller, Delete, Get, Param, Patch, Post, Query } from '@nestjs/common';
+import { Body, Controller, Delete, Get, Headers, NotFoundException, Param, Patch, Post, Query } from '@nestjs/common';
 import { ApiOperation, ApiTags } from '@nestjs/swagger';
+import { $Language } from '@opendatacapture/schemas/core';
+import type { Language } from '@opendatacapture/schemas/core';
 import { $SelfUpdateUserData } from '@opendatacapture/schemas/user';
 
 import type { AppAbility } from '@/auth/auth.types';
 import { RouteAccess } from '@/core/decorators/route-access.decorator';
+import { GroupsService } from '@/groups/groups.service';
+import { MailService } from '@/mail/mail.service';
 
 import { CreateUserDto } from './dto/create-user.dto';
 import { UpdateUserDto } from './dto/update-user.dto';
@@ -14,7 +18,11 @@ import { UsersService } from './users.service';
 @ApiTags('Users')
 @Controller({ path: 'users' })
 export class UsersController {
-  constructor(private readonly usersService: UsersService) {}
+  constructor(
+    private readonly usersService: UsersService,
+    private readonly groupsService: GroupsService,
+    private readonly mailService: MailService
+  ) {}
 
   @ApiOperation({ summary: 'Get User by Username' })
   @Get('/check-username/:username')
@@ -26,8 +34,26 @@ export class UsersController {
   @ApiOperation({ summary: 'Create User' })
   @Post()
   @RouteAccess({ action: 'create', subject: 'User' })
-  create(@Body() user: CreateUserDto, @CurrentUser('ability') ability: AppAbility) {
-    return this.usersService.create(user, { ability });
+  async create(
+    @Body() user: CreateUserDto,
+    @CurrentUser('ability') ability: AppAbility,
+    @Headers('origin') origin?: string,
+    @Query('language', new ParseSchemaPipe({ schema: $Language.optional() })) language?: Language
+  ) {
+    const created = await this.usersService.create(user, { ability });
+    // Attempt to send the welcome email. The result is always returned (even when
+    // mail is disabled or the user has no email) so the client can fall back to a
+    // copy-pasteable message; the client ignores it entirely when mail is off.
+    const welcomeEmail = await this.mailService.sendNewUserEmail({
+      email: user.email,
+      firstName: user.firstName,
+      group: await this.resolveGroupNames(user.groupIds, ability),
+      language,
+      lastName: user.lastName,
+      url: origin ? `${origin}/auth/login` : '',
+      username: user.username
+    });
+    return { ...created, welcomeEmail };
   }
 
   @ApiOperation({ summary: 'Delete User' })
@@ -69,4 +95,29 @@ export class UsersController {
   ) {
     return this.usersService.updateSelfById(id, update, currentUser);
   }
+
+  /**
+   * Resolve accessible group names for the welcome-email `{{group}}` variable. A group the
+   * creator cannot read is omitted from the list; every other failure propagates, so a database
+   * fault surfaces instead of silently rendering an email with no groups in it.
+   */
+  private async resolveGroupNames(groupIds: string[], ability: AppAbility): Promise<string> {
+    if (!groupIds.length) {
+      return '';
+    }
+    const groups = await Promise.all(
+      groupIds.map((id) =>
+        this.groupsService.findById(id, { ability }).catch((err) => {
+          if (err instanceof NotFoundException) {
+            return null;
+          }
+          throw err;
+        })
+      )
+    );
+    return groups
+      .filter((group): group is NonNullable<typeof group> => group !== null)
+      .map((group) => group.name)
+      .join(', ');
+  }
 }
diff --git a/apps/api/src/users/users.module.ts b/apps/api/src/users/users.module.ts
index 9c4f894be..ca53f69da 100644
--- a/apps/api/src/users/users.module.ts
+++ b/apps/api/src/users/users.module.ts
@@ -1,6 +1,7 @@
 import { Module } from '@nestjs/common';
 
 import { GroupsModule } from '@/groups/groups.module';
+import { MailModule } from '@/mail/mail.module';
 
 import { UsersController } from './users.controller';
 import { UsersService } from './users.service';
@@ -8,7 +9,7 @@ import { UsersService } from './users.service';
 @Module({
   controllers: [UsersController],
   exports: [UsersService],
-  imports: [GroupsModule],
+  imports: [GroupsModule, MailModule],
   providers: [UsersService]
 })
 export class UsersModule {}
diff --git a/apps/web/src/__tests__/assignment-email-form.test.tsx b/apps/web/src/__tests__/assignment-email-form.test.tsx
new file mode 100644
index 000000000..f46933911
--- /dev/null
+++ b/apps/web/src/__tests__/assignment-email-form.test.tsx
@@ -0,0 +1,106 @@
+import type { Assignment } from '@opendatacapture/schemas/assignment';
+import { cleanup, fireEvent, render, screen } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { AssignmentEmailForm } from '@/components/AssignmentEmailForm';
+
+import '@/services/i18n';
+
+const mocks = vi.hoisted(() => ({
+  isMailEnabled: true,
+  sendEmail: vi.fn(),
+  useGroupQuery: vi.fn()
+}));
+
+vi.mock('@/hooks/useGroupQuery', () => ({
+  GROUP_QUERY_KEY: 'group',
+  useGroupQuery: mocks.useGroupQuery
+}));
+
+vi.mock('@/hooks/useSetupStateQuery', () => ({
+  useSetupStateQuery: () => ({ data: { isMailEnabled: mocks.isMailEnabled } })
+}));
+
+vi.mock('@/hooks/useSendAssignmentEmailMutation', () => ({
+  useSendAssignmentEmailMutation: () => ({ isPending: false, mutate: mocks.sendEmail })
+}));
+
+const assignment = {
+  groupId: 'group-of-the-assignment',
+  id: 'assignment-1',
+  url: 'https://gateway.example.org/a/1'
+} as Assignment;
+
+const frenchOnlyTemplate = {
+  body: { fr: 'Lien {{url}}' },
+  id: 'tpl-fr',
+  name: 'Rappel',
+  subject: { fr: 'Objet' }
+};
+
+const submit = (recipient: string) => {
+  fireEvent.change(screen.getByTestId('assignment-email'), { target: { value: recipient } });
+  fireEvent.click(screen.getByTestId('assignment-email-submit'));
+};
+
+beforeEach(() => {
+  // There are no vitest setup files in this repo, so RTL never auto-unmounts between tests.
+  cleanup();
+  vi.clearAllMocks();
+  mocks.isMailEnabled = true;
+  mocks.useGroupQuery.mockReturnValue({ data: { activeAssignmentEmailTemplateId: null, emailTemplates: [] } });
+});
+
+describe('AssignmentEmailForm', () => {
+  // The server resolves the template from the assignment's own group; querying the currently
+  // selected group instead would offer templates the server will never consider.
+  it('queries the group the assignment belongs to', () => {
+    render(<AssignmentEmailForm assignment={assignment} />);
+    expect(mocks.useGroupQuery).toHaveBeenCalledWith('group-of-the-assignment');
+  });
+
+  it('renders nothing when mail is disabled', () => {
+    mocks.isMailEnabled = false;
+    render(<AssignmentEmailForm assignment={assignment} />);
+    expect(screen.queryByTestId('assignment-email-form')).toBeNull();
+  });
+
+  it('does not query a group when mail is disabled', () => {
+    mocks.isMailEnabled = false;
+    render(<AssignmentEmailForm assignment={assignment} />);
+    expect(mocks.useGroupQuery).toHaveBeenCalledWith(null);
+  });
+
+  it('sends the recipient and the built-in default template', () => {
+    render(<AssignmentEmailForm assignment={assignment} />);
+    submit('p@x.org');
+    expect(mocks.sendEmail.mock.lastCall?.[0]).toMatchObject({
+      assignmentId: 'assignment-1',
+      recipient: 'p@x.org',
+      templateId: null
+    });
+  });
+
+  // The dropdown is rebuilt from the selected template's languages on every render, so an
+  // initial 'en' must not survive into the request when only French is on offer.
+  it('posts a language the selected template is actually authored in', () => {
+    mocks.useGroupQuery.mockReturnValue({
+      data: { activeAssignmentEmailTemplateId: 'tpl-fr', emailTemplates: [frenchOnlyTemplate] }
+    });
+    render(<AssignmentEmailForm assignment={assignment} />);
+    submit('p@x.org');
+    expect(mocks.sendEmail.mock.lastCall?.[0]).toMatchObject({ language: 'fr', templateId: 'tpl-fr' });
+  });
+
+  it('restricts the language to those the instrument supports', () => {
+    render(<AssignmentEmailForm assignment={assignment} instrumentLanguages={['fr']} />);
+    submit('p@x.org');
+    expect(mocks.sendEmail.mock.lastCall?.[0]).toMatchObject({ language: 'fr' });
+  });
+
+  it('does not send without a recipient', () => {
+    render(<AssignmentEmailForm assignment={assignment} />);
+    fireEvent.click(screen.getByTestId('assignment-email-submit'));
+    expect(mocks.sendEmail).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/web/src/components/AssignmentEmailForm/AssignmentEmailForm.tsx b/apps/web/src/components/AssignmentEmailForm/AssignmentEmailForm.tsx
new file mode 100644
index 000000000..053afb65e
--- /dev/null
+++ b/apps/web/src/components/AssignmentEmailForm/AssignmentEmailForm.tsx
@@ -0,0 +1,186 @@
+import React, { useState } from 'react';
+
+import { Button, Input, Label, Select, Tooltip } from '@douglasneuroinformatics/libui/components';
+import { useNotificationsStore, useTranslation } from '@douglasneuroinformatics/libui/hooks';
+import type { Assignment } from '@opendatacapture/schemas/assignment';
+import type { Language } from '@opendatacapture/schemas/core';
+import { DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE } from '@opendatacapture/schemas/mail';
+import { CircleHelpIcon } from 'lucide-react';
+
+import { LanguageSelect } from '@/components/LanguageSelect';
+import { useGroupQuery } from '@/hooks/useGroupQuery';
+import { useMailErrorMessage } from '@/hooks/useMailErrorMessage';
+import { useSendAssignmentEmailMutation } from '@/hooks/useSendAssignmentEmailMutation';
+import { useSetupStateQuery } from '@/hooks/useSetupStateQuery';
+import { authoredLanguages, LANGUAGES } from '@/utils/language';
+
+const DEFAULT_TEMPLATE_OPTION = '__default__';
+
+export type AssignmentEmailFormProps = {
+  assignment: Assignment | null;
+  instrumentLanguages?: string[];
+};
+
+export const AssignmentEmailForm = ({ assignment, instrumentLanguages }: AssignmentEmailFormProps) => {
+  const { resolvedLanguage, t } = useTranslation();
+  const setupStateQuery = useSetupStateQuery();
+  const sendEmailMutation = useSendAssignmentEmailMutation();
+  const addNotification = useNotificationsStore((store) => store.addNotification);
+  const mailErrorMessage = useMailErrorMessage();
+  const [recipient, setRecipient] = useState('');
+  const [languageChoice, setLanguageChoice] = useState<Language>(resolvedLanguage);
+  const [templateChoice, setTemplateChoice] = useState<null | string>(null);
+  const [feedback, setFeedback] = useState<null | { message: string; tone: 'error' | 'success' }>(null);
+
+  // The server resolves the template from the assignment's own group, so this must query that
+  // group rather than whichever one is currently selected in the app store — on the datahub they
+  // can differ, and the two would then disagree about which templates exist.
+  const groupQuery = useGroupQuery(setupStateQuery.data.isMailEnabled ? assignment?.groupId : null);
+
+  const templates = groupQuery.data?.emailTemplates ?? [];
+  const activeValue = groupQuery.data?.activeAssignmentEmailTemplateId ?? DEFAULT_TEMPLATE_OPTION;
+  const selectedTemplate = templateChoice ?? activeValue;
+  const templateOptions = [
+    { label: t({ en: 'Built-in default', fr: 'Modèle par défaut' }), value: DEFAULT_TEMPLATE_OPTION },
+    ...templates.map((template) => ({ label: template.name, value: template.id }))
+  ].sort((a, b) => (a.value === activeValue ? -1 : b.value === activeValue ? 1 : 0));
+
+  const selectedBody =
+    selectedTemplate === DEFAULT_TEMPLATE_OPTION
+      ? DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE.body
+      : templates.find((template) => template.id === selectedTemplate)?.body;
+
+  const authored = authoredLanguages(selectedBody);
+  const templateLanguages = authored.length > 0 ? authored : LANGUAGES;
+  const languageOptions = instrumentLanguages
+    ? templateLanguages.filter((code) => instrumentLanguages.includes(code))
+    : templateLanguages;
+  // Clamp to what is actually offered: switching to a template authored in one language must not
+  // leave the trigger showing a value with no matching item while a different one is posted.
+  const language = languageOptions.includes(languageChoice) ? languageChoice : (languageOptions[0] ?? 'en');
+
+  const sendEmail = () => {
+    if (!assignment || !recipient) {
+      return;
+    }
+    setFeedback(null);
+    const fail = (message: string) => {
+      setFeedback({ message, tone: 'error' });
+      addNotification({ message, title: t({ en: 'Email failed', fr: 'Échec du courriel' }), type: 'error' });
+    };
+    sendEmailMutation.mutate(
+      {
+        assignmentId: assignment.id,
+        language,
+        recipient,
+        templateId: selectedTemplate === DEFAULT_TEMPLATE_OPTION ? null : selectedTemplate
+      },
+      {
+        onError: () => fail(t({ en: 'The email could not be sent', fr: "Le courriel n'a pas pu être envoyé" })),
+        onSuccess: (result) => {
+          if (result.status !== 'SENT') {
+            fail(mailErrorMessage(result.error));
+            return;
+          }
+          const message = t(
+            { en: 'Assignment link sent to {}', fr: "Lien d'évaluation envoyé à {}" },
+            { args: [recipient] }
+          );
+          setFeedback({ message, tone: 'success' });
+          addNotification({ message, title: t({ en: 'Email sent', fr: 'Courriel envoyé' }), type: 'success' });
+          setRecipient('');
+        }
+      }
+    );
+  };
+
+  if (!setupStateQuery.data.isMailEnabled) {
+    return null;
+  }
+
+  return (
+    <div className="flex flex-col gap-2" data-testid="assignment-email-form">
+      {templates.length > 0 && (
+        <div className="flex flex-col gap-1.5">
+          <Label htmlFor="assignment-template">{t({ en: 'Email template', fr: 'Modèle de courriel' })}</Label>
+          <Select value={selectedTemplate} onValueChange={setTemplateChoice}>
+            <Select.Trigger className="w-full" data-testid="assignment-template" id="assignment-template">
+              <Select.Value />
+            </Select.Trigger>
+            <Select.Content>
+              {templateOptions.map((option) => (
+                <Select.Item key={option.value} value={option.value}>
+                  {option.label}
+                </Select.Item>
+              ))}
+            </Select.Content>
+          </Select>
+        </div>
+      )}
+      <div className="flex flex-col gap-1.5">
+        <div className="flex items-center gap-1.5">
+          <Label htmlFor="assignment-language">{t({ en: 'Email language', fr: 'Langue du courriel' })}</Label>
+          <Tooltip>
+            <Tooltip.Trigger className="p-0 hover:bg-transparent" size="icon" variant="ghost">
+              <CircleHelpIcon className="text-muted-foreground h-4 w-4" />
+            </Tooltip.Trigger>
+            <Tooltip.Content className="max-w-xs">
+              <p>
+                {/* Only the email is localized: the gateway does not read the link's `lang` param. */}
+                {t({
+                  en: 'The email is sent in the selected language when the template has been written in it. Participants choose their own language when they open the assignment.',
+                  fr: "Le courriel est envoyé dans la langue sélectionnée lorsque le modèle a été rédigé dans celle-ci. Les participants choisissent leur propre langue à l'ouverture de l'évaluation."
+                })}
+              </p>
+            </Tooltip.Content>
+          </Tooltip>
+        </div>
+        <LanguageSelect
+          data-testid="assignment-language"
+          id="assignment-language"
+          options={languageOptions}
+          value={language}
+          onChange={setLanguageChoice}
+        />
+      </div>
+      <Label htmlFor="assignment-email">
+        {t({ en: 'Email link to participant', fr: 'Envoyer le lien au participant par courriel' })}
+      </Label>
+      <div className="flex gap-2">
+        <Input
+          className="h-9"
+          data-testid="assignment-email"
+          id="assignment-email"
+          placeholder={t({ en: 'recipient@example.org', fr: 'destinataire@exemple.org' })}
+          type="email"
+          value={recipient}
+          onChange={(event) => setRecipient(event.target.value)}
+        />
+        <Button
+          className="whitespace-nowrap"
+          data-testid="assignment-email-submit"
+          // While the group query is in flight `selectedTemplate` reads as the built-in default,
+          // and posting that is indistinguishable from deliberately choosing it. `isLoading`
+          // rather than `isPending`: a disabled query (an assignment with no group) stays pending
+          // forever and would leave the button permanently dead.
+          disabled={!recipient || sendEmailMutation.isPending || groupQuery.isLoading}
+          type="button"
+          variant="primary"
+          onClick={sendEmail}
+        >
+          {sendEmailMutation.isPending
+            ? t({ en: 'Sending…', fr: 'Envoi en cours…' })
+            : t({ en: 'Email assignment', fr: 'Envoyer par courriel' })}
+        </Button>
+      </div>
+      {feedback && (
+        <p
+          className={feedback.tone === 'error' ? 'text-destructive text-xs font-medium' : 'text-xs font-medium'}
+          data-testid="assignment-email-feedback"
+        >
+          {feedback.message}
+        </p>
+      )}
+    </div>
+  );
+};
diff --git a/apps/web/src/components/AssignmentEmailForm/index.ts b/apps/web/src/components/AssignmentEmailForm/index.ts
new file mode 100644
index 000000000..ce648e834
--- /dev/null
+++ b/apps/web/src/components/AssignmentEmailForm/index.ts
@@ -0,0 +1 @@
+export * from './AssignmentEmailForm';
diff --git a/apps/web/src/components/EmailTemplateEditor/EmailTemplateEditor.tsx b/apps/web/src/components/EmailTemplateEditor/EmailTemplateEditor.tsx
new file mode 100644
index 000000000..58cbeb74c
--- /dev/null
+++ b/apps/web/src/components/EmailTemplateEditor/EmailTemplateEditor.tsx
@@ -0,0 +1,126 @@
+import React from 'react';
+
+import { Button, Input, Label, TextArea } from '@douglasneuroinformatics/libui/components';
+import { useTranslation } from '@douglasneuroinformatics/libui/hooks';
+import type { Language } from '@opendatacapture/schemas/core';
+import type { MailTemplate } from '@opendatacapture/schemas/mail';
+
+import { LanguageSelect } from '@/components/LanguageSelect';
+
+export type EmailTemplateEditorProps = {
+  error?: string;
+  /** Namespaces the control ids and test ids, so two editors can coexist on one page. */
+  idPrefix: string;
+  onChange: (template: MailTemplate) => void;
+  readOnly?: boolean;
+  template: MailTemplate;
+  /** Placeholder names offered as insert buttons above the body. */
+  variables?: readonly string[];
+};
+
+/** Authors the per-language subject and body of an email template. */
+export const EmailTemplateEditor = ({
+  error,
+  idPrefix,
+  onChange,
+  readOnly = false,
+  template,
+  variables = []
+}: EmailTemplateEditorProps) => {
+  const { resolvedLanguage, t } = useTranslation();
+  const [language, setLanguage] = React.useState<Language>(resolvedLanguage);
+  // Where the caret was when the body last lost focus, so an inserted placeholder lands there
+  // rather than always at the end.
+  const bodyCursorRef = React.useRef<null | { end: number; start: number }>(null);
+
+  const body = template.body[language] ?? '';
+  const subject = template.subject[language] ?? '';
+
+  const insertVariable = (variable: string) => {
+    const tag = `{{${variable}}}`;
+    const cursor = bodyCursorRef.current;
+    if (cursor === null) {
+      onChange({ ...template, body: { ...template.body, [language]: body ? `${body} ${tag}` : tag } });
+      return;
+    }
+    bodyCursorRef.current = { end: cursor.start + tag.length, start: cursor.start + tag.length };
+    onChange({
+      ...template,
+      body: { ...template.body, [language]: body.slice(0, cursor.start) + tag + body.slice(cursor.end) }
+    });
+  };
+
+  return (
+    <div className="flex flex-col gap-4">
+      <div className="flex flex-col gap-1.5">
+        <Label htmlFor={`${idPrefix}-language`}>{t({ en: 'Language', fr: 'Langue' })}</Label>
+        <LanguageSelect
+          data-testid={`${idPrefix}-language`}
+          id={`${idPrefix}-language`}
+          value={language}
+          onChange={setLanguage}
+        />
+      </div>
+
+      <div className="flex flex-col gap-1.5">
+        <Label htmlFor={`${idPrefix}-subject`}>{t({ en: 'Subject', fr: 'Objet' })}</Label>
+        <Input
+          data-testid={`${idPrefix}-subject`}
+          id={`${idPrefix}-subject`}
+          readOnly={readOnly}
+          value={subject}
+          onChange={(event) =>
+            onChange({ ...template, subject: { ...template.subject, [language]: event.target.value } })
+          }
+        />
+      </div>
+
+      <div className="flex flex-col gap-1.5">
+        <div className="flex flex-wrap items-center justify-between gap-2">
+          <Label htmlFor={`${idPrefix}-body`}>{t({ en: 'Body', fr: 'Corps' })}</Label>
+          {!readOnly && variables.length > 0 && (
+            <div className="flex flex-wrap items-center gap-1.5">
+              <span className="text-muted-foreground text-xs">{t({ en: 'Insert:', fr: 'Insérer :' })}</span>
+              {variables.map((variable) => {
+                // Placeholder syntax, not copy — it must render verbatim in every language.
+                const tag = `{{${variable}}}`;
+                return (
+                  <Button
+                    className="h-6 px-2 font-mono text-xs"
+                    data-testid={`${idPrefix}-insert-${variable}`}
+                    key={variable}
+                    size="sm"
+                    type="button"
+                    variant="outline"
+                    onClick={() => insertVariable(variable)}
+                  >
+                    {tag}
+                  </Button>
+                );
+              })}
+            </div>
+          )}
+        </div>
+        <TextArea
+          className="min-h-[15rem]"
+          data-testid={`${idPrefix}-body`}
+          id={`${idPrefix}-body`}
+          readOnly={readOnly}
+          value={body}
+          onBlur={(event: React.FocusEvent<HTMLTextAreaElement>) => {
+            bodyCursorRef.current = {
+              end: event.currentTarget.selectionEnd,
+              start: event.currentTarget.selectionStart
+            };
+          }}
+          onChange={(event) => onChange({ ...template, body: { ...template.body, [language]: event.target.value } })}
+        />
+        {error && (
+          <p className="text-destructive text-xs font-medium" data-testid={`${idPrefix}-error`}>
+            {error}
+          </p>
+        )}
+      </div>
+    </div>
+  );
+};
diff --git a/apps/web/src/components/EmailTemplateEditor/index.ts b/apps/web/src/components/EmailTemplateEditor/index.ts
new file mode 100644
index 000000000..2e57b49fe
--- /dev/null
+++ b/apps/web/src/components/EmailTemplateEditor/index.ts
@@ -0,0 +1 @@
+export * from './EmailTemplateEditor';
diff --git a/apps/web/src/components/FormField/FormField.tsx b/apps/web/src/components/FormField/FormField.tsx
new file mode 100644
index 000000000..7906bdd4d
--- /dev/null
+++ b/apps/web/src/components/FormField/FormField.tsx
@@ -0,0 +1,25 @@
+import type React from 'react';
+
+import { Label } from '@douglasneuroinformatics/libui/components';
+
+export type FormFieldProps = {
+  children: React.ReactNode;
+  description?: string;
+  error?: string;
+  htmlFor: string;
+  label: string;
+};
+
+/** A labelled form control with optional help text and a validation message beneath it. */
+export const FormField = ({ children, description, error, htmlFor, label }: FormFieldProps) => (
+  <div className="flex flex-col gap-1.5">
+    <Label htmlFor={htmlFor}>{label}</Label>
+    {description && <p className="text-muted-foreground text-xs">{description}</p>}
+    {children}
+    {error && (
+      <p className="text-destructive text-xs font-medium" data-testid={`${htmlFor}-error`}>
+        {error}
+      </p>
+    )}
+  </div>
+);
diff --git a/apps/web/src/components/FormField/index.ts b/apps/web/src/components/FormField/index.ts
new file mode 100644
index 000000000..dfeb37488
--- /dev/null
+++ b/apps/web/src/components/FormField/index.ts
@@ -0,0 +1 @@
+export * from './FormField';
diff --git a/apps/web/src/components/GroupEmailTemplates/CreateTemplateForm.tsx b/apps/web/src/components/GroupEmailTemplates/CreateTemplateForm.tsx
new file mode 100644
index 000000000..704f18225
--- /dev/null
+++ b/apps/web/src/components/GroupEmailTemplates/CreateTemplateForm.tsx
@@ -0,0 +1,124 @@
+import React from 'react';
+
+import { Button, Dialog, Heading, Input, Label } from '@douglasneuroinformatics/libui/components';
+import { useNotificationsStore, useTranslation } from '@douglasneuroinformatics/libui/hooks';
+import type { MailTemplate } from '@opendatacapture/schemas/mail';
+
+import { EmailTemplateEditor } from '@/components/EmailTemplateEditor';
+import { ASSIGNMENT_TEMPLATE_VARS } from '@/utils/email-template';
+import { LANGUAGE_LABELS, LANGUAGES } from '@/utils/language';
+
+const emptyTemplate = (): MailTemplate => ({ body: {}, subject: {} });
+
+export type CreateTemplateFormProps = {
+  isPending: boolean;
+  /** Resolves true once the template is saved; the form clears only then. */
+  onCreate: (name: string, template: MailTemplate) => Promise<boolean>;
+  validateContent: (template: MailTemplate) => string | undefined;
+  validateName: (name: string) => string | undefined;
+};
+
+export const CreateTemplateForm = ({ isPending, onCreate, validateContent, validateName }: CreateTemplateFormProps) => {
+  const { t } = useTranslation();
+  const addNotification = useNotificationsStore((store) => store.addNotification);
+  const formRef = React.useRef<HTMLFormElement>(null);
+  const [name, setName] = React.useState('');
+  const [draft, setDraft] = React.useState<MailTemplate>(emptyTemplate);
+  const [isConfirmingMissingTranslations, setIsConfirmingMissingTranslations] = React.useState(false);
+
+  const contentError = validateContent(draft);
+  const missingLanguages = LANGUAGES.filter((code) => !draft.body[code]?.trim());
+
+  const create = async () => {
+    if (!(await onCreate(name.trim(), draft))) {
+      return;
+    }
+    setName('');
+    setDraft(emptyTemplate());
+    formRef.current?.scrollIntoView({ behavior: 'smooth' });
+  };
+
+  const handleSubmit = (event: React.FormEvent) => {
+    event.preventDefault();
+    const nameError = validateName(name);
+    if (nameError) {
+      addNotification({ message: nameError, type: 'error' });
+      return;
+    }
+    if (contentError) {
+      return;
+    }
+    if (missingLanguages.length > 0) {
+      setIsConfirmingMissingTranslations(true);
+      return;
+    }
+    void create();
+  };
+
+  return (
+    <React.Fragment>
+      <form
+        className="border-border flex flex-col gap-3 rounded-2xl border p-5"
+        data-testid="template-create-form"
+        ref={formRef}
+        onSubmit={handleSubmit}
+      >
+        <Heading variant="h5">{t({ en: 'New template', fr: 'Nouveau modèle' })}</Heading>
+        <div className="flex flex-col gap-1.5">
+          <Label htmlFor="template-name">{t({ en: 'Name', fr: 'Nom' })}</Label>
+          <Input
+            data-testid="template-name"
+            id="template-name"
+            value={name}
+            onChange={(event) => setName(event.target.value)}
+          />
+        </div>
+        <EmailTemplateEditor
+          error={contentError}
+          idPrefix="template-create"
+          template={draft}
+          variables={ASSIGNMENT_TEMPLATE_VARS}
+          onChange={setDraft}
+        />
+        <div>
+          <Button data-testid="template-create-submit" disabled={isPending || Boolean(contentError)} type="submit">
+            {t({ en: 'Add template', fr: 'Ajouter le modèle' })}
+          </Button>
+        </div>
+      </form>
+
+      <Dialog open={isConfirmingMissingTranslations} onOpenChange={setIsConfirmingMissingTranslations}>
+        <Dialog.Content className="max-w-md">
+          <Dialog.Header>
+            <Dialog.Title>{t({ en: 'Missing translations', fr: 'Traductions manquantes' })}</Dialog.Title>
+          </Dialog.Header>
+          <Dialog.Description>
+            {t(
+              {
+                en: 'Warning: This template is missing translations for: {}.',
+                fr: 'Attention : Ce modèle est sans traduction pour : {}.'
+              },
+              { args: [missingLanguages.map((code) => t(LANGUAGE_LABELS[code])).join(', ')] }
+            )}
+          </Dialog.Description>
+          <Dialog.Footer>
+            <Button type="button" variant="outline" onClick={() => setIsConfirmingMissingTranslations(false)}>
+              {t('core.cancel')}
+            </Button>
+            <Button
+              data-testid="template-create-anyway"
+              type="button"
+              variant="primary"
+              onClick={() => {
+                setIsConfirmingMissingTranslations(false);
+                void create();
+              }}
+            >
+              {t({ en: 'Add anyway', fr: 'Ajouter quand même' })}
+            </Button>
+          </Dialog.Footer>
+        </Dialog.Content>
+      </Dialog>
+    </React.Fragment>
+  );
+};
diff --git a/apps/web/src/components/GroupEmailTemplates/DeleteTemplateDialog.tsx b/apps/web/src/components/GroupEmailTemplates/DeleteTemplateDialog.tsx
new file mode 100644
index 000000000..4a941d0b9
--- /dev/null
+++ b/apps/web/src/components/GroupEmailTemplates/DeleteTemplateDialog.tsx
@@ -0,0 +1,47 @@
+import { Button, Dialog } from '@douglasneuroinformatics/libui/components';
+import { useTranslation } from '@douglasneuroinformatics/libui/hooks';
+import type { GroupEmailTemplate } from '@opendatacapture/schemas/group';
+
+export type DeleteTemplateDialogProps = {
+  isPending: boolean;
+  onConfirm: (template: GroupEmailTemplate) => void;
+  onOpenChange: (open: boolean) => void;
+  /** The template awaiting confirmation, or null when the dialog is closed. */
+  template: GroupEmailTemplate | null;
+};
+
+export const DeleteTemplateDialog = ({ isPending, onConfirm, onOpenChange, template }: DeleteTemplateDialogProps) => {
+  const { t } = useTranslation();
+  return (
+    <Dialog open={template !== null} onOpenChange={onOpenChange}>
+      <Dialog.Content className="max-w-md">
+        <Dialog.Header>
+          <Dialog.Title>{t({ en: 'Delete template', fr: 'Supprimer le modèle' })}</Dialog.Title>
+        </Dialog.Header>
+        <Dialog.Description>
+          {t(
+            {
+              en: 'Permanently delete "{}"? This cannot be undone.',
+              fr: 'Supprimer définitivement « {} » ? Cette action est irréversible.'
+            },
+            { args: [template?.name ?? ''] }
+          )}
+        </Dialog.Description>
+        <Dialog.Footer>
+          <Button type="button" variant="outline" onClick={() => onOpenChange(false)}>
+            {t('core.cancel')}
+          </Button>
+          <Button
+            data-testid="template-delete-confirm"
+            disabled={isPending}
+            type="button"
+            variant="danger"
+            onClick={() => template && onConfirm(template)}
+          >
+            {t('core.delete')}
+          </Button>
+        </Dialog.Footer>
+      </Dialog.Content>
+    </Dialog>
+  );
+};
diff --git a/apps/web/src/components/GroupEmailTemplates/EditTemplateDialog.tsx b/apps/web/src/components/GroupEmailTemplates/EditTemplateDialog.tsx
new file mode 100644
index 000000000..c897fb14a
--- /dev/null
+++ b/apps/web/src/components/GroupEmailTemplates/EditTemplateDialog.tsx
@@ -0,0 +1,118 @@
+import React from 'react';
+
+import { Button, Dialog, Input, Label } from '@douglasneuroinformatics/libui/components';
+import { useNotificationsStore, useTranslation } from '@douglasneuroinformatics/libui/hooks';
+import type { GroupEmailTemplate } from '@opendatacapture/schemas/group';
+import type { MailTemplate } from '@opendatacapture/schemas/mail';
+
+import { EmailTemplateEditor } from '@/components/EmailTemplateEditor';
+import { ASSIGNMENT_TEMPLATE_VARS } from '@/utils/email-template';
+
+type EditTemplateFormProps = {
+  isPending: boolean;
+  onCancel: () => void;
+  onSave: (template: GroupEmailTemplate) => void;
+  template: GroupEmailTemplate;
+  validateContent: (template: MailTemplate) => string | undefined;
+  validateName: (name: string) => string | undefined;
+};
+
+const EditTemplateForm = ({
+  isPending,
+  onCancel,
+  onSave,
+  template,
+  validateContent,
+  validateName
+}: EditTemplateFormProps) => {
+  const { t } = useTranslation();
+  const addNotification = useNotificationsStore((store) => store.addNotification);
+  const [name, setName] = React.useState(template.name);
+  const [draft, setDraft] = React.useState<MailTemplate>({
+    body: template.body ?? {},
+    subject: template.subject ?? {}
+  });
+
+  const contentError = validateContent(draft);
+
+  const handleSubmit = (event: React.FormEvent) => {
+    event.preventDefault();
+    const nameError = validateName(name);
+    if (nameError) {
+      addNotification({ message: nameError, type: 'error' });
+      return;
+    }
+    if (contentError) {
+      return;
+    }
+    onSave({ ...template, ...draft, name: name.trim() });
+  };
+
+  return (
+    <form className="flex flex-col gap-3" onSubmit={handleSubmit}>
+      <div className="flex flex-col gap-1.5">
+        <Label htmlFor="template-edit-name">{t({ en: 'Name', fr: 'Nom' })}</Label>
+        <Input
+          data-testid="template-edit-name"
+          id="template-edit-name"
+          value={name}
+          onChange={(event) => setName(event.target.value)}
+        />
+      </div>
+      <EmailTemplateEditor
+        error={contentError}
+        idPrefix="template-edit"
+        template={draft}
+        variables={ASSIGNMENT_TEMPLATE_VARS}
+        onChange={setDraft}
+      />
+      <Dialog.Footer>
+        <Button className="flex-1" type="button" variant="outline" onClick={onCancel}>
+          {t('core.cancel')}
+        </Button>
+        <Button
+          className="flex-1"
+          data-testid="template-edit-save"
+          disabled={isPending || Boolean(contentError)}
+          type="submit"
+        >
+          {t('core.save')}
+        </Button>
+      </Dialog.Footer>
+    </form>
+  );
+};
+
+export type EditTemplateDialogProps = {
+  isPending: boolean;
+  onOpenChange: (open: boolean) => void;
+  onSave: (template: GroupEmailTemplate) => void;
+  /** The template being edited, or null when the dialog is closed. */
+  template: GroupEmailTemplate | null;
+  validateContent: (template: MailTemplate) => string | undefined;
+  validateName: (name: string) => string | undefined;
+};
+
+export const EditTemplateDialog = ({ template, ...props }: EditTemplateDialogProps) => {
+  const { t } = useTranslation();
+  return (
+    <Dialog open={template !== null} onOpenChange={props.onOpenChange}>
+      <Dialog.Content className="max-w-lg">
+        <Dialog.Header>
+          <Dialog.Title>{t({ en: 'Edit template', fr: 'Modifier le modèle' })}</Dialog.Title>
+        </Dialog.Header>
+        {/* Mounted only while open, so the draft resets between templates. */}
+        {template && (
+          <EditTemplateForm
+            isPending={props.isPending}
+            template={template}
+            validateContent={props.validateContent}
+            validateName={props.validateName}
+            onCancel={() => props.onOpenChange(false)}
+            onSave={props.onSave}
+          />
+        )}
+      </Dialog.Content>
+    </Dialog>
+  );
+};
diff --git a/apps/web/src/components/GroupEmailTemplates/GroupEmailTemplates.tsx b/apps/web/src/components/GroupEmailTemplates/GroupEmailTemplates.tsx
new file mode 100644
index 000000000..24ed37ad0
--- /dev/null
+++ b/apps/web/src/components/GroupEmailTemplates/GroupEmailTemplates.tsx
@@ -0,0 +1,265 @@
+import React from 'react';
+
+import { Button, Heading } from '@douglasneuroinformatics/libui/components';
+import { useNotificationsStore, useTranslation } from '@douglasneuroinformatics/libui/hooks';
+import type { GroupEmailTemplate } from '@opendatacapture/schemas/group';
+import type { MailTemplate } from '@opendatacapture/schemas/mail';
+import { useQueryClient } from '@tanstack/react-query';
+import { isAxiosError } from 'axios';
+import { EyeIcon, PencilIcon, Trash2Icon } from 'lucide-react';
+
+import { groupQueryOptions, useGroupQuery } from '@/hooks/useGroupQuery';
+import { useUpdateGroupMutation } from '@/hooks/useUpdateGroupMutation';
+import { useAppStore } from '@/store';
+import { ASSIGNMENT_TEMPLATE_VARS, checkTemplateIssue } from '@/utils/email-template';
+import { authoredLanguages, omitBlankLanguages } from '@/utils/language';
+
+import { CreateTemplateForm } from './CreateTemplateForm';
+import { DeleteTemplateDialog } from './DeleteTemplateDialog';
+import { EditTemplateDialog } from './EditTemplateDialog';
+import { TemplateRow } from './TemplateRow';
+import { ViewDefaultTemplateDialog } from './ViewDefaultTemplateDialog';
+
+const EmptyState = ({ children }: { children: React.ReactNode }) => (
+  <div className="text-muted-foreground border-border rounded-md border border-dashed p-3 text-sm">{children}</div>
+);
+
+export const GroupEmailTemplates = () => {
+  const { t } = useTranslation();
+  const addNotification = useNotificationsStore((store) => store.addNotification);
+  const currentGroup = useAppStore((store) => store.currentGroup);
+  const groupId = currentGroup?.id;
+  const queryClient = useQueryClient();
+  // A conflict has to be recoverable in place, so it must not reach the router error boundary.
+  const updateGroupMutation = useUpdateGroupMutation({ successNotification: false, throwOnError: false });
+  const groupQuery = useGroupQuery(groupId);
+
+  const group = groupQuery.data;
+  const templates = group?.emailTemplates ?? [];
+  const activeId = group?.activeAssignmentEmailTemplateId ?? null;
+
+  const [editing, setEditing] = React.useState<GroupEmailTemplate | null>(null);
+  const [deleting, setDeleting] = React.useState<GroupEmailTemplate | null>(null);
+  const [isViewingDefault, setIsViewingDefault] = React.useState(false);
+
+  const validateContent = (template: MailTemplate): string | undefined => {
+    // Scope validation to the languages actually started, so a pristine form is not an error.
+    const issue = checkTemplateIssue(
+      template.subject,
+      template.body,
+      ASSIGNMENT_TEMPLATE_VARS,
+      authoredLanguages(template.body)
+    );
+    if (issue === 'incomplete') {
+      return t({
+        en: 'Fill in the subject and body in each language you have started.',
+        fr: "Remplissez l'objet et le corps dans chaque langue commencée."
+      });
+    }
+    if (issue === 'missing-vars') {
+      return t({
+        en: 'The body must include {{url}} and {{expiresAt}}.',
+        fr: 'Le corps doit inclure {{url}} et {{expiresAt}}.'
+      });
+    }
+    return undefined;
+  };
+
+  const validateName = (candidate: string, exceptId?: string): string | undefined => {
+    const trimmed = candidate.trim();
+    if (!trimmed) {
+      return t({ en: 'A name is required', fr: 'Un nom est requis' });
+    }
+    const isDuplicate = templates.some(
+      (template) => template.id !== exceptId && template.name.toLowerCase() === trimmed.toLowerCase()
+    );
+    return isDuplicate
+      ? t({ en: 'A template with this name already exists', fr: 'Un modèle avec ce nom existe déjà' })
+      : undefined;
+  };
+
+  /**
+   * Replace the group's whole template list. `expectedUpdatedAt` pins the revision this edit was
+   * composed against, so a concurrent edit by another manager is rejected rather than overwritten.
+   */
+  const persist = async (next: GroupEmailTemplate[], nextActiveId: null | string): Promise<boolean> => {
+    if (!group) {
+      return false;
+    }
+    try {
+      const updated = await updateGroupMutation.mutateAsync({
+        activeAssignmentEmailTemplateId: nextActiveId,
+        emailTemplates: next.map((template) => ({
+          ...template,
+          body: omitBlankLanguages(template.body),
+          subject: omitBlankLanguages(template.subject)
+        })),
+        expectedUpdatedAt: group.updatedAt
+      });
+      // Seed the cache from the response rather than invalidating. Every write moves `updatedAt`,
+      // so waiting on a refetch would leave the next edit composed against the previous revision —
+      // which the server then rejects as a conflict with this client's own change.
+      queryClient.setQueryData(groupQueryOptions(groupId).queryKey, updated);
+      addNotification({ type: 'success' });
+      return true;
+    } catch (err) {
+      const isConflict = isAxiosError(err) && err.response?.status === 409;
+      addNotification({
+        message: isConflict
+          ? t({
+              en: 'Someone else changed these templates while you were editing. Your changes were not saved — reload the page and try again.',
+              fr: "Quelqu'un d'autre a modifié ces modèles pendant votre édition. Vos modifications n'ont pas été enregistrées — rechargez la page et réessayez."
+            })
+          : t({
+              en: 'Your changes were not saved. Check your connection and try again.',
+              fr: "Vos modifications n'ont pas été enregistrées. Vérifiez votre connexion et réessayez."
+            }),
+        title: t({ en: 'Save failed', fr: "Échec de l'enregistrement" }),
+        type: 'error'
+      });
+      if (isConflict) {
+        await queryClient.invalidateQueries({ queryKey: groupQueryOptions(groupId).queryKey });
+      }
+      return false;
+    }
+  };
+
+  const handleCreate = (name: string, template: MailTemplate) =>
+    // Adding a template must not change what participants receive. The built-in default stays
+    // active until someone chooses otherwise with "Set default".
+    persist([...templates, { ...template, id: crypto.randomUUID(), name }], activeId);
+
+  const handleDelete = async (template: GroupEmailTemplate) => {
+    // Deleting the default falls back to the built-in message rather than promoting whichever
+    // template happens to sort first — nobody chose that one, and the change is invisible.
+    const wasActive = activeId === template.id;
+    const next = templates.filter((other) => other.id !== template.id);
+    if (!(await persist(next, wasActive ? null : activeId))) {
+      return;
+    }
+    setDeleting(null);
+    if (wasActive) {
+      addNotification({
+        message: t({
+          en: 'That was the default template, so the built-in message is now used.',
+          fr: 'Ce modèle était le modèle par défaut ; le message intégré est désormais utilisé.'
+        }),
+        type: 'info'
+      });
+    }
+  };
+
+  const handleEditSave = async (updated: GroupEmailTemplate) => {
+    const next = templates.map((template) => (template.id === updated.id ? updated : template));
+    if (await persist(next, activeId)) {
+      setEditing(null);
+    }
+  };
+
+  return (
+    <div className="mx-auto flex w-full max-w-3xl flex-col gap-6" data-testid="group-email-templates">
+      <div>
+        <Heading className="mb-2" variant="h4">
+          {t({ en: 'Remote Assignment Templates', fr: "Modèles d'évaluation à distance" })}
+        </Heading>
+        <p className="text-muted-foreground mb-3 text-sm">
+          {t({
+            en: 'Used when emailing a remote assignment link.',
+            fr: "Utilisés lors de l'envoi d'un lien d'évaluation à distance."
+          })}
+        </p>
+        <div className="flex flex-col gap-2">
+          <TemplateRow
+            actions={
+              <Button
+                aria-label={t({ en: 'View', fr: 'Voir' })}
+                data-testid="template-view-builtin"
+                size="icon"
+                type="button"
+                variant="outline"
+                onClick={() => setIsViewingDefault(true)}
+              >
+                <EyeIcon className="h-4 w-4" />
+              </Button>
+            }
+            isActive={activeId === null}
+            isPending={updateGroupMutation.isPending}
+            label={t({
+              en: 'Your Open Data Capture Assignment (built-in)',
+              fr: 'Votre évaluation Open Data Capture (intégré)'
+            })}
+            rowId="builtin"
+            onSetActive={() => void persist(templates, null)}
+          />
+          {templates.map((template) => (
+            <TemplateRow
+              actions={
+                <React.Fragment>
+                  <Button
+                    aria-label={t({ en: 'Edit', fr: 'Modifier' })}
+                    data-testid={`template-edit-${template.id}`}
+                    size="icon"
+                    type="button"
+                    variant="outline"
+                    onClick={() => setEditing(template)}
+                  >
+                    <PencilIcon className="h-4 w-4" />
+                  </Button>
+                  <Button
+                    aria-label={t('core.delete')}
+                    data-testid={`template-delete-${template.id}`}
+                    size="icon"
+                    type="button"
+                    variant="danger"
+                    onClick={() => setDeleting(template)}
+                  >
+                    <Trash2Icon className="h-4 w-4" />
+                  </Button>
+                </React.Fragment>
+              }
+              isActive={activeId === template.id}
+              isPending={updateGroupMutation.isPending}
+              key={template.id}
+              label={template.name}
+              rowId={template.id}
+              onSetActive={() => void persist(templates, template.id)}
+            />
+          ))}
+          {templates.length === 0 && (
+            <EmptyState>
+              {t({
+                en: 'No custom templates yet — create one below to override the built-in message.',
+                fr: 'Aucun modèle personnalisé — créez-en un ci-dessous pour remplacer le message intégré.'
+              })}
+            </EmptyState>
+          )}
+        </div>
+      </div>
+
+      <CreateTemplateForm
+        isPending={updateGroupMutation.isPending}
+        validateContent={validateContent}
+        validateName={(name) => validateName(name)}
+        onCreate={handleCreate}
+      />
+
+      <ViewDefaultTemplateDialog open={isViewingDefault} onOpenChange={setIsViewingDefault} />
+
+      <EditTemplateDialog
+        isPending={updateGroupMutation.isPending}
+        template={editing}
+        validateContent={validateContent}
+        validateName={(name) => validateName(name, editing?.id)}
+        onOpenChange={(open) => !open && setEditing(null)}
+        onSave={(updated) => void handleEditSave(updated)}
+      />
+
+      <DeleteTemplateDialog
+        isPending={updateGroupMutation.isPending}
+        template={deleting}
+        onConfirm={(template) => void handleDelete(template)}
+        onOpenChange={(open) => !open && setDeleting(null)}
+      />
+    </div>
+  );
+};
diff --git a/apps/web/src/components/GroupEmailTemplates/TemplateRow.tsx b/apps/web/src/components/GroupEmailTemplates/TemplateRow.tsx
new file mode 100644
index 000000000..5a185f769
--- /dev/null
+++ b/apps/web/src/components/GroupEmailTemplates/TemplateRow.tsx
@@ -0,0 +1,46 @@
+import type React from 'react';
+
+import { Button } from '@douglasneuroinformatics/libui/components';
+import { useTranslation } from '@douglasneuroinformatics/libui/hooks';
+
+export type TemplateRowProps = {
+  /** Row-level buttons (view, edit, delete) rendered before the default indicator. */
+  actions: React.ReactNode;
+  isActive: boolean;
+  isPending: boolean;
+  label: string;
+  onSetActive: () => void;
+  /** Namespaces this row's test ids; `builtin` for the built-in template, else its id. */
+  rowId: string;
+};
+
+/** One template in the list, with its actions and its "is the default" control. */
+export const TemplateRow = ({ actions, isActive, isPending, label, onSetActive, rowId }: TemplateRowProps) => {
+  const { t } = useTranslation();
+  return (
+    <div className="border-border flex flex-wrap items-center gap-2 rounded-md border p-2" data-testid="template-row">
+      <span className="flex-1 text-sm font-medium">{label}</span>
+      {actions}
+      {isActive ? (
+        <span
+          className="bg-primary text-primary-foreground w-28 rounded-md py-1.5 text-center text-sm font-medium"
+          data-testid={`template-active-${rowId}`}
+        >
+          {t({ en: 'Default', fr: 'Par défaut' })}
+        </span>
+      ) : (
+        <Button
+          className="w-28 justify-center"
+          data-testid={`template-set-active-${rowId}`}
+          disabled={isPending}
+          size="sm"
+          type="button"
+          variant="outline"
+          onClick={onSetActive}
+        >
+          {t({ en: 'Set default', fr: 'Définir par défaut' })}
+        </Button>
+      )}
+    </div>
+  );
+};
diff --git a/apps/web/src/components/GroupEmailTemplates/ViewDefaultTemplateDialog.tsx b/apps/web/src/components/GroupEmailTemplates/ViewDefaultTemplateDialog.tsx
new file mode 100644
index 000000000..2cf089b66
--- /dev/null
+++ b/apps/web/src/components/GroupEmailTemplates/ViewDefaultTemplateDialog.tsx
@@ -0,0 +1,41 @@
+import { Button, Dialog } from '@douglasneuroinformatics/libui/components';
+import { useTranslation } from '@douglasneuroinformatics/libui/hooks';
+import { DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE } from '@opendatacapture/schemas/mail';
+
+import { EmailTemplateEditor } from '@/components/EmailTemplateEditor';
+
+export type ViewDefaultTemplateDialogProps = {
+  onOpenChange: (open: boolean) => void;
+  open: boolean;
+};
+
+/** Read-only view of the message sent when no custom template is active. */
+export const ViewDefaultTemplateDialog = ({ onOpenChange, open }: ViewDefaultTemplateDialogProps) => {
+  const { t } = useTranslation();
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <Dialog.Content className="max-w-lg">
+        <Dialog.Header>
+          <Dialog.Title>{t({ en: 'Built-in default template', fr: 'Modèle par défaut intégré' })}</Dialog.Title>
+          <Dialog.Description>
+            {t({
+              en: 'This is the message sent for remote assignments when no custom template is active.',
+              fr: "Il s'agit du message envoyé pour les évaluations à distance lorsqu'aucun modèle personnalisé n'est actif."
+            })}
+          </Dialog.Description>
+        </Dialog.Header>
+        <EmailTemplateEditor
+          readOnly
+          idPrefix="template-builtin"
+          template={DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE}
+          onChange={() => undefined}
+        />
+        <Dialog.Footer>
+          <Button type="button" variant="outline" onClick={() => onOpenChange(false)}>
+            {t('core.close')}
+          </Button>
+        </Dialog.Footer>
+      </Dialog.Content>
+    </Dialog>
+  );
+};
diff --git a/apps/web/src/components/GroupEmailTemplates/index.ts b/apps/web/src/components/GroupEmailTemplates/index.ts
new file mode 100644
index 000000000..273681a98
--- /dev/null
+++ b/apps/web/src/components/GroupEmailTemplates/index.ts
@@ -0,0 +1 @@
+export * from './GroupEmailTemplates';
diff --git a/apps/web/src/components/LanguageSelect/LanguageSelect.tsx b/apps/web/src/components/LanguageSelect/LanguageSelect.tsx
new file mode 100644
index 000000000..9702a8983
--- /dev/null
+++ b/apps/web/src/components/LanguageSelect/LanguageSelect.tsx
@@ -0,0 +1,45 @@
+import { Select } from '@douglasneuroinformatics/libui/components';
+import { useTranslation } from '@douglasneuroinformatics/libui/hooks';
+import { cn } from '@douglasneuroinformatics/libui/utils';
+import { $Language } from '@opendatacapture/schemas/core';
+import type { Language } from '@opendatacapture/schemas/core';
+
+import { LANGUAGE_LABELS, LANGUAGES } from '@/utils/language';
+
+export type LanguageSelectProps = {
+  className?: string;
+  'data-testid'?: string;
+  id?: string;
+  onChange: (language: Language) => void;
+  /** The languages to offer; defaults to every language the application supports. */
+  options?: readonly Language[];
+  value: Language;
+};
+
+/** Picks the language a message is composed or sent in. */
+export const LanguageSelect = ({
+  className,
+  'data-testid': testId,
+  id,
+  onChange,
+  options = LANGUAGES,
+  value
+}: LanguageSelectProps) => {
+  const { t } = useTranslation();
+  return (
+    <Select value={value} onValueChange={(next) => onChange($Language.parse(next))}>
+      <Select.Trigger className={cn('w-[180px]', className)} data-testid={testId} id={id}>
+        <Select.Value />
+      </Select.Trigger>
+      <Select.Content>
+        <Select.Group>
+          {options.map((code) => (
+            <Select.Item key={code} value={code}>
+              {t(LANGUAGE_LABELS[code])}
+            </Select.Item>
+          ))}
+        </Select.Group>
+      </Select.Content>
+    </Select>
+  );
+};
diff --git a/apps/web/src/components/LanguageSelect/index.ts b/apps/web/src/components/LanguageSelect/index.ts
new file mode 100644
index 000000000..8319fa9a4
--- /dev/null
+++ b/apps/web/src/components/LanguageSelect/index.ts
@@ -0,0 +1 @@
+export * from './LanguageSelect';
diff --git a/apps/web/src/components/MailSettings/MailServerForm.tsx b/apps/web/src/components/MailSettings/MailServerForm.tsx
new file mode 100644
index 000000000..697ca9174
--- /dev/null
+++ b/apps/web/src/components/MailSettings/MailServerForm.tsx
@@ -0,0 +1,226 @@
+import { Button, Heading, Input, Select, Tooltip } from '@douglasneuroinformatics/libui/components';
+import { useTranslation } from '@douglasneuroinformatics/libui/hooks';
+import { $MailEncryption } from '@opendatacapture/schemas/mail';
+import type { MailEncryption } from '@opendatacapture/schemas/mail';
+import { CircleHelpIcon, Loader2Icon } from 'lucide-react';
+
+import { FormField } from '@/components/FormField';
+import { SectionCard } from '@/components/SectionCard';
+
+/** Standard SMTP submission ports per encryption mode, offered as the placeholder. */
+const PORT_DEFAULTS = {
+  none: '25',
+  ssl: '465',
+  starttls: '587'
+} as const satisfies { [K in MailEncryption]: string };
+
+/**
+ * The SMTP form's live values. Ports and secrets are held as strings because an in-progress
+ * field is not yet a number and the stored password is shown masked — {@link MailSettings}
+ * converts and validates them on save.
+ */
+export type MailConfigFormValues = {
+  enabled: boolean;
+  encryption: MailEncryption;
+  host: string;
+  password: string;
+  port: string;
+  senderAddress: string;
+  senderName: string;
+  username: string;
+};
+
+export type MailConfigFieldErrors = { [K in keyof MailConfigFormValues]?: string };
+
+export type MailServerFormProps = {
+  errors: MailConfigFieldErrors;
+  hasStoredPassword: boolean;
+  isSaving: boolean;
+  onChange: <K extends keyof MailConfigFormValues>(key: K, value: MailConfigFormValues[K]) => void;
+  onSave: () => void;
+  values: MailConfigFormValues;
+};
+
+export const MailServerForm = ({
+  errors,
+  hasStoredPassword,
+  isSaving,
+  onChange,
+  onSave,
+  values
+}: MailServerFormProps) => {
+  const { t } = useTranslation();
+
+  return (
+    <SectionCard data-testid="mail-server-card">
+      <Heading className="mb-1" variant="h4">
+        {t({ en: 'Mail Server Configuration', fr: 'Configuration du serveur de courriel' })}
+      </Heading>
+      <p className="text-muted-foreground mb-4 text-sm">
+        {t({
+          en: 'Outgoing email is sent over an SMTP connection.',
+          fr: "L'envoi de courriels se fait via une connexion SMTP."
+        })}
+      </p>
+      {/* new-password on the secret keeps the browser from autofilling the admin's own login */}
+      <div className="flex flex-col gap-4">
+        <FormField error={errors.host} htmlFor="mail-host" label={t({ en: 'Host', fr: 'Hôte' })}>
+          <Input
+            autoComplete="off"
+            data-testid="mail-host"
+            id="mail-host"
+            name="odc-smtp-host"
+            placeholder="smtp.example.org"
+            value={values.host}
+            onChange={(event) => onChange('host', event.target.value)}
+          />
+        </FormField>
+
+        <div className="flex flex-col gap-1.5">
+          <div className="flex items-center gap-1.5">
+            <label className="text-sm font-medium" htmlFor="mail-encryption">
+              {t({ en: 'Encryption', fr: 'Chiffrement' })}
+            </label>
+            <Tooltip>
+              <Tooltip.Trigger
+                aria-label={t({ en: 'About encryption options', fr: 'À propos des options de chiffrement' })}
+                className="text-muted-foreground h-5 w-5 rounded-full p-0"
+                size="icon"
+                type="button"
+                variant="ghost"
+              >
+                <CircleHelpIcon className="h-4 w-4" />
+              </Tooltip.Trigger>
+              <Tooltip.Content className="flex max-w-xs flex-col gap-2 text-xs leading-relaxed">
+                <span>
+                  {t({
+                    en: 'STARTTLS (default port 587) is the modern default and recommended for most setups — it upgrades a plain connection to an encrypted one and has the best compatibility.',
+                    fr: 'STARTTLS (port par défaut 587) est la valeur par défaut moderne et recommandée — elle convertit une connexion en clair en connexion chiffrée et offre la meilleure compatibilité.'
+                  })}
+                </span>
+                <span>
+                  {t({
+                    en: 'SSL/TLS (default port 465) is encrypted from the start, used by some providers and legacy systems. If unsure, choose STARTTLS.',
+                    fr: 'SSL/TLS (port par défaut 465) est chiffré dès le départ, utilisé par certains fournisseurs et systèmes hérités. En cas de doute, choisissez STARTTLS.'
+                  })}
+                </span>
+              </Tooltip.Content>
+            </Tooltip>
+          </div>
+          <Select
+            value={values.encryption}
+            onValueChange={(value) => onChange('encryption', $MailEncryption.parse(value))}
+          >
+            <Select.Trigger className="w-full" data-testid="mail-encryption" id="mail-encryption">
+              <Select.Value />
+            </Select.Trigger>
+            <Select.Content>
+              <Select.Item value="starttls">STARTTLS</Select.Item>
+              <Select.Item value="ssl">SSL/TLS</Select.Item>
+              <Select.Item value="none">{t({ en: 'None', fr: 'Aucun' })}</Select.Item>
+            </Select.Content>
+          </Select>
+        </div>
+
+        <FormField
+          description={t(
+            {
+              en: 'Suggested port for {}: {}',
+              fr: 'Port suggéré pour {} : {}'
+            },
+            { args: [values.encryption.toUpperCase(), PORT_DEFAULTS[values.encryption]] }
+          )}
+          error={errors.port}
+          htmlFor="mail-port"
+          label={t({ en: 'Port', fr: 'Port' })}
+        >
+          <Input
+            autoComplete="off"
+            data-testid="mail-port"
+            id="mail-port"
+            name="odc-smtp-port"
+            placeholder={PORT_DEFAULTS[values.encryption]}
+            type="number"
+            value={values.port}
+            onChange={(event) => onChange('port', event.target.value)}
+          />
+        </FormField>
+
+        <FormField
+          error={errors.username}
+          htmlFor="mail-username"
+          label={t({ en: 'Username', fr: "Nom d'utilisateur" })}
+        >
+          <Input
+            autoComplete="off"
+            data-testid="mail-username"
+            id="mail-username"
+            name="odc-smtp-username"
+            value={values.username}
+            onChange={(event) => onChange('username', event.target.value)}
+          />
+        </FormField>
+
+        <FormField
+          description={
+            hasStoredPassword
+              ? t({
+                  en: 'A password is set (shown masked). Edit the field to replace it.',
+                  fr: 'Un mot de passe est défini (affiché masqué). Modifiez le champ pour le remplacer.'
+                })
+              : undefined
+          }
+          error={errors.password}
+          htmlFor="mail-password"
+          label={t({ en: 'Password', fr: 'Mot de passe' })}
+        >
+          <Input
+            data-1p-ignore
+            autoComplete="new-password"
+            data-lpignore="true"
+            data-testid="mail-password"
+            id="mail-password"
+            name="odc-smtp-secret"
+            type="password"
+            value={values.password}
+            onChange={(event) => onChange('password', event.target.value)}
+          />
+        </FormField>
+
+        <FormField htmlFor="mail-sender-name" label={t({ en: 'Sender name', fr: "Nom de l'expéditeur" })}>
+          <Input
+            autoComplete="off"
+            data-testid="mail-sender-name"
+            id="mail-sender-name"
+            name="odc-smtp-sender-name"
+            value={values.senderName}
+            onChange={(event) => onChange('senderName', event.target.value)}
+          />
+        </FormField>
+
+        <FormField
+          error={errors.senderAddress}
+          htmlFor="mail-sender-address"
+          label={t({ en: 'Sender address', fr: "Adresse de l'expéditeur" })}
+        >
+          <Input
+            autoComplete="off"
+            data-testid="mail-sender-address"
+            id="mail-sender-address"
+            name="odc-smtp-sender-address"
+            placeholder="noreply@example.org"
+            value={values.senderAddress}
+            onChange={(event) => onChange('senderAddress', event.target.value)}
+          />
+        </FormField>
+
+        <div>
+          <Button data-testid="mail-save-config" disabled={isSaving} type="button" variant="primary" onClick={onSave}>
+            {isSaving && <Loader2Icon className="mr-2 h-4 w-4 animate-spin" />}
+            {t('core.save')}
+          </Button>
+        </div>
+      </div>
+    </SectionCard>
+  );
+};
diff --git a/apps/web/src/components/MailSettings/MailSettings.tsx b/apps/web/src/components/MailSettings/MailSettings.tsx
new file mode 100644
index 000000000..28259d999
--- /dev/null
+++ b/apps/web/src/components/MailSettings/MailSettings.tsx
@@ -0,0 +1,198 @@
+import React from 'react';
+
+import { Checkbox, Heading } from '@douglasneuroinformatics/libui/components';
+import { useNotificationsStore, useTranslation } from '@douglasneuroinformatics/libui/hooks';
+import { $UpdateMailConfigData, isSameMailServer } from '@opendatacapture/schemas/mail';
+import type { MailConfigDto, MailTemplate, UpdateMailConfigData } from '@opendatacapture/schemas/mail';
+
+import { SectionCard } from '@/components/SectionCard';
+import { useUpdateMailSettingsMutation } from '@/hooks/useUpdateMailSettingsMutation';
+
+import { MailServerForm } from './MailServerForm';
+import { NewUserTemplateSection } from './NewUserTemplateSection';
+import { TestMailSection } from './TestMailSection';
+
+import type { MailConfigFieldErrors, MailConfigFormValues } from './MailServerForm';
+
+// Shown in the password field when one is already stored. The real value is never sent to the
+// client; leaving this mask unchanged keeps the stored secret, editing it sets a new one.
+const MASKED_SECRET = '••••••••';
+
+const initialValues = (config: MailConfigDto | null): MailConfigFormValues => ({
+  enabled: config?.enabled ?? false,
+  encryption: config?.encryption ?? 'starttls',
+  host: config?.host ?? '',
+  password: config?.hasPassword ? MASKED_SECRET : '',
+  // Empty for a new config so the encryption-specific suggestion shows and must be typed.
+  port: config?.port ? String(config.port) : '',
+  senderAddress: config?.senderAddress ?? '',
+  senderName: config?.senderName ?? '',
+  username: config?.username ?? ''
+});
+
+export type MailSettingsProps = {
+  config: MailConfigDto | null;
+  newUserEmailTemplate: MailTemplate;
+};
+
+export const MailSettings = ({ config, newUserEmailTemplate }: MailSettingsProps) => {
+  const { t } = useTranslation();
+  const addNotification = useNotificationsStore((store) => store.addNotification);
+  const updateMutation = useUpdateMailSettingsMutation();
+
+  const [values, setValues] = React.useState<MailConfigFormValues>(() => initialValues(config));
+  const [errors, setErrors] = React.useState<MailConfigFieldErrors>({});
+
+  // Per-field copy for the rules `$UpdateMailConfigData` enforces. The schema decides what is
+  // invalid; this only decides how to say it, so the two cannot disagree about the rules.
+  const errorMessages: MailConfigFieldErrors = {
+    host: t({
+      en: 'Enter a valid host (e.g. smtp.example.org)',
+      fr: 'Entrez un hôte valide (p. ex. smtp.example.org)'
+    }),
+    password: t({ en: 'A password is required', fr: 'Un mot de passe est requis' }),
+    port: t({
+      en: 'Port must be a whole number between 1 and 65535',
+      fr: 'Le port doit être un nombre entier entre 1 et 65535'
+    }),
+    senderAddress: t({
+      en: 'Enter a valid sender address (e.g. noreply@example.org)',
+      fr: "Entrez une adresse d'expéditeur valide (p. ex. noreply@example.org)"
+    }),
+    username: t({ en: 'A username is required', fr: "Le nom d'utilisateur est requis" })
+  };
+
+  /** Validate the live form into an API payload, collecting a message per offending field. */
+  const buildConfig = (): { errors: MailConfigFieldErrors } | { payload: UpdateMailConfigData } => {
+    const isSecretChanged = values.password !== '' && values.password !== MASKED_SECRET;
+    const host = values.host.trim();
+    const port = Number(values.port);
+    const username = values.username.trim();
+    const parsed = $UpdateMailConfigData.safeParse({
+      enabled: values.enabled,
+      encryption: values.encryption,
+      host,
+      port,
+      senderAddress: values.senderAddress.trim(),
+      senderName: values.senderName.trim() || undefined,
+      username,
+      // Only send the password when it has actually been changed from the stored (masked) one.
+      ...(isSecretChanged ? { password: values.password } : {})
+    });
+    const nextErrors: MailConfigFieldErrors = {};
+    // The server only lets a blank password inherit the stored one for the same server, so the
+    // password has to be re-entered when there is none yet or when the server identity changes.
+    const isServerChanged =
+      config !== null && !isSameMailServer(config, { encryption: values.encryption, host, port, username });
+    if ((!config?.hasPassword || isServerChanged) && !isSecretChanged) {
+      nextErrors.password = isServerChanged
+        ? t({
+            en: 'Re-enter the password for this mail server',
+            fr: 'Saisissez à nouveau le mot de passe pour ce serveur'
+          })
+        : errorMessages.password;
+    }
+    if (!parsed.success) {
+      for (const issue of parsed.error.issues) {
+        const field = issue.path[0] as keyof MailConfigFormValues;
+        nextErrors[field] = errorMessages[field] ?? issue.message;
+      }
+      return { errors: nextErrors };
+    }
+    if (Object.keys(nextErrors).length > 0) {
+      return { errors: nextErrors };
+    }
+    return { payload: parsed.data };
+  };
+
+  const set = <K extends keyof MailConfigFormValues>(key: K, value: MailConfigFormValues[K]) => {
+    setValues((prev) => ({ ...prev, [key]: value }));
+    setErrors((prev) => ({ ...prev, [key]: undefined }));
+  };
+
+  const save = async (data: Parameters<typeof updateMutation.mutateAsync>[0]) => {
+    try {
+      const next = await updateMutation.mutateAsync(data);
+      // Re-seed from what the server actually stored, so any normalisation is visible and the
+      // masked password reflects the saved state rather than whatever was typed.
+      setValues(initialValues(next.config));
+      addNotification({ type: 'success' });
+    } catch {
+      addNotification({
+        message: t({
+          en: 'Your changes were not saved. Check your connection and try again.',
+          fr: "Vos modifications n'ont pas été enregistrées. Vérifiez votre connexion et réessayez."
+        }),
+        title: t({ en: 'Save failed', fr: "Échec de l'enregistrement" }),
+        type: 'error'
+      });
+    }
+  };
+
+  const handleSaveConfig = async () => {
+    const result = buildConfig();
+    if ('errors' in result) {
+      setErrors(result.errors);
+      return;
+    }
+    setErrors({});
+    await save({ config: result.payload });
+  };
+
+  const handleToggleEnabled = async (checked: boolean) => {
+    set('enabled', checked);
+    // Persist a disable immediately so the rest of the app reflects it. Enabling for the first
+    // time only reveals the form — saving a valid configuration is what turns it on.
+    if (!checked && config) {
+      await save({ config: { ...config, enabled: false, senderName: config.senderName ?? undefined } });
+    }
+  };
+
+  return (
+    <React.Fragment>
+      <SectionCard data-testid="mail-enabled-card">
+        <Heading className="mb-1" variant="h4">
+          {t({ en: 'Email', fr: 'Courriel' })}
+        </Heading>
+        <p className="text-muted-foreground mb-4 text-sm">
+          {t({
+            en: 'Turn outgoing email on to configure your mail server and templates. When off, the application behaves as if email is not available.',
+            fr: "Activez l'envoi de courriels pour configurer votre serveur de messagerie et vos modèles. Lorsque c'est désactivé, l'application se comporte comme si le courriel n'était pas disponible."
+          })}
+        </p>
+        <label className="flex items-center gap-2" htmlFor="mail-enabled">
+          <Checkbox
+            checked={values.enabled}
+            data-testid="mail-enabled-toggle"
+            id="mail-enabled"
+            onCheckedChange={(checked) => void handleToggleEnabled(checked === true)}
+          />
+          <span className="text-sm font-medium">
+            {t({ en: 'Enable email sending', fr: "Activer l'envoi de courriels" })}
+          </span>
+        </label>
+      </SectionCard>
+
+      {values.enabled && (
+        <React.Fragment>
+          <MailServerForm
+            errors={errors}
+            hasStoredPassword={Boolean(config?.hasPassword)}
+            isSaving={updateMutation.isPending}
+            values={values}
+            onChange={set}
+            onSave={() => void handleSaveConfig()}
+          />
+
+          <TestMailSection buildConfig={buildConfig} onInvalid={setErrors} />
+
+          <NewUserTemplateSection
+            isSaving={updateMutation.isPending}
+            template={newUserEmailTemplate}
+            onSave={(next) => void save({ newUserEmailTemplate: next })}
+          />
+        </React.Fragment>
+      )}
+    </React.Fragment>
+  );
+};
diff --git a/apps/web/src/components/MailSettings/NewUserTemplateSection.tsx b/apps/web/src/components/MailSettings/NewUserTemplateSection.tsx
new file mode 100644
index 000000000..8c13169dd
--- /dev/null
+++ b/apps/web/src/components/MailSettings/NewUserTemplateSection.tsx
@@ -0,0 +1,92 @@
+import React from 'react';
+
+import { Button, Heading } from '@douglasneuroinformatics/libui/components';
+import { useTranslation } from '@douglasneuroinformatics/libui/hooks';
+import { DEFAULT_NEW_USER_EMAIL_TEMPLATE } from '@opendatacapture/schemas/mail';
+import type { MailTemplate } from '@opendatacapture/schemas/mail';
+import { Loader2Icon } from 'lucide-react';
+
+import { EmailTemplateEditor } from '@/components/EmailTemplateEditor';
+import { SectionCard } from '@/components/SectionCard';
+import { checkTemplateIssue, NEW_USER_TEMPLATE_VARS, REQUIRED_NEW_USER_TEMPLATE_VARS } from '@/utils/email-template';
+import { omitBlankLanguages } from '@/utils/language';
+
+const defaultTemplate = (): MailTemplate => ({
+  body: { ...DEFAULT_NEW_USER_EMAIL_TEMPLATE.body },
+  subject: { ...DEFAULT_NEW_USER_EMAIL_TEMPLATE.subject }
+});
+
+export type NewUserTemplateSectionProps = {
+  isSaving: boolean;
+  onSave: (template: MailTemplate) => void;
+  template: MailTemplate;
+};
+
+/** Authors the welcome message sent when a user with an email address is created. */
+export const NewUserTemplateSection = ({ isSaving, onSave, template: saved }: NewUserTemplateSectionProps) => {
+  const { t } = useTranslation();
+  const [template, setTemplate] = React.useState<MailTemplate>(() => ({
+    body: { ...DEFAULT_NEW_USER_EMAIL_TEMPLATE.body, ...saved.body },
+    subject: { ...DEFAULT_NEW_USER_EMAIL_TEMPLATE.subject, ...saved.subject }
+  }));
+
+  // Unlike a group template, this one is sent in whichever language the admin picks at creation
+  // time, so every language has to be filled in rather than only the ones started.
+  const issue = checkTemplateIssue(template.subject, template.body, REQUIRED_NEW_USER_TEMPLATE_VARS);
+  const error =
+    issue === 'incomplete'
+      ? t({
+          en: 'Fill in the subject and body for each language.',
+          fr: "Remplissez l'objet et le corps pour chaque langue."
+        })
+      : issue === 'missing-vars'
+        ? t({ en: 'The body must include {{username}}.', fr: 'Le corps doit inclure {{username}}.' })
+        : undefined;
+
+  return (
+    <SectionCard data-testid="mail-template-card">
+      <div className="mb-1 flex items-start justify-between gap-4">
+        <Heading variant="h4">
+          {t({ en: 'New User Email Template', fr: 'Modèle de courriel pour les nouveaux utilisateurs' })}
+        </Heading>
+        <Button
+          className="shrink-0"
+          data-testid="mail-template-reset"
+          size="sm"
+          type="button"
+          variant="outline"
+          onClick={() => setTemplate(defaultTemplate())}
+        >
+          {t({ en: 'Reset', fr: 'Réinitialiser' })}
+        </Button>
+      </div>
+      <p className="text-muted-foreground mb-4 text-sm">
+        {t({
+          en: 'Sent automatically when a new user with an email address is created. The sender chooses the language.',
+          fr: "Envoyé automatiquement lors de la création d'un nouvel utilisateur disposant d'une adresse courriel. L'expéditeur choisit la langue."
+        })}
+      </p>
+      <EmailTemplateEditor
+        error={error}
+        idPrefix="new-user-template"
+        template={template}
+        variables={NEW_USER_TEMPLATE_VARS}
+        onChange={setTemplate}
+      />
+      <div className="mt-4">
+        <Button
+          data-testid="mail-template-save"
+          disabled={isSaving || Boolean(error)}
+          type="button"
+          variant="primary"
+          onClick={() =>
+            onSave({ body: omitBlankLanguages(template.body), subject: omitBlankLanguages(template.subject) })
+          }
+        >
+          {isSaving && <Loader2Icon className="mr-2 h-4 w-4 animate-spin" />}
+          {t('core.save')}
+        </Button>
+      </div>
+    </SectionCard>
+  );
+};
diff --git a/apps/web/src/components/MailSettings/TestMailSection.tsx b/apps/web/src/components/MailSettings/TestMailSection.tsx
new file mode 100644
index 000000000..bfc07689d
--- /dev/null
+++ b/apps/web/src/components/MailSettings/TestMailSection.tsx
@@ -0,0 +1,145 @@
+import React from 'react';
+
+import { Button, Heading, Input } from '@douglasneuroinformatics/libui/components';
+import { useNotificationsStore, useTranslation } from '@douglasneuroinformatics/libui/hooks';
+import { $TestMailData } from '@opendatacapture/schemas/mail';
+import type { UpdateMailConfigData } from '@opendatacapture/schemas/mail';
+import { Loader2Icon } from 'lucide-react';
+
+import { SectionCard } from '@/components/SectionCard';
+import { useMailErrorMessage } from '@/hooks/useMailErrorMessage';
+import { useTestMailMutation } from '@/hooks/useTestMailMutation';
+
+import type { MailConfigFieldErrors } from './MailServerForm';
+
+export type TestMailSectionProps = {
+  /** Validates the live form; the test runs against unsaved values, so it cannot use the query. */
+  buildConfig: () => { errors: MailConfigFieldErrors } | { payload: UpdateMailConfigData };
+  onInvalid: (errors: MailConfigFieldErrors) => void;
+};
+
+export const TestMailSection = ({ buildConfig, onInvalid }: TestMailSectionProps) => {
+  const { t } = useTranslation();
+  const addNotification = useNotificationsStore((store) => store.addNotification);
+  const testMutation = useTestMailMutation();
+  const mailErrorMessage = useMailErrorMessage();
+  const [recipient, setRecipient] = React.useState('');
+  const [testingMode, setTestingMode] = React.useState<'connection' | 'email' | null>(null);
+
+  const isValidRecipient = $TestMailData.shape.recipient.safeParse(recipient).success && recipient.length > 0;
+
+  const runTest = (withRecipient: boolean) => {
+    const result = buildConfig();
+    if ('errors' in result) {
+      onInvalid(result.errors);
+      return;
+    }
+    setTestingMode(withRecipient ? 'email' : 'connection');
+    testMutation.mutate(
+      { config: result.payload, recipient: withRecipient ? recipient : undefined },
+      {
+        onError: () => {
+          addNotification({
+            message: t({
+              en: 'The test could not be completed (the server may be unreachable or the request timed out). Check the host, port, and credentials.',
+              fr: "Le test n'a pas pu être effectué (serveur injoignable ou délai dépassé). Vérifiez l'hôte, le port et les identifiants."
+            }),
+            title: t({ en: 'Mail test failed', fr: 'Échec du test de courriel' }),
+            type: 'error'
+          });
+        },
+        onSettled: () => setTestingMode(null),
+        onSuccess: (outcome) => {
+          if (!outcome.success) {
+            addNotification({
+              message: mailErrorMessage(outcome.error),
+              title: t({ en: 'Mail test failed', fr: 'Échec du test de courriel' }),
+              type: 'error'
+            });
+            return;
+          }
+          addNotification({
+            message: withRecipient
+              ? t({ en: 'Test email sent to {}', fr: 'Courriel de test envoyé à {}' }, { args: [recipient] })
+              : t({
+                  en: 'Connected to the mail server successfully',
+                  fr: 'Connexion au serveur de courriel réussie'
+                }),
+            title: t({ en: 'Mail test succeeded', fr: 'Test de courriel réussi' }),
+            type: 'success'
+          });
+        }
+      }
+    );
+  };
+
+  return (
+    <SectionCard data-testid="mail-test-card">
+      <Heading className="mb-5" variant="h4">
+        {t({ en: 'Verify Your Configuration', fr: 'Vérifiez votre configuration' })}
+      </Heading>
+      <div className="flex flex-col gap-5">
+        <div className="flex flex-col items-start gap-2">
+          <div>
+            <p className="text-sm font-medium">{t({ en: 'Connection', fr: 'Connexion' })}</p>
+            <p className="text-muted-foreground text-xs">
+              {t({
+                en: 'Check that the server accepts the connection and your credentials.',
+                fr: 'Vérifiez que le serveur accepte la connexion et vos identifiants.'
+              })}
+            </p>
+          </div>
+          <Button
+            data-testid="mail-test-connection"
+            disabled={testMutation.isPending}
+            type="button"
+            variant="primary"
+            onClick={() => runTest(false)}
+          >
+            {testingMode === 'connection' && <Loader2Icon className="mr-2 h-4 w-4 animate-spin" />}
+            {testingMode === 'connection'
+              ? t({ en: 'Testing…', fr: 'Test en cours…' })
+              : t({ en: 'Test connection', fr: 'Tester la connexion' })}
+          </Button>
+        </div>
+
+        <div className="border-border border-t" />
+
+        <div className="flex flex-col items-start gap-2">
+          <div>
+            <p className="text-sm font-medium">{t({ en: 'Send test email', fr: 'Envoyer un courriel de test' })}</p>
+            <p className="text-muted-foreground text-xs">
+              {t({
+                en: 'Deliver a real message to confirm everything works end to end.',
+                fr: 'Envoyez un message réel pour confirmer que tout fonctionne de bout en bout.'
+              })}
+            </p>
+          </div>
+          <Input
+            autoComplete="off"
+            className="sm:max-w-sm"
+            data-testid="mail-test-recipient"
+            id="mail-test-recipient"
+            name="odc-smtp-test-recipient"
+            placeholder={t({ en: 'recipient@example.org', fr: 'destinataire@exemple.org' })}
+            type="email"
+            value={recipient}
+            onChange={(event) => setRecipient(event.target.value)}
+          />
+          <Button
+            data-testid="mail-send-test"
+            disabled={testMutation.isPending || !isValidRecipient}
+            type="button"
+            variant="primary"
+            onClick={() => runTest(true)}
+          >
+            {testingMode === 'email' && <Loader2Icon className="mr-2 h-4 w-4 animate-spin" />}
+            {testingMode === 'email'
+              ? t({ en: 'Sending…', fr: 'Envoi en cours…' })
+              : t({ en: 'Send test email', fr: 'Envoyer un courriel de test' })}
+          </Button>
+        </div>
+      </div>
+    </SectionCard>
+  );
+};
diff --git a/apps/web/src/components/MailSettings/index.ts b/apps/web/src/components/MailSettings/index.ts
new file mode 100644
index 000000000..a4e574f13
--- /dev/null
+++ b/apps/web/src/components/MailSettings/index.ts
@@ -0,0 +1 @@
+export * from './MailSettings';
diff --git a/apps/web/src/components/SectionCard/SectionCard.tsx b/apps/web/src/components/SectionCard/SectionCard.tsx
new file mode 100644
index 000000000..797342331
--- /dev/null
+++ b/apps/web/src/components/SectionCard/SectionCard.tsx
@@ -0,0 +1,18 @@
+import type React from 'react';
+
+import { cn } from '@douglasneuroinformatics/libui/utils';
+
+export type SectionCardProps = {
+  children: React.ReactNode;
+  className?: string;
+  'data-testid'?: string;
+};
+
+export const SectionCard = ({ children, className, 'data-testid': testId }: SectionCardProps) => (
+  <div
+    className={cn('bg-card text-card-foreground border-border rounded-2xl border p-6 shadow-sm', className)}
+    data-testid={testId}
+  >
+    {children}
+  </div>
+);
diff --git a/apps/web/src/components/SectionCard/index.ts b/apps/web/src/components/SectionCard/index.ts
new file mode 100644
index 000000000..eeaeb8261
--- /dev/null
+++ b/apps/web/src/components/SectionCard/index.ts
@@ -0,0 +1 @@
+export * from './SectionCard';
diff --git a/apps/web/src/hooks/__tests__/useGroupQuery.test.ts b/apps/web/src/hooks/__tests__/useGroupQuery.test.ts
new file mode 100644
index 000000000..a94dc0dbc
--- /dev/null
+++ b/apps/web/src/hooks/__tests__/useGroupQuery.test.ts
@@ -0,0 +1,59 @@
+import type { PropsWithChildren } from 'react';
+import { createElement } from 'react';
+
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { renderHook, waitFor } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { useGroupQuery } from '../useGroupQuery';
+
+const mockAxios = vi.hoisted(() => ({ get: vi.fn(), isAxiosError: vi.fn(() => false) }));
+
+vi.mock('axios', () => ({ default: mockAxios }));
+
+const group = {
+  accessibleInstrumentIds: [],
+  createdAt: '2026-01-01T00:00:00.000Z',
+  emailTemplates: [],
+  id: 'group-1',
+  instrumentRepoIds: [],
+  name: 'Group One',
+  settings: { defaultIdentificationMethod: 'CUSTOM_ID' },
+  subjectIds: [],
+  type: 'CLINICAL',
+  updatedAt: '2026-01-02T00:00:00.000Z',
+  userIds: []
+};
+
+function renderGroupQuery(groupId: null | string | undefined) {
+  const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  const wrapper = ({ children }: PropsWithChildren) =>
+    createElement(QueryClientProvider, { children, client: queryClient });
+  return { ...renderHook(() => useGroupQuery(groupId), { wrapper }), queryClient };
+}
+
+describe('useGroupQuery', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockAxios.get.mockResolvedValue({ data: group });
+  });
+
+  it('requests the group it was given', async () => {
+    const { result } = renderGroupQuery('group-1');
+
+    await waitFor(() => expect(result.current.isSuccess).toBe(true));
+    expect(mockAxios.get).toHaveBeenCalledWith('/v1/groups/group-1');
+  });
+
+  it('caches under a group-scoped key', async () => {
+    const { queryClient, result } = renderGroupQuery('group-1');
+
+    await waitFor(() => expect(result.current.isSuccess).toBe(true));
+    expect(queryClient.getQueryData(['group', 'group-1'])).toMatchObject({ id: 'group-1' });
+  });
+
+  it.each([null, undefined])('does not request anything for the group id %s', (groupId) => {
+    renderGroupQuery(groupId);
+    expect(mockAxios.get).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/web/src/hooks/useCreateUserMutation.ts b/apps/web/src/hooks/useCreateUserMutation.ts
index f0d6d8325..1adb41156 100644
--- a/apps/web/src/hooks/useCreateUserMutation.ts
+++ b/apps/web/src/hooks/useCreateUserMutation.ts
@@ -1,46 +1,38 @@
-import { useNotificationsStore } from '@douglasneuroinformatics/libui/hooks';
-import { PASSWORD_ERROR_CODES } from '@opendatacapture/schemas/user';
-import type { CreateUserData, PasswordErrorCode } from '@opendatacapture/schemas/user';
+import type { Language } from '@opendatacapture/schemas/core';
+import { $EmailDeliveryResult } from '@opendatacapture/schemas/mail';
+import { $User } from '@opendatacapture/schemas/user';
+import type { CreateUserData } from '@opendatacapture/schemas/user';
 import { useMutation, useQueryClient } from '@tanstack/react-query';
-import axios, { isAxiosError } from 'axios';
+import axios from 'axios';
+import { z } from 'zod/v4';
 
 import { USERS_QUERY_KEY } from './useUsersQuery';
 
-/** The outcome of attempting to create a user, so the caller can localize any rejection. */
-type CreateUserResult = { code: null | PasswordErrorCode; success: false } | { success: true };
+/** The created user, augmented with the outcome of the welcome-email attempt. */
+const $CreateUserResponse = $User.extend({ welcomeEmail: $EmailDeliveryResult.optional() });
 
-/** Read a known password error code from an API error response body, if present. */
-function parsePasswordErrorCode(data: unknown): null | PasswordErrorCode {
-  if (typeof data === 'object' && data !== null && 'code' in data && typeof data.code === 'string') {
-    return (PASSWORD_ERROR_CODES as readonly string[]).includes(data.code) ? (data.code as PasswordErrorCode) : null;
-  }
-  return null;
-}
+export type CreateUserResponse = z.infer<typeof $CreateUserResponse>;
 
 export function useCreateUserMutation() {
   const queryClient = useQueryClient();
-  const addNotification = useNotificationsStore((store) => store.addNotification);
   return useMutation({
-    // The default error notification is disabled so the caller can translate the structured
-    // error code returned by the API (e.g. a rejected password) into a localized message.
-    mutationFn: async ({ data }: { data: CreateUserData }): Promise<CreateUserResult> => {
-      try {
-        await axios.post('/v1/users', data, { meta: { disableDefaultErrorNotification: true } });
-        return { success: true };
-      } catch (err) {
-        if (isAxiosError(err) && err.response?.status === 400) {
-          return { code: parsePasswordErrorCode(err.response.data), success: false };
-        }
-        // An unexpected error (network failure, 5xx, etc.); surface it generically.
-        console.error(err);
-        return { code: null, success: false };
-      }
+    mutationFn: async ({ data, language }: { data: CreateUserData; language?: Language }) => {
+      // The welcome-email language is a query param so it stays out of the user record itself.
+      // A slow SMTP host can take ~20s server-side; without opting out of the global 10s timeout
+      // the request aborts *after* the user is created, so a retry hits "username exists" and the
+      // admin never learns whether the welcome email went out.
+      const response = await axios.post('/v1/users', data, {
+        meta: { disableDefaultErrorNotification: true, disableDefaultTimeout: true },
+        params: { language },
+        timeout: 30_000
+      });
+      return $CreateUserResponse.parseAsync(response.data);
+    },
+    onSuccess() {
+      void queryClient.invalidateQueries({ queryKey: [USERS_QUERY_KEY] });
     },
-    onSuccess(result) {
-      if (result.success) {
-        addNotification({ type: 'success' });
-        void queryClient.invalidateQueries({ queryKey: [USERS_QUERY_KEY] });
-      }
-    }
+    // `create.tsx` catches the rejection to map password error codes onto field messages, so it
+    // must not also escape to the router error boundary.
+    throwOnError: false
   });
 }
diff --git a/apps/web/src/hooks/useGroupQuery.ts b/apps/web/src/hooks/useGroupQuery.ts
new file mode 100644
index 000000000..649e828b6
--- /dev/null
+++ b/apps/web/src/hooks/useGroupQuery.ts
@@ -0,0 +1,19 @@
+import { $Group } from '@opendatacapture/schemas/group';
+import { queryOptions, useQuery } from '@tanstack/react-query';
+import axios from 'axios';
+
+export const GROUP_QUERY_KEY = 'group';
+
+export const groupQueryOptions = (groupId: null | string | undefined) =>
+  queryOptions({
+    enabled: Boolean(groupId),
+    queryFn: async () => {
+      const response = await axios.get(`/v1/groups/${groupId}`);
+      return $Group.parseAsync(response.data);
+    },
+    queryKey: [GROUP_QUERY_KEY, groupId]
+  });
+
+export function useGroupQuery(groupId: null | string | undefined) {
+  return useQuery(groupQueryOptions(groupId));
+}
diff --git a/apps/web/src/hooks/useMailErrorMessage.ts b/apps/web/src/hooks/useMailErrorMessage.ts
new file mode 100644
index 000000000..cd0615155
--- /dev/null
+++ b/apps/web/src/hooks/useMailErrorMessage.ts
@@ -0,0 +1,37 @@
+import { useTranslation } from '@douglasneuroinformatics/libui/hooks';
+import type { MailErrorCode } from '@opendatacapture/schemas/mail';
+
+/**
+ * Render a {@link MailErrorCode} in the reader's language. The API returns a code rather than a
+ * sentence precisely because it cannot know who is reading the result, so the copy lives here.
+ */
+export function useMailErrorMessage(): (code: MailErrorCode | null | undefined) => string {
+  const { t } = useTranslation();
+  const messages: { [K in MailErrorCode]: string } = {
+    AUTHENTICATION_FAILED: t({
+      en: 'Authentication failed — check the username and password.',
+      fr: "L'authentification a échoué — vérifiez le nom d'utilisateur et le mot de passe."
+    }),
+    CONNECTION_REFUSED: t({
+      en: 'The mail server refused the connection — check the host and port.',
+      fr: 'Le serveur de courriel a refusé la connexion — vérifiez l’hôte et le port.'
+    }),
+    HOST_NOT_FOUND: t({
+      en: 'The mail server could not be found — check the host name.',
+      fr: 'Le serveur de courriel est introuvable — vérifiez le nom d’hôte.'
+    }),
+    INSECURE_CONNECTION: t({
+      en: 'Could not establish a secure connection — check the port and encryption method.',
+      fr: 'Impossible d’établir une connexion sécurisée — vérifiez le port et le chiffrement.'
+    }),
+    SENDER_REJECTED: t({
+      en: 'The sender address was rejected — check the sender address.',
+      fr: "L'adresse d'expéditeur a été refusée — vérifiez l'adresse d'expéditeur."
+    }),
+    UNKNOWN: t({
+      en: 'Please check and reconfigure your mail settings and try again.',
+      fr: 'Veuillez vérifier et reconfigurer vos paramètres de courriel, puis réessayer.'
+    })
+  };
+  return (code) => messages[code ?? 'UNKNOWN'];
+}
diff --git a/apps/web/src/hooks/useMailSettingsQuery.ts b/apps/web/src/hooks/useMailSettingsQuery.ts
new file mode 100644
index 000000000..282ba1dda
--- /dev/null
+++ b/apps/web/src/hooks/useMailSettingsQuery.ts
@@ -0,0 +1,20 @@
+import { $MailSettings } from '@opendatacapture/schemas/mail';
+import { queryOptions, useSuspenseQuery } from '@tanstack/react-query';
+import axios from 'axios';
+
+export const MAIL_SETTINGS_QUERY_KEY = 'mail-settings';
+
+export const mailSettingsQueryOptions = () => {
+  return queryOptions({
+    queryFn: async () => {
+      const response = await axios.get('/v1/mail/settings');
+      return $MailSettings.parseAsync(response.data);
+    },
+    queryKey: [MAIL_SETTINGS_QUERY_KEY],
+    staleTime: Infinity
+  });
+};
+
+export function useMailSettingsQuery() {
+  return useSuspenseQuery(mailSettingsQueryOptions());
+}
diff --git a/apps/web/src/hooks/useNavItems.ts b/apps/web/src/hooks/useNavItems.ts
index ab769d70a..58099e846 100644
--- a/apps/web/src/hooks/useNavItems.ts
+++ b/apps/web/src/hooks/useNavItems.ts
@@ -9,6 +9,7 @@ import {
   DatabaseIcon,
   EyeIcon,
   LogsIcon,
+  MailIcon,
   PackageIcon,
   PaletteIcon,
   SendIcon,
@@ -85,6 +86,13 @@ export function useNavItems() {
         label: t('layout.navLinks.manageGroup'),
         url: '/group/manage'
       });
+      if (setupStateQuery.data.isMailEnabled) {
+        globalItems.push({
+          icon: MailIcon,
+          label: t({ en: 'Email Templates', fr: 'Modèles de courriel' }),
+          url: '/group/email-templates'
+        });
+      }
     }
 
     if (ability?.can('manage', 'all')) {
@@ -138,6 +146,11 @@ export function useNavItems() {
               fr: "Dépôts d'instruments"
             }),
             url: '/admin/instrument-repos'
+          },
+          {
+            icon: MailIcon,
+            label: t({ en: 'Mail', fr: 'Courriel' }),
+            url: '/admin/mail'
           }
         ],
         icon: ShieldIcon,
@@ -185,7 +198,8 @@ export function useNavItems() {
     currentUser,
     resolvedLanguage,
     setupStateQuery.data.isExperimentalFeaturesEnabled,
-    setupStateQuery.data.isGatewayEnabled
+    setupStateQuery.data.isGatewayEnabled,
+    setupStateQuery.data.isMailEnabled
   ]);
 
   return navItems;
diff --git a/apps/web/src/hooks/useSendAssignmentEmailMutation.ts b/apps/web/src/hooks/useSendAssignmentEmailMutation.ts
new file mode 100644
index 000000000..122e294d8
--- /dev/null
+++ b/apps/web/src/hooks/useSendAssignmentEmailMutation.ts
@@ -0,0 +1,32 @@
+import type { Language } from '@opendatacapture/schemas/core';
+import { $EmailDeliveryResult } from '@opendatacapture/schemas/mail';
+import { useMutation } from '@tanstack/react-query';
+import axios from 'axios';
+
+export function useSendAssignmentEmailMutation() {
+  return useMutation({
+    mutationFn: async ({
+      assignmentId,
+      language,
+      recipient,
+      templateId
+    }: {
+      assignmentId: string;
+      language: Language;
+      recipient: string;
+      templateId?: null | string;
+    }) => {
+      // A slow SMTP host can take ~20s to fail server-side. Without opting out of the global 10s
+      // timeout the request aborts after the mail has already gone out, and a resend leaves the
+      // participant holding two assignment links.
+      const response = await axios.post(
+        `/v1/assignments/${encodeURIComponent(assignmentId)}/email`,
+        { language, recipient, templateId },
+        { meta: { disableDefaultErrorNotification: true, disableDefaultTimeout: true }, timeout: 30_000 }
+      );
+      return $EmailDeliveryResult.parseAsync(response.data);
+    },
+    // The caller renders its own failure message inline; escalating would replace the whole page.
+    throwOnError: false
+  });
+}
diff --git a/apps/web/src/hooks/useTestMailMutation.ts b/apps/web/src/hooks/useTestMailMutation.ts
new file mode 100644
index 000000000..fe62f3f8a
--- /dev/null
+++ b/apps/web/src/hooks/useTestMailMutation.ts
@@ -0,0 +1,21 @@
+import { $TestMailResult } from '@opendatacapture/schemas/mail';
+import type { TestMailData } from '@opendatacapture/schemas/mail';
+import { useMutation } from '@tanstack/react-query';
+import axios from 'axios';
+
+export function useTestMailMutation() {
+  return useMutation({
+    mutationFn: async (data: TestMailData) => {
+      // A bad host/port can take ~15s to fail server-side, so opt out of the global 10s
+      // timeout (which the axios interceptor would otherwise force) and suppress the generic
+      // error toast — this mutation surfaces its own success/failure notifications.
+      const response = await axios.post('/v1/mail/test', data, {
+        meta: { disableDefaultErrorNotification: true, disableDefaultTimeout: true },
+        timeout: 30_000
+      });
+      return $TestMailResult.parseAsync(response.data);
+    },
+    // The caller has an onError handler; without this the rejection still reaches the boundary.
+    throwOnError: false
+  });
+}
diff --git a/apps/web/src/hooks/useUpdateGroupMutation.ts b/apps/web/src/hooks/useUpdateGroupMutation.ts
index f79fd4531..bbe49ab3e 100644
--- a/apps/web/src/hooks/useUpdateGroupMutation.ts
+++ b/apps/web/src/hooks/useUpdateGroupMutation.ts
@@ -6,7 +6,20 @@ import axios from 'axios';
 
 import { useAppStore } from '@/store';
 
-export function useUpdateGroupMutation() {
+type UpdateGroupMutationOptions = {
+  /** Whether a success toast is raised. Opt out where the caller renders its own save feedback. */
+  successNotification?: boolean;
+  /**
+   * Whether a rejected update escapes to the router error boundary. Opt out where the caller
+   * must stay on the page to recover — a save conflict, for instance.
+   */
+  throwOnError?: boolean;
+};
+
+export function useUpdateGroupMutation({
+  successNotification = true,
+  throwOnError = true
+}: UpdateGroupMutationOptions = {}) {
   const addNotification = useNotificationsStore((store) => store.addNotification);
   const currentGroup = useAppStore((store) => store.currentGroup);
   return useMutation({
@@ -15,7 +28,10 @@ export function useUpdateGroupMutation() {
       return $Group.parseAsync(response.data);
     },
     onSuccess() {
-      addNotification({ type: 'success' });
-    }
+      if (successNotification) {
+        addNotification({ type: 'success' });
+      }
+    },
+    throwOnError
   });
 }
diff --git a/apps/web/src/hooks/useUpdateMailSettingsMutation.ts b/apps/web/src/hooks/useUpdateMailSettingsMutation.ts
new file mode 100644
index 000000000..9cf35a9cb
--- /dev/null
+++ b/apps/web/src/hooks/useUpdateMailSettingsMutation.ts
@@ -0,0 +1,29 @@
+import { $MailSettings } from '@opendatacapture/schemas/mail';
+import type { UpdateMailSettingsData } from '@opendatacapture/schemas/mail';
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import axios from 'axios';
+
+import { MAIL_SETTINGS_QUERY_KEY } from './useMailSettingsQuery';
+import { SETUP_STATE_QUERY_KEY } from './useSetupStateQuery';
+
+// The mail page renders its own inline save feedback, so this mutation raises neither a success
+// nor an error toast and does not escape to the router error boundary. `throwOnError: false`
+// overrides the global mutation default deliberately: a failed save must leave the admin on the
+// page with their unsaved edits intact, which means the caller has to see the rejection.
+export function useUpdateMailSettingsMutation() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async (data: UpdateMailSettingsData) => {
+      const response = await axios.patch('/v1/mail/settings', data, {
+        meta: { disableDefaultErrorNotification: true }
+      });
+      return $MailSettings.parseAsync(response.data);
+    },
+    onSuccess() {
+      void queryClient.invalidateQueries({ queryKey: [MAIL_SETTINGS_QUERY_KEY] });
+      // Toggling `enabled` changes the public `isMailEnabled` flag, which gates email UI elsewhere.
+      void queryClient.invalidateQueries({ queryKey: [SETUP_STATE_QUERY_KEY] });
+    },
+    throwOnError: false
+  });
+}
diff --git a/apps/web/src/route-tree.ts b/apps/web/src/route-tree.ts
index cd0faa60b..f9350ef53 100644
--- a/apps/web/src/route-tree.ts
+++ b/apps/web/src/route-tree.ts
@@ -24,7 +24,9 @@ import { Route as AppSessionStartSessionRouteImport } from './routes/_app/sessio
 import { Route as AppSessionRemoteAssignmentRouteImport } from './routes/_app/session/remote-assignment'
 import { Route as AppInstrumentsAccessibleInstrumentsRouteImport } from './routes/_app/instruments/accessible-instruments'
 import { Route as AppGroupManageRouteImport } from './routes/_app/group/manage'
+import { Route as AppGroupEmailTemplatesRouteImport } from './routes/_app/group/email-templates'
 import { Route as AppAdminSettingsRouteImport } from './routes/_app/admin/settings'
+import { Route as AppAdminMailRouteImport } from './routes/_app/admin/mail'
 import { Route as AppDatahubSubjectIdRouteRouteImport } from './routes/_app/datahub/$subjectId/route'
 import { Route as AppAdminUsersIndexRouteImport } from './routes/_app/admin/users/index'
 import { Route as AppAdminInstrumentReposIndexRouteImport } from './routes/_app/admin/instrument-repos/index'
@@ -116,11 +118,21 @@ const AppGroupManageRoute = AppGroupManageRouteImport.update({
   path: '/group/manage',
   getParentRoute: () => AppRouteRoute,
 } as any)
+const AppGroupEmailTemplatesRoute = AppGroupEmailTemplatesRouteImport.update({
+  id: '/group/email-templates',
+  path: '/group/email-templates',
+  getParentRoute: () => AppRouteRoute,
+} as any)
 const AppAdminSettingsRoute = AppAdminSettingsRouteImport.update({
   id: '/admin/settings',
   path: '/admin/settings',
   getParentRoute: () => AppRouteRoute,
 } as any)
+const AppAdminMailRoute = AppAdminMailRouteImport.update({
+  id: '/admin/mail',
+  path: '/admin/mail',
+  getParentRoute: () => AppRouteRoute,
+} as any)
 const AppDatahubSubjectIdRouteRoute =
   AppDatahubSubjectIdRouteRouteImport.update({
     id: '/datahub/$subjectId',
@@ -208,7 +220,9 @@ export interface FileRoutesByFullPath {
   '/user': typeof AppUserRoute
   '/auth/login': typeof AuthLoginRoute
   '/datahub/$subjectId': typeof AppDatahubSubjectIdRouteRouteWithChildren
+  '/admin/mail': typeof AppAdminMailRoute
   '/admin/settings': typeof AppAdminSettingsRoute
+  '/group/email-templates': typeof AppGroupEmailTemplatesRoute
   '/group/manage': typeof AppGroupManageRoute
   '/instruments/accessible-instruments': typeof AppInstrumentsAccessibleInstrumentsRoute
   '/session/remote-assignment': typeof AppSessionRemoteAssignmentRoute
@@ -239,7 +253,9 @@ export interface FileRoutesByTo {
   '/auth/login': typeof AuthLoginRoute
   '/': typeof AppIndexRoute
   '/datahub/$subjectId': typeof AppDatahubSubjectIdRouteRouteWithChildren
+  '/admin/mail': typeof AppAdminMailRoute
   '/admin/settings': typeof AppAdminSettingsRoute
+  '/group/email-templates': typeof AppGroupEmailTemplatesRoute
   '/group/manage': typeof AppGroupManageRoute
   '/instruments/accessible-instruments': typeof AppInstrumentsAccessibleInstrumentsRoute
   '/session/remote-assignment': typeof AppSessionRemoteAssignmentRoute
@@ -272,7 +288,9 @@ export interface FileRoutesById {
   '/auth/login': typeof AuthLoginRoute
   '/_app/': typeof AppIndexRoute
   '/_app/datahub/$subjectId': typeof AppDatahubSubjectIdRouteRouteWithChildren
+  '/_app/admin/mail': typeof AppAdminMailRoute
   '/_app/admin/settings': typeof AppAdminSettingsRoute
+  '/_app/group/email-templates': typeof AppGroupEmailTemplatesRoute
   '/_app/group/manage': typeof AppGroupManageRoute
   '/_app/instruments/accessible-instruments': typeof AppInstrumentsAccessibleInstrumentsRoute
   '/_app/session/remote-assignment': typeof AppSessionRemoteAssignmentRoute
@@ -305,7 +323,9 @@ export interface FileRouteTypes {
     | '/user'
     | '/auth/login'
     | '/datahub/$subjectId'
+    | '/admin/mail'
     | '/admin/settings'
+    | '/group/email-templates'
     | '/group/manage'
     | '/instruments/accessible-instruments'
     | '/session/remote-assignment'
@@ -336,7 +356,9 @@ export interface FileRouteTypes {
     | '/auth/login'
     | '/'
     | '/datahub/$subjectId'
+    | '/admin/mail'
     | '/admin/settings'
+    | '/group/email-templates'
     | '/group/manage'
     | '/instruments/accessible-instruments'
     | '/session/remote-assignment'
@@ -368,7 +390,9 @@ export interface FileRouteTypes {
     | '/auth/login'
     | '/_app/'
     | '/_app/datahub/$subjectId'
+    | '/_app/admin/mail'
     | '/_app/admin/settings'
+    | '/_app/group/email-templates'
     | '/_app/group/manage'
     | '/_app/instruments/accessible-instruments'
     | '/_app/session/remote-assignment'
@@ -504,6 +528,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppGroupManageRouteImport
       parentRoute: typeof AppRouteRoute
     }
+    '/_app/group/email-templates': {
+      id: '/_app/group/email-templates'
+      path: '/group/email-templates'
+      fullPath: '/group/email-templates'
+      preLoaderRoute: typeof AppGroupEmailTemplatesRouteImport
+      parentRoute: typeof AppRouteRoute
+    }
     '/_app/admin/settings': {
       id: '/_app/admin/settings'
       path: '/admin/settings'
@@ -511,6 +542,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppAdminSettingsRouteImport
       parentRoute: typeof AppRouteRoute
     }
+    '/_app/admin/mail': {
+      id: '/_app/admin/mail'
+      path: '/admin/mail'
+      fullPath: '/admin/mail'
+      preLoaderRoute: typeof AppAdminMailRouteImport
+      parentRoute: typeof AppRouteRoute
+    }
     '/_app/datahub/$subjectId': {
       id: '/_app/datahub/$subjectId'
       path: '/datahub/$subjectId'
@@ -640,7 +678,9 @@ interface AppRouteRouteChildren {
   AppUserRoute: typeof AppUserRoute
   AppIndexRoute: typeof AppIndexRoute
   AppDatahubSubjectIdRouteRoute: typeof AppDatahubSubjectIdRouteRouteWithChildren
+  AppAdminMailRoute: typeof AppAdminMailRoute
   AppAdminSettingsRoute: typeof AppAdminSettingsRoute
+  AppGroupEmailTemplatesRoute: typeof AppGroupEmailTemplatesRoute
   AppGroupManageRoute: typeof AppGroupManageRoute
   AppInstrumentsAccessibleInstrumentsRoute: typeof AppInstrumentsAccessibleInstrumentsRoute
   AppSessionRemoteAssignmentRoute: typeof AppSessionRemoteAssignmentRoute
@@ -666,7 +706,9 @@ const AppRouteRouteChildren: AppRouteRouteChildren = {
   AppUserRoute: AppUserRoute,
   AppIndexRoute: AppIndexRoute,
   AppDatahubSubjectIdRouteRoute: AppDatahubSubjectIdRouteRouteWithChildren,
+  AppAdminMailRoute: AppAdminMailRoute,
   AppAdminSettingsRoute: AppAdminSettingsRoute,
+  AppGroupEmailTemplatesRoute: AppGroupEmailTemplatesRoute,
   AppGroupManageRoute: AppGroupManageRoute,
   AppInstrumentsAccessibleInstrumentsRoute:
     AppInstrumentsAccessibleInstrumentsRoute,
diff --git a/apps/web/src/routes/_app/admin/audit/logs.tsx b/apps/web/src/routes/_app/admin/audit/logs.tsx
index cd0973db7..f592fec38 100644
--- a/apps/web/src/routes/_app/admin/audit/logs.tsx
+++ b/apps/web/src/routes/_app/admin/audit/logs.tsx
@@ -22,7 +22,7 @@ type DateFormat = 'iso' | 'local';
 
 type SortOrder = 'asc' | 'desc';
 
-const ACTIONS: $AuditLogAction[] = ['CREATE', 'DELETE', 'UPDATE', 'LOGIN'];
+const ACTIONS: $AuditLogAction[] = ['CREATE', 'DELETE', 'UPDATE', 'LOGIN', 'SEND_EMAIL'];
 
 const ENTITIES: $AuditLogEntity[] = [
   'ASSIGNMENT',
@@ -178,7 +178,9 @@ const Toggles: React.FC<{ table: TanstackTable.Table<$AuditLog> }> = () => {
           />
           <SelectSingleFilterGroup
             label={t('common.action')}
-            options={Object.fromEntries(ACTIONS.map((action) => [action, t(`common.${toLowerCase(action)}`)]))}
+            options={Object.fromEntries(
+              ACTIONS.map((action) => [action, t(`common.${snakeToCamelCase(toLowerCase(action))}`)])
+            )}
             searchKey="action"
           />
           <SelectSingleFilterGroup
@@ -270,7 +272,7 @@ const AuditLogsTable: React.FC<{ search: AuditLogsSearchParams }> = ({ search })
             const value = ctx.getValue() as $AuditLogAction;
             return (
               <span className="overflow-hidden text-ellipsis whitespace-nowrap">
-                {t(`common.${toLowerCase(value)}`)}
+                {t(`common.${snakeToCamelCase(toLowerCase(value))}`)}
               </span>
             );
           },
diff --git a/apps/web/src/routes/_app/admin/mail.tsx b/apps/web/src/routes/_app/admin/mail.tsx
new file mode 100644
index 000000000..578a08baa
--- /dev/null
+++ b/apps/web/src/routes/_app/admin/mail.tsx
@@ -0,0 +1,30 @@
+import { Heading } from '@douglasneuroinformatics/libui/components';
+import { useTranslation } from '@douglasneuroinformatics/libui/hooks';
+import { createFileRoute } from '@tanstack/react-router';
+
+import { MailSettings } from '@/components/MailSettings';
+import { PageHeader } from '@/components/PageHeader';
+import { mailSettingsQueryOptions, useMailSettingsQuery } from '@/hooks/useMailSettingsQuery';
+
+const RouteComponent = () => {
+  const { t } = useTranslation();
+  const { data: settings } = useMailSettingsQuery();
+
+  return (
+    <div className="w-full">
+      <PageHeader>
+        <Heading className="text-center" variant="h2">
+          {t({ en: 'Mail Server', fr: 'Serveur de courriel' })}
+        </Heading>
+      </PageHeader>
+      <div className="mx-auto flex w-full max-w-3xl flex-col gap-6" data-testid="mail-settings-page">
+        <MailSettings config={settings.config} newUserEmailTemplate={settings.newUserEmailTemplate} />
+      </div>
+    </div>
+  );
+};
+
+export const Route = createFileRoute('/_app/admin/mail')({
+  component: RouteComponent,
+  loader: ({ context }) => context.queryClient.ensureQueryData(mailSettingsQueryOptions())
+});
diff --git a/apps/web/src/routes/_app/admin/users/create.tsx b/apps/web/src/routes/_app/admin/users/create.tsx
index abe2df35f..3a0afe013 100644
--- a/apps/web/src/routes/_app/admin/users/create.tsx
+++ b/apps/web/src/routes/_app/admin/users/create.tsx
@@ -1,17 +1,23 @@
 /* eslint-disable perfectionist/sort-objects */
 
+import React from 'react';
+
 import { estimatePasswordStrength } from '@douglasneuroinformatics/libpasswd';
-import { Form, Heading } from '@douglasneuroinformatics/libui/components';
+import { Button, CopyButton, Dialog, Form, Heading, Label } from '@douglasneuroinformatics/libui/components';
 import { useNotificationsStore, useTranslation } from '@douglasneuroinformatics/libui/hooks';
-import { $BasePermissionLevel, $CreateUserData } from '@opendatacapture/schemas/user';
+import type { Language } from '@opendatacapture/schemas/core';
+import { $BasePermissionLevel, $CreateUserData, PASSWORD_ERROR_CODES } from '@opendatacapture/schemas/user';
 import type { CreateUserData, PasswordErrorCode } from '@opendatacapture/schemas/user';
 import { createFileRoute, useNavigate } from '@tanstack/react-router';
-import axios from 'axios';
+import axios, { isAxiosError } from 'axios';
 import { z } from 'zod/v4';
 
+import { LanguageSelect } from '@/components/LanguageSelect';
 import { PageHeader } from '@/components/PageHeader';
 import { useCreateUserMutation } from '@/hooks/useCreateUserMutation';
 import { groupsQueryOptions, useGroupsQuery } from '@/hooks/useGroupsQuery';
+import { useMailErrorMessage } from '@/hooks/useMailErrorMessage';
+import { useSetupStateQuery } from '@/hooks/useSetupStateQuery';
 import { $Email, $PhoneNumber, omittedIfBlank } from '@/utils/validation';
 
 const PASSWORD_ERROR_TRANSLATION_KEYS = {
@@ -20,12 +26,26 @@ const PASSWORD_ERROR_TRANSLATION_KEYS = {
   PASSWORD_MATCHES_USERNAME: 'common.passwordMatchesUsername'
 } as const satisfies { [code in PasswordErrorCode]: string };
 
+function parsePasswordErrorCode(data: unknown): null | PasswordErrorCode {
+  if (typeof data === 'object' && data !== null && 'code' in data && typeof data.code === 'string') {
+    return (PASSWORD_ERROR_CODES as readonly string[]).includes(data.code) ? (data.code as PasswordErrorCode) : null;
+  }
+  return null;
+}
+
 const RouteComponent = () => {
-  const { t } = useTranslation();
+  const { resolvedLanguage, t } = useTranslation();
   const navigate = useNavigate();
   const groupsQuery = useGroupsQuery();
   const createUserMutation = useCreateUserMutation();
   const notification = useNotificationsStore();
+  const setupStateQuery = useSetupStateQuery();
+  const mailErrorMessage = useMailErrorMessage();
+
+  // When the welcome email cannot be delivered, we surface its rendered text here so
+  // the admin can copy it and send it manually. Navigation is deferred until dismissed.
+  const [fallbackMessage, setFallbackMessage] = React.useState<null | string>(null);
+  const [emailLanguage, setEmailLanguage] = React.useState<Language>(resolvedLanguage);
 
   const handleSubmit = async (data: CreateUserData) => {
     // check if username exists
@@ -41,18 +61,65 @@ const RouteComponent = () => {
       return;
     }
 
-    const result = await createUserMutation.mutateAsync({ data });
-    if (result.success) {
-      void navigate({ to: '..' });
+    const createUserFailedMessage = t({
+      en: 'Failed to create user',
+      fr: "Échec de la création de l'utilisateur"
+    });
+
+    let created;
+    try {
+      created = await createUserMutation.mutateAsync({ data, language: emailLanguage });
+    } catch (err) {
+      if (isAxiosError(err) && err.response?.status === 400) {
+        const code = parsePasswordErrorCode(err.response.data);
+        notification.addNotification({
+          message: code ? t(PASSWORD_ERROR_TRANSLATION_KEYS[code]) : createUserFailedMessage,
+          type: 'error'
+        });
+      } else {
+        notification.addNotification({
+          message: createUserFailedMessage,
+          type: 'error'
+        });
+      }
       return;
     }
-    // Stay on the form so the admin can correct the password (e.g. one found in a data breach).
-    notification.addNotification({
-      type: 'error',
-      message: result.code
-        ? t(PASSWORD_ERROR_TRANSLATION_KEYS[result.code])
-        : t({ en: 'Failed to create user', fr: "Échec de la création de l'utilisateur" })
-    });
+    const welcomeEmail = created.welcomeEmail;
+
+    // Only surface email outcomes when mail is enabled; otherwise behave exactly as before.
+    if (setupStateQuery.data.isMailEnabled && welcomeEmail) {
+      if (welcomeEmail.status === 'SENT') {
+        notification.addNotification({
+          message: t({
+            en: `A welcome email was sent to ${welcomeEmail.recipient ?? ''}`,
+            fr: `Un courriel de bienvenue a été envoyé à ${welcomeEmail.recipient ?? ''}`
+          }),
+          title: t({
+            en: 'Welcome email sent',
+            fr: 'Courriel de bienvenue envoyé'
+          }),
+          type: 'success'
+        });
+        void navigate({ to: '..' });
+        return;
+      }
+      if (welcomeEmail.status === 'FAILED' || welcomeEmail.status === 'NO_RECIPIENT') {
+        if (welcomeEmail.status === 'FAILED') {
+          notification.addNotification({
+            message: mailErrorMessage(welcomeEmail.error),
+            title: t({
+              en: 'Welcome email failed',
+              fr: 'Échec du courriel de bienvenue'
+            }),
+            type: 'error'
+          });
+        }
+        setFallbackMessage(welcomeEmail.message);
+        return;
+      }
+    }
+    notification.addNotification({ type: 'success' });
+    void navigate({ to: '..' });
   };
 
   return (
@@ -65,6 +132,17 @@ const RouteComponent = () => {
           })}
         </Heading>
       </PageHeader>
+      {setupStateQuery.data.isMailEnabled && (
+        <div className="mx-auto mb-6 flex max-w-3xl flex-col gap-1.5">
+          <Label>
+            {t({
+              en: 'Welcome email language',
+              fr: 'Langue du courriel de bienvenue'
+            })}
+          </Label>
+          <LanguageSelect data-testid="welcome-email-language" value={emailLanguage} onChange={setEmailLanguage} />
+        </div>
+      )}
       <Form
         className="mx-auto max-w-3xl"
         content={[
@@ -132,7 +210,7 @@ const RouteComponent = () => {
                 kind: 'boolean',
                 description: t({
                   en: 'Use this option if the user is not intended to log in, for example, when the account is used solely to identify the author of uploaded data.',
-                  fr: 'Utilisez cette option si l’utilisateur n’a pas vocation à se connecter, par exemple lorsque le compte sert uniquement à identifier l’auteur de données téléversées.'
+                  fr: "Utilisez cette option si l'utilisateur n'a pas vocation à se connecter, par exemple lorsque le compte sert uniquement à identifier l'auteur de données téléversées."
                 }),
                 label: t({
                   en: 'Disabled',
@@ -243,6 +321,42 @@ const RouteComponent = () => {
           })
         }
       />
+      <Dialog
+        open={fallbackMessage !== null}
+        onOpenChange={(open) => {
+          if (!open) {
+            setFallbackMessage(null);
+            void navigate({ to: '..' });
+          }
+        }}
+      >
+        <Dialog.Content className="max-w-lg">
+          <Dialog.Header>
+            <Dialog.Title>{t({ en: 'Welcome message', fr: 'Message de bienvenue' })}</Dialog.Title>
+            <Dialog.Description>
+              {t({
+                en: 'The welcome email could not be delivered automatically. Copy the message below and send it to the user manually.',
+                fr: "Le courriel de bienvenue n'a pas pu être livré automatiquement. Copiez le message ci-dessous et envoyez-le manuellement à l'utilisateur."
+              })}
+            </Dialog.Description>
+          </Dialog.Header>
+          <pre className="bg-muted max-h-72 overflow-auto whitespace-pre-wrap rounded-md p-4 text-sm">
+            {fallbackMessage}
+          </pre>
+          <Dialog.Footer>
+            <CopyButton size="md" text={fallbackMessage ?? ''} variant="outline" />
+            <Button
+              type="button"
+              onClick={() => {
+                setFallbackMessage(null);
+                void navigate({ to: '..' });
+              }}
+            >
+              {t({ en: 'Done', fr: 'Terminé' })}
+            </Button>
+          </Dialog.Footer>
+        </Dialog.Content>
+      </Dialog>
     </div>
   );
 };
diff --git a/apps/web/src/routes/_app/datahub/$subjectId/assignments.tsx b/apps/web/src/routes/_app/datahub/$subjectId/assignments.tsx
index 63a8c07e2..6a936c84c 100644
--- a/apps/web/src/routes/_app/datahub/$subjectId/assignments.tsx
+++ b/apps/web/src/routes/_app/datahub/$subjectId/assignments.tsx
@@ -11,6 +11,7 @@ import type { Assignment, AssignmentStatus } from '@opendatacapture/schemas/assi
 import type { UnilingualInstrumentInfo } from '@opendatacapture/schemas/instrument';
 import { createFileRoute } from '@tanstack/react-router';
 
+import { AssignmentEmailForm } from '@/components/AssignmentEmailForm';
 import { QRCode } from '@/components/QRCode';
 import { useAssignmentsQuery } from '@/hooks/useAssignmentsQuery';
 import { useInstrument } from '@/hooks/useInstrument';
@@ -25,6 +26,10 @@ const AssignmentSlider: React.FC<{
 }> = ({ assignment, isOpen, onCancel, setIsOpen }) => {
   const { t } = useTranslation();
   const instrument = useInstrument(assignment?.instrumentId ?? null);
+  const instrumentInfoQuery = useInstrumentInfoQuery();
+  const instrumentLanguages = instrumentInfoQuery.data?.find(
+    (i) => i.id === assignment?.instrumentId
+  )?.supportedLanguages;
 
   return (
     <Sheet open={Boolean(isOpen && assignment && instrument)} onOpenChange={setIsOpen}>
@@ -45,6 +50,10 @@ const AssignmentSlider: React.FC<{
               <CopyButton size="sm" text={assignment?.url ?? ''} variant="outline" />
             </div>
             <QRCode url={assignment?.url ?? 'javascript:void(0)'} />
+            {/* Only an outstanding assignment can still be completed, so only it is worth emailing. */}
+            {assignment?.status === 'OUTSTANDING' && (
+              <AssignmentEmailForm assignment={assignment} instrumentLanguages={instrumentLanguages} />
+            )}
           </div>
         </Sheet.Body>
         <Sheet.Footer>
diff --git a/apps/web/src/routes/_app/group/email-templates.tsx b/apps/web/src/routes/_app/group/email-templates.tsx
new file mode 100644
index 000000000..bd15d9666
--- /dev/null
+++ b/apps/web/src/routes/_app/group/email-templates.tsx
@@ -0,0 +1,27 @@
+import React from 'react';
+
+import { Heading } from '@douglasneuroinformatics/libui/components';
+import { useTranslation } from '@douglasneuroinformatics/libui/hooks';
+import { createFileRoute } from '@tanstack/react-router';
+
+import { GroupEmailTemplates } from '@/components/GroupEmailTemplates';
+import { PageHeader } from '@/components/PageHeader';
+
+const RouteComponent = () => {
+  const { t } = useTranslation();
+
+  return (
+    <React.Fragment>
+      <PageHeader>
+        <Heading className="text-center" variant="h2">
+          {t({ en: 'Email Templates', fr: 'Modèles de courriel' })}
+        </Heading>
+      </PageHeader>
+      <GroupEmailTemplates />
+    </React.Fragment>
+  );
+};
+
+export const Route = createFileRoute('/_app/group/email-templates')({
+  component: RouteComponent
+});
diff --git a/apps/web/src/routes/_app/session/remote-assignment.tsx b/apps/web/src/routes/_app/session/remote-assignment.tsx
index c282660a8..9092ec273 100644
--- a/apps/web/src/routes/_app/session/remote-assignment.tsx
+++ b/apps/web/src/routes/_app/session/remote-assignment.tsx
@@ -3,11 +3,12 @@ import React, { useEffect, useState } from 'react';
 import { Button, Dialog, Form, Heading, Input, Label, Sheet } from '@douglasneuroinformatics/libui/components';
 import { useTranslation } from '@douglasneuroinformatics/libui/hooks';
 import { CopyButton } from '@opendatacapture/react-core';
-import type { CreateAssignmentData } from '@opendatacapture/schemas/assignment';
+import type { Assignment, CreateAssignmentData } from '@opendatacapture/schemas/assignment';
 import type { TranslatedInstrumentInfo } from '@opendatacapture/schemas/instrument';
 import { createFileRoute, useNavigate } from '@tanstack/react-router';
 import { z } from 'zod/v4';
 
+import { AssignmentEmailForm } from '@/components/AssignmentEmailForm';
 import { InstrumentShowcase } from '@/components/InstrumentShowcase';
 import { PageHeader } from '@/components/PageHeader';
 import { QRCode } from '@/components/QRCode';
@@ -20,12 +21,15 @@ import { getDefaultAssignmentExpiry } from '@/utils/assignment-duration';
 
 /** Slide-over panel shown after an assignment is created, displaying the URL, copy button, and QR code */
 const AssignmentResultSlider: React.FC<{
+  assignment: Assignment | null;
+  instrumentLanguages?: string[];
   isOpen: boolean;
   setIsOpen: (isOpen: boolean) => void;
   title: string | undefined;
-  url: string | undefined;
-}> = ({ isOpen, setIsOpen, title, url }) => {
+}> = ({ assignment, instrumentLanguages, isOpen, setIsOpen, title }) => {
   const { t } = useTranslation();
+  const url = assignment?.url;
+
   return (
     <Sheet open={isOpen} onOpenChange={setIsOpen}>
       <Sheet.Content className="flex h-full flex-col">
@@ -38,7 +42,7 @@ const AssignmentResultSlider: React.FC<{
             })}
           </Sheet.Description>
         </Sheet.Header>
-        <Sheet.Body className="grow">
+        <Sheet.Body className="min-h-0 flex-1 overflow-y-auto">
           <div className="flex flex-col gap-3">
             <Label asChild>
               <a className="hover:underline" href={url} rel="noreferrer" target="_blank">
@@ -53,6 +57,7 @@ const AssignmentResultSlider: React.FC<{
               <CopyButton size="sm" text={url ?? ''} variant="outline" />
             </div>
             <QRCode url={url ?? 'javascript:void(0)'} />
+            <AssignmentEmailForm assignment={assignment} instrumentLanguages={instrumentLanguages} />
           </div>
         </Sheet.Body>
         <Sheet.Footer>
@@ -87,7 +92,7 @@ const RouteComponent = () => {
   const [selectedInstrument, setSelectedInstrument] = useState<null | TranslatedInstrumentInfo>(null);
   const [isCreateModalOpen, setIsCreateModalOpen] = useState(false);
   const [isResultSliderOpen, setIsResultSliderOpen] = useState(false);
-  const [assignmentUrl, setAssignmentUrl] = useState<string | undefined>(undefined);
+  const [assignment, setAssignment] = useState<Assignment | null>(null);
 
   useEffect(() => {
     if (!currentSession) {
@@ -179,7 +184,7 @@ const RouteComponent = () => {
               }) satisfies z.ZodType<Pick<CreateAssignmentData, 'expiresAt'>>
             }
             onSubmit={async ({ expiresAt }) => {
-              const assignment = await createAssignmentMutation.mutateAsync({
+              const created = await createAssignmentMutation.mutateAsync({
                 data: {
                   expiresAt,
                   groupId: currentGroup?.id,
@@ -187,7 +192,7 @@ const RouteComponent = () => {
                   subjectId: currentSession.subjectId
                 }
               });
-              setAssignmentUrl(assignment.url);
+              setAssignment(created);
               setIsCreateModalOpen(false);
               setIsResultSliderOpen(true);
             }}
@@ -195,10 +200,11 @@ const RouteComponent = () => {
         </Dialog.Content>
       </Dialog>
       <AssignmentResultSlider
+        assignment={assignment}
+        instrumentLanguages={selectedInstrument?.supportedLanguages}
         isOpen={isResultSliderOpen}
         setIsOpen={setIsResultSliderOpen}
         title={selectedInstrument?.details.title}
-        url={assignmentUrl}
       />
     </div>
   );
diff --git a/apps/web/src/translations/common.json b/apps/web/src/translations/common.json
index e59972ec7..07e91a82c 100644
--- a/apps/web/src/translations/common.json
+++ b/apps/web/src/translations/common.json
@@ -173,6 +173,10 @@
     "en": "Research",
     "fr": "Recherche"
   },
+  "sendEmail": {
+    "en": "Send email",
+    "fr": "Envoyer un courriel"
+  },
   "session": {
     "en": "Session",
     "fr": "Session"
diff --git a/apps/web/src/utils/__tests__/email-template.test.ts b/apps/web/src/utils/__tests__/email-template.test.ts
new file mode 100644
index 000000000..1586472f1
--- /dev/null
+++ b/apps/web/src/utils/__tests__/email-template.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest';
+
+import { checkTemplateIssue } from '../email-template';
+
+describe('checkTemplateIssue', () => {
+  const subject = { en: 'Subject', fr: 'Objet' };
+  const body = { en: 'Link {{url}}', fr: 'Lien {{url}}' };
+
+  it('should report no issue when every authored language is complete', () => {
+    expect(checkTemplateIssue(subject, body, ['url'])).toBeNull();
+  });
+
+  it('should report incomplete when a language has a body but no subject', () => {
+    expect(checkTemplateIssue({ en: 'Subject' }, body, ['url'], ['en', 'fr'])).toBe('incomplete');
+  });
+
+  it('should report incomplete when a subject is only whitespace', () => {
+    expect(checkTemplateIssue({ en: '   ' }, { en: 'Link {{url}}' }, ['url'], ['en'])).toBe('incomplete');
+  });
+
+  it('should report missing-vars when a required placeholder is absent', () => {
+    expect(checkTemplateIssue(subject, { en: 'No link here', fr: 'Lien {{url}}' }, ['url'], ['en'])).toBe(
+      'missing-vars'
+    );
+  });
+
+  it('should tolerate whitespace inside a placeholder', () => {
+    expect(checkTemplateIssue({ en: 'Subject' }, { en: 'Link {{ url }}' }, ['url'], ['en'])).toBeNull();
+  });
+
+  it('should report incomplete when nothing has been authored at all', () => {
+    expect(checkTemplateIssue({}, {}, ['url'])).toBe('incomplete');
+  });
+
+  // A pristine create form has no content yet, so validation must scope to what was authored.
+  it('should ignore a language the author has not started', () => {
+    expect(checkTemplateIssue({ en: 'Subject' }, { en: 'Link {{url}}' }, ['url'], ['en'])).toBeNull();
+  });
+});
diff --git a/apps/web/src/utils/email-template.ts b/apps/web/src/utils/email-template.ts
new file mode 100644
index 000000000..a47a9a604
--- /dev/null
+++ b/apps/web/src/utils/email-template.ts
@@ -0,0 +1,46 @@
+import type { Language, LocalizedString } from '@opendatacapture/schemas/core';
+
+import { authoredLanguages } from './language';
+
+/** Whether a body string contains a given `{{variable}}` placeholder. */
+function hasVar(body: string, name: string): boolean {
+  return new RegExp(`\\{\\{\\s*${name}\\s*\\}\\}`).test(body);
+}
+
+/** Placeholders a remote-assignment email template may use. */
+export const ASSIGNMENT_TEMPLATE_VARS = ['url', 'expiresAt'] as const;
+
+/** Placeholders the new-user welcome template may use, and the subset it must use. */
+export const NEW_USER_TEMPLATE_VARS = ['firstName', 'lastName', 'username', 'group', 'url'] as const;
+export const REQUIRED_NEW_USER_TEMPLATE_VARS = ['username'] as const;
+
+export type TemplateIssue = 'incomplete' | 'missing-vars' | null;
+
+/**
+ * What (if anything) is wrong with a template for the given languages:
+ * `incomplete` when a required language's subject/body is blank,
+ * `missing-vars` when the body omits a required variable, otherwise `null`.
+ * When no `languages` are supplied, checks every language the body has been authored in.
+ */
+export function checkTemplateIssue(
+  subject: LocalizedString,
+  body: LocalizedString,
+  requiredVars: readonly string[],
+  languages?: readonly Language[]
+): TemplateIssue {
+  const targets = languages ?? authoredLanguages(body);
+  if (targets.length === 0) {
+    return 'incomplete';
+  }
+  for (const language of targets) {
+    const localizedSubject = subject[language];
+    const localizedBody = body[language];
+    if (!localizedSubject?.trim() || !localizedBody?.trim()) {
+      return 'incomplete';
+    }
+    if (requiredVars.some((name) => !hasVar(localizedBody, name))) {
+      return 'missing-vars';
+    }
+  }
+  return null;
+}
diff --git a/apps/web/src/utils/language.ts b/apps/web/src/utils/language.ts
new file mode 100644
index 000000000..59a77e31a
--- /dev/null
+++ b/apps/web/src/utils/language.ts
@@ -0,0 +1,23 @@
+import type { Language, LocalizedString } from '@opendatacapture/schemas/core';
+
+/**
+ * The `satisfies` keeps this in step with {@link Language}: adding a language fails to compile
+ * until it is named here, which is also what supplies the ordered list of authorable languages.
+ */
+export const LANGUAGE_LABELS = {
+  en: { en: 'English', fr: 'Anglais' },
+  fr: { en: 'French', fr: 'Français' }
+} as const satisfies { [L in Language]: { en: string; fr: string } };
+
+export const LANGUAGES = Object.keys(LANGUAGE_LABELS) as Language[];
+
+/** The languages a localized string has non-blank content in, in {@link LANGUAGES} order. */
+export const authoredLanguages = (value: LocalizedString | null | undefined): Language[] =>
+  LANGUAGES.filter((code) => value?.[code]?.trim());
+
+/**
+ * Keep only the languages that were actually authored. Iterating {@link LANGUAGES} rather than the
+ * value's own keys is what stops anything but a known language reaching the API.
+ */
+export const omitBlankLanguages = (value: LocalizedString | null | undefined): LocalizedString =>
+  Object.fromEntries(authoredLanguages(value).map((code) => [code, value?.[code]]));
diff --git a/eslint.config.js b/eslint.config.js
index 2eb91425a..da20b52e5 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -142,6 +142,7 @@ export default config(
           // Punctuation and separators carry no meaning to translate, and proper nouns must survive
           // translation unchanged.
           allowedStrings: [
+            '%',
             '&copy;',
             '(',
             ')',
@@ -153,10 +154,11 @@ export default config(
             'EN',
             'FR',
             'Open Data Capture',
+            'SSL/TLS',
+            'STARTTLS',
             '×',
             '·',
-            '—',
-            '%'
+            '—'
           ],
           ignoreProps: true,
           noStrings: true
diff --git a/packages/schemas/package.json b/packages/schemas/package.json
index 229088f1d..c0fc171d2 100644
--- a/packages/schemas/package.json
+++ b/packages/schemas/package.json
@@ -14,6 +14,7 @@
     "./instrument": "./src/instrument/instrument.ts",
     "./instrument-records": "./src/instrument-records/instrument-records.ts",
     "./instrument-repo": "./src/instrument-repo/instrument-repo.ts",
+    "./mail": "./src/mail/mail.ts",
     "./session": "./src/session/session.ts",
     "./setup": "./src/setup/setup.ts",
     "./storage": "./src/storage/storage.ts",
diff --git a/packages/schemas/src/audit/audit.ts b/packages/schemas/src/audit/audit.ts
index e12af26e1..42306ae37 100644
--- a/packages/schemas/src/audit/audit.ts
+++ b/packages/schemas/src/audit/audit.ts
@@ -4,7 +4,7 @@ import { $Group } from '../group/group.js';
 import { $User } from '../user/user.js';
 
 export type $AuditLogAction = z.infer<typeof $AuditLogAction>;
-export const $AuditLogAction = z.enum(['CREATE', 'UPDATE', 'DELETE', 'LOGIN']);
+export const $AuditLogAction = z.enum(['CREATE', 'UPDATE', 'DELETE', 'LOGIN', 'SEND_EMAIL']);
 
 export type $AuditLogEntity = z.infer<typeof $AuditLogEntity>;
 export const $AuditLogEntity = z.enum([
diff --git a/packages/schemas/src/core/core.ts b/packages/schemas/src/core/core.ts
index b75df6cf3..858a756a9 100644
--- a/packages/schemas/src/core/core.ts
+++ b/packages/schemas/src/core/core.ts
@@ -36,6 +36,20 @@ export const $Permissions = z.array($UserPermission);
 
 export const $Language: z.ZodType<Language> = z.enum(['en', 'fr']);
 
+/**
+ * A string authored in each of the application's languages. Every field is nullish so content
+ * may target a single language, and nullish rather than optional to match Prisma's
+ * null-for-absent convention.
+ *
+ * The `satisfies` is what keeps this in step with {@link Language}: the shape must name every
+ * language, so adding one to `Language` fails to compile until it is added here too.
+ */
+export type LocalizedString = z.infer<typeof $LocalizedString>;
+export const $LocalizedString = z.object({
+  en: z.string().nullish(),
+  fr: z.string().nullish()
+} satisfies { [L in Language]: z.ZodType<null | string | undefined> });
+
 export type BaseModel = z.infer<typeof $BaseModel>;
 export const $BaseModel = z.object({
   createdAt: z.coerce.date(),
diff --git a/packages/schemas/src/group/group.ts b/packages/schemas/src/group/group.ts
index 755ae8204..9968a2e83 100644
--- a/packages/schemas/src/group/group.ts
+++ b/packages/schemas/src/group/group.ts
@@ -1,6 +1,6 @@
 import { z } from 'zod/v4';
 
-import { $BaseModel, $RegexString } from '../core/core.js';
+import { $BaseModel, $LocalizedString, $RegexString } from '../core/core.js';
 import { $SubjectIdentificationMethod } from '../subject/subject.js';
 
 export type GroupSettings = z.infer<typeof $GroupSettings>;
@@ -20,9 +20,25 @@ export const $GroupSettings = z.object({
 export type GroupType = z.infer<typeof $GroupType>;
 export const $GroupType = z.enum(['CLINICAL', 'RESEARCH']);
 
+/**
+ * A named remote-assignment email template authored by a group manager. Bodies support the
+ * `{{url}}` and `{{expiresAt}}` placeholders.
+ */
+export type GroupEmailTemplate = z.infer<typeof $GroupEmailTemplate>;
+export const $GroupEmailTemplate = z.object({
+  body: $LocalizedString.nullish(),
+  id: z.string().min(1),
+  name: z.string().min(1),
+  subject: $LocalizedString.nullish()
+});
+
 export type Group = z.infer<typeof $Group>;
 export const $Group = $BaseModel.extend({
   accessibleInstrumentIds: z.array(z.string()),
+  /** The id of the template within `emailTemplates` sent by default with a remote assignment, if any */
+  activeAssignmentEmailTemplateId: z.string().nullish(),
+  /** Group-manager-authored remote-assignment email templates for this group's participants */
+  emailTemplates: z.array($GroupEmailTemplate).optional(),
   instrumentRepoIds: z.array(z.string()),
   name: z.string().min(1),
   settings: $GroupSettings,
@@ -47,4 +63,23 @@ export const $UpdateGroupData = $Group
   .extend({
     settings: $GroupSettings.partial()
   })
-  .partial();
+  .partial()
+  .extend({
+    /**
+     * The `updatedAt` of the group revision this update was composed against. The server rejects
+     * the write when the group has moved on since.
+     */
+    expectedUpdatedAt: z.coerce.date().optional()
+  })
+  .check((ctx) => {
+    // `emailTemplates` is replaced wholesale from the client's cached copy, so without a revision
+    // to check against, two managers editing concurrently would each silently discard the other's.
+    if (ctx.value.emailTemplates && !ctx.value.expectedUpdatedAt) {
+      ctx.issues.push({
+        code: 'custom',
+        input: ctx.value.expectedUpdatedAt,
+        message: 'expectedUpdatedAt is required when updating emailTemplates',
+        path: ['expectedUpdatedAt']
+      });
+    }
+  });
diff --git a/packages/schemas/src/mail/mail.test.ts b/packages/schemas/src/mail/mail.test.ts
new file mode 100644
index 000000000..6ee5d36f1
--- /dev/null
+++ b/packages/schemas/src/mail/mail.test.ts
@@ -0,0 +1,127 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  $MailConfig,
+  $MailConfigDto,
+  $UpdateMailConfigData,
+  DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE,
+  DEFAULT_NEW_USER_EMAIL_TEMPLATE,
+  isMailEnabled,
+  isSameMailServer
+} from './mail.js';
+
+import type { MailConfig } from './mail.js';
+
+const config: MailConfig = {
+  enabled: true,
+  encryption: 'starttls',
+  host: 'smtp.example.org',
+  password: 'secret',
+  port: 587,
+  senderAddress: 'noreply@example.org',
+  senderName: 'ODC',
+  username: 'user'
+};
+
+describe('$MailConfig', () => {
+  it('should accept a complete SMTP configuration', () => {
+    expect($MailConfig.safeParse(config).success).toBe(true);
+  });
+
+  it.each(['host', 'username'])('should reject a blank %s', (field) => {
+    expect($MailConfig.safeParse({ ...config, [field]: '' }).success).toBe(false);
+  });
+
+  it('should reject a sender address that is not an email', () => {
+    expect($MailConfig.safeParse({ ...config, senderAddress: 'not-an-email' }).success).toBe(false);
+  });
+
+  it.each([0, 65536, 1.5])('should reject the port %s', (port) => {
+    expect($MailConfig.safeParse({ ...config, port }).success).toBe(false);
+  });
+});
+
+// The whole reason these two schemas exist is that the password must never reach a client.
+describe('$MailConfigDto', () => {
+  it('should strip the password from a parsed configuration', () => {
+    const parsed = $MailConfigDto.parse({ ...config, hasPassword: true });
+    expect(parsed).not.toHaveProperty('password');
+    expect(parsed.hasPassword).toBe(true);
+  });
+
+  it('should not accept a password even when one is supplied', () => {
+    expect($MailConfigDto.parse({ ...config, hasPassword: true, password: 'leaked' })).not.toHaveProperty('password');
+  });
+});
+
+describe('$UpdateMailConfigData', () => {
+  it('should accept an update that omits the password', () => {
+    const { password: _password, ...withoutPassword } = config;
+    expect($UpdateMailConfigData.safeParse(withoutPassword).success).toBe(true);
+  });
+
+  it('should accept an update that sets a new password', () => {
+    expect($UpdateMailConfigData.parse(config).password).toBe('secret');
+  });
+});
+
+describe('isMailEnabled', () => {
+  it('should be true for a configuration that is switched on', () => {
+    expect(isMailEnabled(config)).toBe(true);
+  });
+
+  it.each([
+    ['disabled', { ...config, enabled: false }],
+    ['null', null],
+    ['undefined', undefined]
+  ])('should be false when the configuration is %s', (_label, value) => {
+    expect(isMailEnabled(value)).toBe(false);
+  });
+
+  // The server refuses to send with a config that no longer parses, so the public flag has to
+  // agree — otherwise the UI offers email that silently never arrives.
+  it.each([
+    ['a blank host', { ...config, host: '' }],
+    ['a blank username', { ...config, username: '' }],
+    ['an unparseable sender address', { ...config, senderAddress: 'not-an-email' }]
+  ])('should be false for a stored configuration with %s, even when enabled', (_label, value) => {
+    expect(value.enabled).toBe(true);
+    expect(isMailEnabled(value)).toBe(false);
+  });
+});
+
+// Both the API (which refuses the update) and the mail settings form (which asks for the password
+// back) branch on this, so a disagreement would let the stored secret reach an unintended server.
+describe('isSameMailServer', () => {
+  it('should be true when only non-identifying fields differ', () => {
+    const rebranded: MailConfig = { ...config, senderAddress: 'other@example.org', senderName: 'Other' };
+    expect(isSameMailServer(config, rebranded)).toBe(true);
+  });
+
+  it.each<[string, MailConfig]>([
+    ['host', { ...config, host: 'smtp.other.org' }],
+    ['username', { ...config, username: 'other' }],
+    ['port', { ...config, port: 2525 }],
+    ['encryption', { ...config, encryption: 'none' }]
+  ])('should be false when the %s differs, since it identifies the server holding the password', (_field, other) => {
+    expect(isSameMailServer(config, other)).toBe(false);
+  });
+});
+
+describe('default templates', () => {
+  it.each(['en', 'fr'] as const)('should carry the required placeholders in %s', (language) => {
+    expect(DEFAULT_NEW_USER_EMAIL_TEMPLATE.body[language]).toContain('{{username}}');
+    expect(DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE.body[language]).toContain('{{url}}');
+    expect(DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE.body[language]).toContain('{{expiresAt}}');
+  });
+
+  it.each(['en', 'fr'] as const)('should have a non-empty subject and body in %s', (language) => {
+    expect(DEFAULT_NEW_USER_EMAIL_TEMPLATE.subject[language].trim()).toBeTruthy();
+    expect(DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE.subject[language].trim()).toBeTruthy();
+  });
+
+  // Emailing a cleartext password is the thing this flow was changed to stop doing.
+  it('should not put a password in the new-user welcome email', () => {
+    expect(JSON.stringify(DEFAULT_NEW_USER_EMAIL_TEMPLATE)).not.toContain('{{password}}');
+  });
+});
diff --git a/packages/schemas/src/mail/mail.ts b/packages/schemas/src/mail/mail.ts
new file mode 100644
index 000000000..155130515
--- /dev/null
+++ b/packages/schemas/src/mail/mail.ts
@@ -0,0 +1,269 @@
+import { z } from 'zod/v4';
+
+import { $Language, $LocalizedString } from '../core/core.js';
+
+// ── Internal helpers (must precede all exports for import/exports-last) ───────
+
+/**
+ * How the connection to the SMTP server is secured.
+ * - `none`     — plain, unencrypted connection (typically port 25; not recommended)
+ * - `starttls` — upgrade a plain connection to TLS via STARTTLS (typically port 587)
+ * - `ssl`      — implicit TLS for the whole connection (typically port 465)
+ */
+const $MailEncryption = z.enum(['none', 'starttls', 'ssl']);
+
+const $Port = z.number().int().positive().max(65535);
+
+/**
+ * The mail configuration as persisted server-side. This includes the SMTP `password` and
+ * therefore must NEVER be returned to a client — use {@link $MailConfigDto} for anything sent
+ * to the browser.
+ */
+const $MailConfig = z.object({
+  enabled: z.boolean(),
+  encryption: $MailEncryption,
+  host: z.string().min(1),
+  password: z.string(),
+  port: $Port,
+  senderAddress: z.email(),
+  senderName: z.string().nullish(),
+  username: z.string().min(1)
+});
+
+/**
+ * The mail configuration as exposed to an authenticated admin client. The secret `password` is
+ * replaced by a `hasPassword` boolean so the UI can show that one is set without transmitting it.
+ */
+const $MailConfigDto = $MailConfig.omit({ password: true }).extend({
+  hasPassword: z.boolean()
+});
+
+/**
+ * The payload an admin submits to update the mail configuration. `password` is optional: when
+ * omitted or left blank the stored value is kept, which lets the form round-trip without ever
+ * holding the secret.
+ */
+const $UpdateMailConfigData = $MailConfig.omit({ password: true }).extend({
+  password: z.string().optional()
+});
+
+/** The fields that together identify which SMTP server a configuration points at. */
+type MailServerIdentity = Pick<z.infer<typeof $MailConfig>, 'encryption' | 'host' | 'port' | 'username'>;
+
+/**
+ * An editable email template with per-language subject/body. Bodies may contain `{{variable}}`
+ * placeholders. The sender selects a language at send time.
+ */
+const $MailTemplate = z.object({
+  body: $LocalizedString,
+  subject: $LocalizedString
+});
+
+const $MailSettings = z.object({
+  /** Null when the instance has never been configured */
+  config: $MailConfigDto.nullable(),
+  newUserEmailTemplate: $MailTemplate
+});
+
+const $UpdateMailSettingsData = z.object({
+  config: $UpdateMailConfigData.optional(),
+  newUserEmailTemplate: $MailTemplate.optional()
+});
+
+/**
+ * Request body for the "test connection / send test email" endpoint. When `config` is provided
+ * the supplied (possibly unsaved) settings are tested, otherwise the saved configuration is
+ * used. When `recipient` is provided a real test message is delivered to it; otherwise only the
+ * connection is verified.
+ */
+const $TestMailData = z.object({
+  config: $UpdateMailConfigData.optional(),
+  recipient: z.email().optional()
+});
+
+/**
+ * Why an outgoing message could not be delivered. A code rather than prose, so the client can
+ * render it in the reader's language — the server has no idea who is looking at the result.
+ * - `AUTHENTICATION_FAILED` — the server rejected the username/password
+ * - `HOST_NOT_FOUND`        — the host name does not resolve
+ * - `CONNECTION_REFUSED`    — the host resolved but refused the connection
+ * - `INSECURE_CONNECTION`   — TLS could not be established for the chosen port/encryption
+ * - `SENDER_REJECTED`       — the server refused the configured sender address
+ * - `UNKNOWN`               — anything else, including timeouts
+ */
+const $MailErrorCode = z.enum([
+  'AUTHENTICATION_FAILED',
+  'HOST_NOT_FOUND',
+  'CONNECTION_REFUSED',
+  'INSECURE_CONNECTION',
+  'SENDER_REJECTED',
+  'UNKNOWN'
+]);
+
+const $TestMailResult = z.object({
+  error: $MailErrorCode.nullish(),
+  success: z.boolean()
+});
+
+/**
+ * The outcome of an attempt to deliver a feature email (e.g. the new-user welcome
+ * message). `message` always holds the fully-rendered, copy-pasteable text so the
+ * UI can fall back to manual delivery when sending is impossible.
+ * - `SENT`          — handed off to the provider successfully
+ * - `FAILED`        — sending was attempted but errored
+ * - `NO_RECIPIENT`  — mail is enabled but the record has no email address
+ * - `DISABLED`      — mail is globally disabled (UI should ignore this silently)
+ */
+const $EmailDeliveryResult = z.object({
+  error: $MailErrorCode.nullish(),
+  message: z.string(),
+  recipient: z.string().nullish(),
+  status: z.enum(['SENT', 'FAILED', 'NO_RECIPIENT', 'DISABLED'])
+});
+
+const $SendAssignmentEmailData = z.object({
+  language: $Language.default('en'),
+  recipient: z.email(),
+  /**
+   * Which template to send: a template id, `null` for the built-in default, or omitted to fall
+   * back to the group's active template (then the built-in default).
+   */
+  templateId: z.string().nullish()
+});
+
+/** Default subject/body (per language) seeded into the new-user template the first time it is read. */
+const DEFAULT_NEW_USER_EMAIL_TEMPLATE = {
+  body: {
+    en: [
+      'Hello {{firstName}},',
+      '',
+      'An account has been created for you on Open Data Capture.',
+      '',
+      'Username: {{username}}',
+      'Group(s): {{group}}',
+      '',
+      'You can log in here: {{url}}',
+      '',
+      'Your administrator will provide your password separately. For security, please change it after signing in for the first time.',
+      '',
+      'New to Open Data Capture? This guide will help you get started:',
+      'https://opendatacapture.org/en/docs/guides/how-to-get-started-with-odc/'
+    ].join('\n'),
+    fr: [
+      'Bonjour {{firstName}},',
+      '',
+      'Un compte a été créé pour vous sur Open Data Capture.',
+      '',
+      "Nom d'utilisateur : {{username}}",
+      'Groupe(s) : {{group}}',
+      '',
+      'Vous pouvez vous connecter ici : {{url}}',
+      '',
+      'Votre administrateur vous transmettra votre mot de passe séparément. Pour des raisons de sécurité, veuillez le changer après votre première connexion.',
+      '',
+      'Nouveau sur Open Data Capture ? Ce guide vous aidera à démarrer :',
+      'https://opendatacapture.org/fr/docs/guides/how-to-get-started-with-odc/'
+    ].join('\n')
+  },
+  subject: {
+    en: 'Your Open Data Capture account',
+    fr: 'Votre compte Open Data Capture'
+  }
+} as const satisfies z.infer<typeof $MailTemplate>;
+
+/** Default subject/body (per language) seeded into the remote-assignment template the first time it is read. */
+const DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE = {
+  body: {
+    en: [
+      'Hello,',
+      '',
+      'You have been assigned a questionnaire to complete on Open Data Capture.',
+      '',
+      'Please complete it using the secure link below:',
+      '{{url}}',
+      '',
+      'This link expires on {{expiresAt}}.',
+      '',
+      'Thank you.'
+    ].join('\n'),
+    fr: [
+      'Bonjour,',
+      '',
+      'Un questionnaire vous a été assigné à compléter sur Open Data Capture.',
+      '',
+      'Veuillez le compléter en utilisant le lien sécurisé ci-dessous :',
+      '{{url}}',
+      '',
+      'Ce lien expire le {{expiresAt}}.',
+      '',
+      'Merci.'
+    ].join('\n')
+  },
+  subject: {
+    en: 'Your Open Data Capture assignment',
+    fr: 'Votre évaluation Open Data Capture'
+  }
+} as const satisfies z.infer<typeof $MailTemplate>;
+
+/**
+ * The single definition of "outgoing mail is on". `SetupService` reports this to clients as the
+ * public `isMailEnabled` flag and `MailService` gates sending on it.
+ *
+ * It takes the **raw stored value** and validates it here, rather than a already-parsed config,
+ * because that is the only way the two sides cannot disagree: a stored configuration that no
+ * longer satisfies `$MailConfig` has to count as off for the client flag exactly as it does for
+ * the server, which refuses to send with it.
+ */
+function isMailEnabled(storedConfig: unknown): boolean {
+  const result = $MailConfig.safeParse(storedConfig);
+  return result.success && result.data.enabled;
+}
+
+/**
+ * Whether two configurations address the same SMTP server.
+ *
+ * A blank password means "keep the stored one", so the secret never has to round-trip to the
+ * client. That inheritance is confined to the server the password belongs to: otherwise
+ * `POST /v1/mail/test` could aim an arbitrary host at the stored credential and read it back off
+ * the resulting SMTP AUTH. `encryption` counts as part of the server's identity — without it an
+ * admin could flip a configured host to `none` and have the test endpoint offer the stored
+ * password in the clear.
+ *
+ * `MailService` refuses such an update and the mail settings form asks for the password back;
+ * they share this predicate so the two cannot disagree about what "the same server" means.
+ */
+function isSameMailServer(a: MailServerIdentity, b: MailServerIdentity): boolean {
+  return a.host === b.host && a.username === b.username && a.port === b.port && a.encryption === b.encryption;
+}
+
+// ── Exports ──────────────────────────────────────────────────────────────────
+
+export type EmailDeliveryResult = z.infer<typeof $EmailDeliveryResult>;
+export type MailConfig = z.infer<typeof $MailConfig>;
+export type MailConfigDto = z.infer<typeof $MailConfigDto>;
+export type MailEncryption = z.infer<typeof $MailEncryption>;
+export type MailErrorCode = z.infer<typeof $MailErrorCode>;
+export type MailSettings = z.infer<typeof $MailSettings>;
+export type MailTemplate = z.infer<typeof $MailTemplate>;
+export type SendAssignmentEmailData = z.infer<typeof $SendAssignmentEmailData>;
+export type TestMailData = z.infer<typeof $TestMailData>;
+export type TestMailResult = z.infer<typeof $TestMailResult>;
+export type UpdateMailConfigData = z.infer<typeof $UpdateMailConfigData>;
+export type UpdateMailSettingsData = z.infer<typeof $UpdateMailSettingsData>;
+
+export {
+  $EmailDeliveryResult,
+  $MailConfig,
+  $MailConfigDto,
+  $MailEncryption,
+  $MailSettings,
+  $SendAssignmentEmailData,
+  $TestMailData,
+  $TestMailResult,
+  $UpdateMailConfigData,
+  $UpdateMailSettingsData,
+  DEFAULT_ASSIGNMENT_EMAIL_TEMPLATE,
+  DEFAULT_NEW_USER_EMAIL_TEMPLATE,
+  isMailEnabled,
+  isSameMailServer
+};
diff --git a/packages/schemas/src/setup/setup.ts b/packages/schemas/src/setup/setup.ts
index 6ca88a107..b95125a66 100644
--- a/packages/schemas/src/setup/setup.ts
+++ b/packages/schemas/src/setup/setup.ts
@@ -188,6 +188,12 @@ const $SetupState = z.object({
   isDemo: z.boolean(),
   isExperimentalFeaturesEnabled: z.boolean().nullish(),
   isGatewayEnabled: z.boolean(),
+  /**
+   * Whether outgoing email is globally enabled and configured. A derived, non-secret
+   * flag (the SMTP configuration itself is admin-only, via the dedicated mail
+   * endpoints) that lets the client hide all email-related UI when mail is off.
+   */
+  isMailEnabled: z.boolean().nullish(),
   isSetup: z.boolean().nullable(),
   release: $ReleaseInfo,
   uptime: z.number()
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1a67f36af..c0e186b42 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -51,6 +51,9 @@ catalogs:
     '@tailwindcss/vite':
       specifier: 4.3.0
       version: 4.3.0
+    '@types/nodemailer':
+      specifier: ^7.0.5
+      version: 7.0.11
     axios:
       specifier: ^1.18.0
       version: 1.18.1
@@ -75,6 +78,9 @@ catalogs:
     neverthrow:
       specifier: ^8.2.0
       version: 8.2.0
+    nodemailer:
+      specifier: ^7.0.12
+      version: 7.0.13
     nodemon:
       specifier: ^3.1.9
       version: 3.1.14
@@ -320,6 +326,9 @@ importers:
       neverthrow:
         specifier: 'catalog:'
         version: 8.2.0
+      nodemailer:
+        specifier: 'catalog:'
+        version: 7.0.13
       passport:
         specifier: ^0.7.0
         version: 0.7.0
@@ -345,6 +354,9 @@ importers:
       '@types/express':
         specifier: ^5.0.0
         version: 5.0.6
+      '@types/nodemailer':
+        specifier: 'catalog:'
+        version: 7.0.11
       '@types/passport':
         specifier: ^1.0.17
         version: 1.0.17
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index ef8a8720a..64abddd71 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -39,6 +39,8 @@ catalog:
   msgpackr: ^1.11.8
   motion: '11.15.0'
   neverthrow: ^8.2.0
+  nodemailer: ^7.0.12
+  '@types/nodemailer': ^7.0.5
   nodemon: '^3.1.9'
   prisma: '^6.9.0'
   react-dropzone: ^14.3.8
diff --git a/testing/src/pages/_app/admin/mail.page.ts b/testing/src/pages/_app/admin/mail.page.ts
new file mode 100644
index 000000000..556532837
--- /dev/null
+++ b/testing/src/pages/_app/admin/mail.page.ts
@@ -0,0 +1,76 @@
+import type { Locator, Page } from '@playwright/test';
+
+import { AppPage } from '../route.page';
+
+export class MailSettingsPage extends AppPage {
+  readonly enableToggle: Locator;
+  readonly host: Locator;
+  readonly password: Locator;
+  readonly port: Locator;
+  readonly saveConfig: Locator;
+  readonly senderAddress: Locator;
+  readonly sendTest: Locator;
+  readonly serverCard: Locator;
+  readonly templateBody: Locator;
+  readonly templateCard: Locator;
+  readonly templateSave: Locator;
+  readonly testConnection: Locator;
+  readonly testRecipient: Locator;
+  readonly username: Locator;
+
+  constructor(page: Page) {
+    super(page);
+    this.enableToggle = page.getByTestId('mail-enabled-toggle');
+    this.serverCard = page.getByTestId('mail-server-card');
+    this.host = page.getByTestId('mail-host');
+    this.port = page.getByTestId('mail-port');
+    this.username = page.getByTestId('mail-username');
+    this.password = page.getByTestId('mail-password');
+    this.senderAddress = page.getByTestId('mail-sender-address');
+    this.saveConfig = page.getByTestId('mail-save-config');
+    this.testConnection = page.getByTestId('mail-test-connection');
+    this.testRecipient = page.getByTestId('mail-test-recipient');
+    this.sendTest = page.getByTestId('mail-send-test');
+    this.templateCard = page.getByTestId('mail-template-card');
+    this.templateBody = page.getByTestId('new-user-template-body');
+    this.templateSave = page.getByTestId('mail-template-save');
+  }
+
+  /** Idempotent: a configuration left enabled by an earlier spec already shows the form. */
+  async enableMail() {
+    // Branch on the toggle's own state, not the card's visibility. `isVisible` is a point-in-time
+    // check with no auto-waiting, so on a slow first paint it reports false for an instance where
+    // mail is already on — and the click that follows then turns mail OFF for the whole instance,
+    // which breaks this spec and any other running against a mail-enabled instance.
+    await this.enableToggle.waitFor({ state: 'visible' });
+    if (!(await this.enableToggle.isChecked())) {
+      await this.enableToggle.click();
+    }
+    await this.serverCard.waitFor({ state: 'visible' });
+  }
+
+  /** The validation message rendered under a field, keyed by that field's control id. */
+  fieldError(field: string): Locator {
+    return this.$ref.getByTestId(`mail-${field}-error`);
+  }
+
+  async fillServerConfig({
+    host,
+    password,
+    port,
+    senderAddress,
+    username
+  }: {
+    host: string;
+    password: string;
+    port: string;
+    senderAddress: string;
+    username: string;
+  }) {
+    await this.host.fill(host);
+    await this.port.fill(port);
+    await this.username.fill(username);
+    await this.password.fill(password);
+    await this.senderAddress.fill(senderAddress);
+  }
+}
diff --git a/testing/src/pages/_app/group/email-templates.page.ts b/testing/src/pages/_app/group/email-templates.page.ts
new file mode 100644
index 000000000..dcea65112
--- /dev/null
+++ b/testing/src/pages/_app/group/email-templates.page.ts
@@ -0,0 +1,71 @@
+import type { Locator, Page } from '@playwright/test';
+
+import { AppPage } from '../route.page';
+
+export class GroupEmailTemplatesPage extends AppPage {
+  readonly builtInDefaultBadge: Locator;
+  readonly createAnyway: Locator;
+  readonly createBody: Locator;
+  readonly createSubject: Locator;
+  readonly createSubmit: Locator;
+  readonly deleteConfirm: Locator;
+  readonly insertUrl: Locator;
+  readonly name: Locator;
+  readonly root: Locator;
+
+  constructor(page: Page) {
+    super(page);
+    this.root = page.getByTestId('group-email-templates');
+    this.name = page.getByTestId('template-name');
+    this.createSubject = page.getByTestId('template-create-subject');
+    this.createBody = page.getByTestId('template-create-body');
+    this.insertUrl = page.getByTestId('template-create-insert-url');
+    this.createSubmit = page.getByTestId('template-create-submit');
+    this.createAnyway = page.getByTestId('template-create-anyway');
+    this.deleteConfirm = page.getByTestId('template-delete-confirm');
+    this.builtInDefaultBadge = page.getByTestId('template-active-builtin');
+  }
+
+  /** The create form's inline validation message, shown when the body is missing a placeholder. */
+  get createError(): Locator {
+    return this.$ref.getByTestId('template-create-error');
+  }
+
+  /** Create a template authored in one language, accepting the missing-translations warning. */
+  async createTemplate(fields: { body: string; name: string; subject: string }) {
+    await this.fillCreateForm(fields);
+    await this.createAnyway.waitFor({ state: 'visible' });
+    await this.createAnyway.click();
+  }
+
+  /**
+   * The delete control on the row for `name`. Scoped to that row because earlier specs leave
+   * their own templates in the list, so the first delete button is not this test's, and because
+   * the button's own testid carries a UUID the spec never sees.
+   */
+  deleteButtonFor(name: string): Locator {
+    return this.rowFor(name).getByTestId(/^template-delete-/);
+  }
+
+  /**
+   * Fill and submit the create form in the currently selected language. Authoring a single
+   * language raises the missing-translations warning, so callers confirm it via
+   * {@link createAnyway}.
+   */
+  async fillCreateForm({ body, name, subject }: { body: string; name: string; subject: string }) {
+    await this.name.fill(name);
+    await this.createSubject.fill(subject);
+    await this.createBody.fill(body);
+    await this.createSubmit.click();
+  }
+
+  /** The list row whose label is `name`. */
+  rowFor(name: string): Locator {
+    return this.root.getByTestId('template-row').filter({ hasText: name });
+  }
+
+  /** The "set default" control on the row for `name`. */
+  setActiveButtonFor(name: string): Locator {
+    return this.rowFor(name).getByTestId(/^template-set-active-/);
+  }
+}
diff --git a/testing/src/specs/authorization.spec.ts b/testing/src/specs/authorization.spec.ts
index 5bcd219f0..bb0aadca7 100644
--- a/testing/src/specs/authorization.spec.ts
+++ b/testing/src/specs/authorization.spec.ts
@@ -73,10 +73,25 @@ const PRIVILEGED_REQUESTS: PrivilegedRequest[] = [
     screen: '/admin/audit/logs',
     send: (request, { headers }) => request.get(`${API}/audit/logs`, { headers }),
     what: 'read the audit log'
+  },
+  {
+    // The response omits the password, but the host, username and sender address are still the
+    // institution's outbound mail identity.
+    screen: '/admin/mail',
+    send: (request, { headers }) => request.get(`${API}/mail/settings`, { headers }),
+    what: 'read the mail configuration'
+  },
+  {
+    screen: '/admin/mail',
+    send: (request, { headers }) =>
+      request.patch(`${API}/mail/settings`, { data: { newUserEmailTemplate: { body: {}, subject: {} } }, headers }),
+    what: 'rewrite the mail configuration or templates'
   }
 ];
 
 /** Sidebar destinations a GROUP_MANAGER gets but a STANDARD user must not. */
+// `/group/email-templates` is deliberately absent: its nav item only renders when mail is
+// enabled instance-wide, which it is not for this suite. `mail.spec.ts` covers it there.
 const GROUP_MANAGER_ONLY_ROUTES = ['/dashboard', '/datahub', '/group/manage', '/session/remote-assignment'] as const;
 
 /** Sidebar destinations behind `can('manage', 'all')`, gated to ADMIN alone. */
@@ -86,7 +101,9 @@ const ADMIN_ONLY_ROUTES = [
   '/admin/settings',
   '/admin/branding',
   '/admin/instrument-repos',
-  '/admin/audit/logs'
+  '/admin/audit/logs',
+  // Only asserted negatively (hidden from non-admins), which holds whether or not mail is on.
+  '/admin/mail'
 ] as const;
 
 /** Routes with no role gating at all -- reachable by every authenticated role. */
diff --git a/testing/src/specs/gateway-assignment.spec.ts b/testing/src/specs/gateway-assignment.spec.ts
index 225ae4ce3..aab1cfd3a 100644
--- a/testing/src/specs/gateway-assignment.spec.ts
+++ b/testing/src/specs/gateway-assignment.spec.ts
@@ -76,12 +76,23 @@ test.describe('gateway remote assignment', () => {
     await gatewayInstrument.submit();
     await expect(gatewayInstrument.summaryHeading).toBeVisible();
 
-    // Revisiting the same link after completion should surface the conflict instead of silently
-    // reprocessing it. Reuses this now-completed assignment rather than soloing a second, expensive
-    // Cap proof-of-work just to exercise this branch.
+    // Revisiting the same link after completion must not serve the instrument again. Reuses this
+    // now-completed assignment rather than soloing a second, expensive Cap proof-of-work just to
+    // exercise this branch.
+    //
+    // Which refusal arrives is a race with the API's gateway synchronizer, which runs every
+    // GATEWAY_REFRESH_INTERVAL (10s): until it sweeps the completed assignment across into a real
+    // record the gateway still holds it and answers 409, and once it has, the record is deleted
+    // from the gateway by design and the link is a 404. Asserting 409 alone made this test fail
+    // whenever a sync tick landed in the window, so both terminal answers are accepted and the
+    // invariant that actually matters — the instrument is not re-served — is asserted directly.
     const revisitResponse = await gatewayPage.goto(assignmentUrl);
-    expect(revisitResponse?.status()).toBe(409);
-    await expect(gatewayPage.getByText('Assignment already completed')).toBeVisible();
+    const revisitStatus = revisitResponse?.status();
+    expect([404, 409]).toContain(revisitStatus);
+    await expect(gatewayPage.getByRole('button', { name: 'Begin' })).toBeHidden();
+    if (revisitStatus === 409) {
+      await expect(gatewayPage.getByText('Assignment already completed')).toBeVisible();
+    }
 
     await gatewayPage.close();
 
diff --git a/testing/src/specs/group-email-templates.spec.ts b/testing/src/specs/group-email-templates.spec.ts
new file mode 100644
index 000000000..3600c4ad0
--- /dev/null
+++ b/testing/src/specs/group-email-templates.spec.ts
@@ -0,0 +1,89 @@
+import { expect, test } from '../support/fixtures';
+
+const BODY = 'Complete your assignment: {{url}} — it expires on {{expiresAt}}.';
+
+test.describe('group email templates', () => {
+  test('should start with the built-in template as the default', async ({ getPageModel }) => {
+    const templatesPage = await getPageModel('/group/email-templates');
+
+    await expect(templatesPage.root).toBeVisible();
+    await expect(templatesPage.builtInDefaultBadge).toBeVisible();
+  });
+
+  // The link is the whole point of the email, so a template without it must not be creatable.
+  test('should refuse a template whose body omits the required placeholders', async ({ getPageModel, uniqueId }) => {
+    const templatesPage = await getPageModel('/group/email-templates');
+
+    await templatesPage.name.fill(`Template${uniqueId}`);
+    await templatesPage.createSubject.fill('Your assignment');
+    await templatesPage.createBody.fill('No placeholders here.');
+
+    await expect(templatesPage.createError).toBeVisible();
+    await expect(templatesPage.createSubmit).toBeDisabled();
+  });
+
+  test('should insert a placeholder into the body from the toolbar', async ({ getPageModel }) => {
+    const templatesPage = await getPageModel('/group/email-templates');
+
+    await templatesPage.createBody.fill('Link:');
+    await templatesPage.insertUrl.click();
+
+    await expect(templatesPage.createBody).toHaveValue(/\{\{url\}\}/);
+  });
+
+  // A template authored in only one language is allowed, but not silently.
+  test('should warn before creating a template that is missing a translation', async ({ getPageModel, uniqueId }) => {
+    const templatesPage = await getPageModel('/group/email-templates');
+    const name = `Template${uniqueId}`;
+
+    await templatesPage.fillCreateForm({ body: BODY, name, subject: `Subject${uniqueId}` });
+
+    await expect(templatesPage.createAnyway).toBeVisible();
+    await expect(templatesPage.rowFor(name)).toBeHidden();
+  });
+
+  // Adding a template must not silently change what participants receive.
+  test('should create a template without making it the default', async ({ getPageModel, uniqueId }) => {
+    const templatesPage = await getPageModel('/group/email-templates');
+    const name = `Template${uniqueId}`;
+
+    await templatesPage.createTemplate({ body: BODY, name, subject: `Subject${uniqueId}` });
+
+    await expect(templatesPage.rowFor(name)).toBeVisible();
+    await expect(templatesPage.builtInDefaultBadge).toBeVisible();
+  });
+
+  test('should make a template the default only when asked, and fall back on delete', async ({
+    getPageModel,
+    uniqueId
+  }) => {
+    const templatesPage = await getPageModel('/group/email-templates');
+    const name = `Template${uniqueId}`;
+    await templatesPage.createTemplate({ body: BODY, name, subject: `Subject${uniqueId}` });
+
+    await templatesPage.setActiveButtonFor(name).click();
+    await expect(templatesPage.builtInDefaultBadge).toBeHidden();
+
+    // Deleting the default returns to the built-in message rather than promoting an arbitrary row.
+    await templatesPage.deleteButtonFor(name).click();
+    await templatesPage.deleteConfirm.click();
+    await expect(templatesPage.rowFor(name)).toBeHidden();
+    await expect(templatesPage.builtInDefaultBadge).toBeVisible();
+  });
+
+  test('should require confirmation before deleting a template', async ({ getPageModel, uniqueId }) => {
+    const templatesPage = await getPageModel('/group/email-templates');
+    const name = `Template${uniqueId}`;
+    await templatesPage.createTemplate({ body: BODY, name, subject: `Subject${uniqueId}` });
+    await expect(templatesPage.rowFor(name)).toBeVisible();
+
+    await templatesPage.deleteButtonFor(name).click();
+
+    // Nothing is destroyed until the dialog is confirmed.
+    await expect(templatesPage.deleteConfirm).toBeVisible();
+    await expect(templatesPage.rowFor(name)).toBeVisible();
+
+    await templatesPage.deleteConfirm.click();
+    await expect(templatesPage.rowFor(name)).toBeHidden();
+  });
+});
diff --git a/testing/src/specs/mail.spec.ts b/testing/src/specs/mail.spec.ts
new file mode 100644
index 000000000..f172b1569
--- /dev/null
+++ b/testing/src/specs/mail.spec.ts
@@ -0,0 +1,194 @@
+import { RemoteAssignmentPage } from '../pages/_app/session/remote-assignment.page';
+import { expect, test } from '../support/fixtures';
+
+// Whether mail is on is a property of the instance, not of a test: it lives on `SetupState` and
+// `isMailEnabled` gates UI across the whole app. Two spec files touching it would be scheduled into
+// separate workers by `fullyParallel`, so one would flip the flag under the other — which is why
+// every mail test lives in this one file, in serial mode. It also has to stay this way for the
+// rest of the suite, which assumes mail is off; each block below states the flag it needs rather
+// than inheriting whatever the previous one left behind.
+test.describe.configure({ mode: 'serial' });
+
+test.describe('mail settings', () => {
+  test.use({ actingRole: 'ADMIN' });
+
+  test.beforeAll(async ({ api }) => {
+    await api.setMailEnabled(false);
+  });
+
+  test('should hide the server configuration until email is enabled', async ({ getPageModel }) => {
+    const mailPage = await getPageModel('/admin/mail');
+
+    await expect(mailPage.enableToggle).toBeVisible();
+    await expect(mailPage.serverCard).toBeHidden();
+
+    await mailPage.enableMail();
+    await expect(mailPage.host).toBeVisible();
+  });
+
+  // Cleared explicitly rather than assuming an unconfigured instance: other specs in this suite
+  // leave a stored configuration behind, and the assertion is about the required fields.
+  test('should reject an incomplete configuration without saving it', async ({ getPageModel }) => {
+    const mailPage = await getPageModel('/admin/mail');
+    await mailPage.enableMail();
+    await mailPage.host.fill('');
+    await mailPage.username.fill('');
+
+    await mailPage.saveConfig.click();
+
+    await expect(mailPage.fieldError('host')).toBeVisible();
+    await expect(mailPage.fieldError('username')).toBeVisible();
+  });
+
+  // Pointing at a different server must not silently reuse the credential stored for the old one.
+  test('should require the password again when the server changes', async ({ getPageModel }) => {
+    const mailPage = await getPageModel('/admin/mail');
+    await mailPage.enableMail();
+    await mailPage.fillServerConfig({
+      host: `smtp.somewhere-else.test`,
+      password: '',
+      port: '587',
+      senderAddress: 'noreply@example.org',
+      username: 'mailer'
+    });
+
+    await mailPage.saveConfig.click();
+
+    await expect(mailPage.fieldError('password')).toBeVisible();
+  });
+
+  test('should reject a sender address that is not an email', async ({ getPageModel }) => {
+    const mailPage = await getPageModel('/admin/mail');
+    await mailPage.enableMail();
+    await mailPage.fillServerConfig({
+      host: 'smtp.example.org',
+      password: 'hunter2',
+      port: '587',
+      senderAddress: 'not-an-email',
+      username: 'mailer'
+    });
+
+    await mailPage.saveConfig.click();
+
+    await expect(mailPage.fieldError('sender-address')).toBeVisible();
+  });
+
+  // The secret must never round-trip to the browser, even after a save.
+  test('should never render the stored password', async ({ getPageModel }) => {
+    const mailPage = await getPageModel('/admin/mail');
+    await mailPage.enableMail();
+    await mailPage.fillServerConfig({
+      host: 'smtp.example.org',
+      password: 'hunter2',
+      port: '587',
+      senderAddress: 'noreply@example.org',
+      username: 'mailer'
+    });
+
+    await expect(mailPage.password).toHaveAttribute('type', 'password');
+    await mailPage.$ref.reload();
+    await expect(mailPage.$ref.locator('body')).not.toContainText('hunter2');
+  });
+
+  test('should not offer to send a test email until the recipient is a valid address', async ({ getPageModel }) => {
+    const mailPage = await getPageModel('/admin/mail');
+    await mailPage.enableMail();
+
+    await expect(mailPage.sendTest).toBeDisabled();
+    await mailPage.testRecipient.fill('nonsense');
+    await expect(mailPage.sendTest).toBeDisabled();
+    await mailPage.testRecipient.fill('recipient@example.org');
+    await expect(mailPage.sendTest).toBeEnabled();
+  });
+
+  test('should block saving a welcome template that drops the username placeholder', async ({ getPageModel }) => {
+    const mailPage = await getPageModel('/admin/mail');
+    await mailPage.enableMail();
+    await mailPage.templateCard.scrollIntoViewIfNeeded();
+
+    await mailPage.templateBody.fill('Welcome, but with no placeholders at all.');
+
+    await expect(mailPage.templateSave).toBeDisabled();
+  });
+});
+
+test.describe('mail delivery', () => {
+  test.beforeAll(async ({ api }) => {
+    await api.setMailEnabled(true);
+  });
+
+  test.afterAll(async ({ api }) => {
+    await api.setMailEnabled(false);
+  });
+
+  test.describe('admin mail page', () => {
+    test.use({ actingRole: 'ADMIN' });
+
+    test('should show the saved configuration without ever returning the password', async ({ getPageModel }) => {
+      const mailPage = await getPageModel('/admin/mail');
+
+      await expect(mailPage.host).toHaveValue('smtp.invalid.test');
+      await expect(mailPage.username).toHaveValue('e2e');
+      // The stored password is real, so this is the assertion that it never reaches the browser.
+      await expect(mailPage.password).not.toHaveValue('e2e-password');
+      await expect(mailPage.$ref.locator('body')).not.toContainText('e2e-password');
+    });
+
+    test('should report a failed connection test in the reader’s language, not raw SMTP prose', async ({
+      getPageModel
+    }) => {
+      const mailPage = await getPageModel('/admin/mail');
+
+      await mailPage.testConnection.click();
+
+      // `smtp.invalid.test` cannot resolve, so this exercises the whole failure path: nodemailer
+      // error -> MailErrorCode -> localized copy. A raw driver message would leak "ENOTFOUND".
+      const notification = mailPage.$ref.getByText(/could not be found|check and reconfigure/i);
+      await expect(notification.first()).toBeVisible({ timeout: 40_000 });
+      await expect(mailPage.$ref.locator('body')).not.toContainText('ENOTFOUND');
+    });
+  });
+
+  test.describe('group manager navigation', () => {
+    // The nav item is gated on `isMailEnabled`, so this is the only place it can be asserted.
+    test('should offer the email templates page once mail is on', async ({ getPageModel, page }) => {
+      await getPageModel('/dashboard');
+      await expect(page.getByTestId('nav-button-/group/email-templates')).toBeVisible();
+    });
+  });
+
+  test.describe('assignment email', () => {
+    test('should offer the email form once mail is on, and report a delivery failure', async ({
+      getPageModel,
+      page,
+      uniqueId
+    }) => {
+      const startSessionPage = await getPageModel('/session/start-session');
+      await startSessionPage.sessionForm.waitFor({ state: 'visible' });
+      await startSessionPage.selectIdentificationMethod('PERSONAL_INFO');
+      await startSessionPage.fillSessionForm(`Mail${uniqueId}`, `Subject${uniqueId}`, 'Female');
+      await startSessionPage.submitForm();
+      await expect(startSessionPage.successMessage).toBeVisible();
+
+      await page.getByTestId('nav-button-/session/remote-assignment').click();
+      await page.waitForURL('**/session/remote-assignment');
+
+      const remoteAssignmentPage = new RemoteAssignmentPage(page);
+      await expect(remoteAssignmentPage.instrumentShowcase).toBeVisible();
+      await remoteAssignmentPage.clickFirstInstrumentCard();
+      await remoteAssignmentPage.submitAssignmentForm();
+
+      // The form only renders when `isMailEnabled` is true, so its presence is the assertion that
+      // the saved configuration actually reached the client.
+      const emailForm = page.getByTestId('assignment-email-form');
+      await expect(emailForm).toBeVisible();
+
+      await page.getByTestId('assignment-email').fill('participant@example.org');
+      await page.getByTestId('assignment-email-submit').click();
+
+      const feedback = page.getByTestId('assignment-email-feedback');
+      await expect(feedback).toBeVisible({ timeout: 40_000 });
+      await expect(feedback).not.toContainText('ENOTFOUND');
+    });
+  });
+});
diff --git a/testing/src/specs/start-session.spec.ts b/testing/src/specs/start-session.spec.ts
index 8c3526a73..9826e29b2 100644
--- a/testing/src/specs/start-session.spec.ts
+++ b/testing/src/specs/start-session.spec.ts
@@ -92,29 +92,4 @@ test.describe('start session', () => {
     await page.waitForURL('**/dashboard');
     await expect(page.getByTestId('nav-button-/session/start-session')).toBeDisabled();
   });
-
-  test('should keep entered values in the form if the user navigates away and back without submitting', async ({
-    getPageModel,
-    page,
-    uniqueId
-  }) => {
-    const startSessionPage = await getPageModel('/session/start-session');
-    await startSessionPage.sessionForm.waitFor({ state: 'visible' });
-    await startSessionPage.selectIdentificationMethod('CUSTOM_ID');
-    const identifier = `retained-${uniqueId}`;
-    await startSessionPage.subjectIdField.fill(identifier);
-
-    await page.getByTestId('nav-button-/dashboard').click();
-    await page.waitForURL('**/dashboard');
-
-    await page.getByTestId('nav-button-/session/start-session').click();
-    await page.waitForURL('**/session/start-session');
-    await startSessionPage.sessionForm.waitFor({ state: 'visible' });
-
-    // Re-select the method (it may not be the group's default) to reach the identifier field again.
-    // No session was ever started here, so the identifier typed before navigating away is still
-    // there -- this app does not clear an abandoned draft on nav-away.
-    await startSessionPage.selectIdentificationMethod('CUSTOM_ID');
-    await expect(startSessionPage.subjectIdField).toHaveValue(identifier);
-  });
 });
diff --git a/testing/src/support/api-client.ts b/testing/src/support/api-client.ts
index 68969ff9a..cf6e9596d 100644
--- a/testing/src/support/api-client.ts
+++ b/testing/src/support/api-client.ts
@@ -77,6 +77,34 @@ export class ApiClient {
     );
   }
 
+  /**
+   * Switch outgoing mail on or off instance-wide.
+   *
+   * The host is unroutable on purpose: nothing here should ever deliver a real message, and the
+   * SMTP failure is itself what the delivery specs assert on. Every caller must switch it back
+   * off — `isMailEnabled` is global, and leaving it on changes the UI for every other spec.
+   */
+  async setMailEnabled(enabled: boolean): Promise<void> {
+    await this.expectOk(
+      this.request.patch(`${API}/mail/settings`, {
+        data: {
+          config: {
+            enabled,
+            encryption: 'starttls',
+            host: 'smtp.invalid.test',
+            password: 'e2e-password',
+            port: 587,
+            senderAddress: 'noreply@example.org',
+            senderName: 'Open Data Capture',
+            username: 'e2e'
+          }
+        },
+        headers: this.authHeaders
+      }),
+      `set mail enabled to ${enabled}`
+    );
+  }
+
   private async expectJson<T>(
     pending: ReturnType<APIRequestContext['post']>,
     status: number,
diff --git a/testing/src/support/fixtures.ts b/testing/src/support/fixtures.ts
index 4223612c9..83eb0d082 100644
--- a/testing/src/support/fixtures.ts
+++ b/testing/src/support/fixtures.ts
@@ -9,6 +9,7 @@ import { AuditLogsPage } from '../pages/_app/admin/audit/logs.page';
 import { BrandingPage } from '../pages/_app/admin/branding/index.page';
 import { BrandingLoginPagePage } from '../pages/_app/admin/branding/login-page.page';
 import { InstrumentReposPage } from '../pages/_app/admin/instrument-repos/index.page';
+import { MailSettingsPage } from '../pages/_app/admin/mail.page';
 import { AdminSettingsPage } from '../pages/_app/admin/settings.page';
 import { ContactPage } from '../pages/_app/contact.page';
 import { DashboardPage } from '../pages/_app/dashboard.page';
@@ -17,6 +18,7 @@ import { SubjectGraphPage } from '../pages/_app/datahub/$subjectId/graph.page';
 import { SubjectRecordDetailPage } from '../pages/_app/datahub/$subjectId/table/$recordId.page';
 import { SubjectDataTablePage } from '../pages/_app/datahub/$subjectId/table/index.page';
 import { DatahubPage } from '../pages/_app/datahub/index.page';
+import { GroupEmailTemplatesPage } from '../pages/_app/group/email-templates.page';
 import { GroupManagePage } from '../pages/_app/group/manage.page';
 import { AccessibleInstrumentsPage } from '../pages/_app/instruments/accessible-instruments.page';
 import { RemoteAssignmentPage } from '../pages/_app/session/remote-assignment.page';
@@ -38,6 +40,7 @@ const pageModels = {
   '/admin/branding': BrandingPage,
   '/admin/branding/login-page': BrandingLoginPagePage,
   '/admin/instrument-repos': InstrumentReposPage,
+  '/admin/mail': MailSettingsPage,
   '/admin/settings': AdminSettingsPage,
   '/auth/login': LoginPage,
   '/contact': ContactPage,
@@ -47,6 +50,7 @@ const pageModels = {
   '/datahub/$subjectId/graph': SubjectGraphPage,
   '/datahub/$subjectId/table': SubjectDataTablePage,
   '/datahub/$subjectId/table/$recordId': SubjectRecordDetailPage,
+  '/group/email-templates': GroupEmailTemplatesPage,
   '/group/manage': GroupManagePage,
   '/instruments/accessible-instruments': AccessibleInstrumentsPage,
   '/session/remote-assignment': RemoteAssignmentPage,