diff --git a/flux2/core/base/single-sign-on/single-sign-on-values-configmap.yaml b/flux2/core/base/single-sign-on/single-sign-on-values-configmap.yaml
index 35fadcef734a38e739fb95d416fa2097fb059063..be6e45347d7df6f2ba073daeed31d7d2bea42d64 100644
--- a/flux2/core/base/single-sign-on/single-sign-on-values-configmap.yaml
+++ b/flux2/core/base/single-sign-on/single-sign-on-values-configmap.yaml
@@ -65,7 +65,7 @@ data:
               base_url: https://sso.${domain}/api/
           courier:
             smtp:
-              connection_uri: smtp://${outgoing_mail_smtp_user}:${outgoing_mail_smtp_password}@${outgoing_mail_smtp_host}:${outgoing_mail_smtp_port}/
+              connection_uri: smtp://${outgoing_mail_smtp_user}:${outgoing_mail_smtp_password_urlencoded}@${outgoing_mail_smtp_host}:${outgoing_mail_smtp_port}/
               from_address: ${outgoing_mail_from_address}
           secrets:
             session:
diff --git a/install/install-stackspin.sh b/install/install-stackspin.sh
index 4a075e540c6573a331e838d3febc10a0e9621f32..d913734f3db48e515e32c37e9b9232e34efab1b8 100755
--- a/install/install-stackspin.sh
+++ b/install/install-stackspin.sh
@@ -5,6 +5,12 @@ set -euo pipefail
 # shellcheck source=install/flux-version-check.sh
 . "$(dirname "$0")/flux-version-check.sh"
 
+# Check if stackspin-cluster-variables secret exists
+smtp_password=$(kubectl get secret -n flux-system stackspin-cluster-variables --template '{{.data.outgoing_mail_smtp_password}}' | base64 -d)
+smtp_password_urlencoded=$(python -c "import urllib.parse; print(urllib.parse.quote('${smtp_password}', safe=''), end='')" | base64 -w0)
+# Add url-encoded version of password to the cluster
+kubectl patch secret -n flux-system stackspin-cluster-variables -p "{\"data\": {\"outgoing_mail_smtp_password_urlencoded\": \"${smtp_password_urlencoded}\"}}"
+
 flux install \
   --network-policy=false \
   --watch-all-namespaces=true \