diff --git a/scripts/tests/test_mailu_sync.py b/scripts/tests/test_mailu_sync.py
index f3edbd1..d5f9487 100644
--- a/scripts/tests/test_mailu_sync.py
+++ b/scripts/tests/test_mailu_sync.py
@@ -160,7 +160,13 @@ def test_main_generates_password_and_upserts(monkeypatch):
             "email": "user2@example.com",
             "attributes": {"mailu_app_password": ["keepme"], "mailu_enabled": ["true"]},
         },
-        {"id": "u3", "username": "user3", "email": "user3@other.com", "attributes": {}},
+        {
+            "id": "u3",
+            "username": "user3",
+            "email": "user3@example.com",
+            "attributes": {"mailu_email": ["user3@example.com"]},
+        },
+        {"id": "u4", "username": "user4", "email": "user4@other.com", "attributes": {}},
     ]
     updated = []
 
@@ -199,6 +205,6 @@ def test_main_generates_password_and_upserts(monkeypatch):
 
     sync.main()
 
-    # Only mail-enabled users are synced and backfilled.
-    assert len(updated) == 2
-    assert conns and len(conns[0]._cursor.executions) == 2
+    # Only mail-enabled users (or legacy users with a mailbox) are synced and backfilled.
+    assert len(updated) == 3
+    assert conns and len(conns[0]._cursor.executions) == 3
diff --git a/services/mailu/scripts/mailu_sync.py b/services/mailu/scripts/mailu_sync.py
index afd1d49..7c5edda 100644
--- a/services/mailu/scripts/mailu_sync.py
+++ b/services/mailu/scripts/mailu_sync.py
@@ -26,6 +26,7 @@ KC_CLIENT_SECRET = os.environ["KEYCLOAK_CLIENT_SECRET"]
 MAILU_DOMAIN = os.environ["MAILU_DOMAIN"]
 MAILU_DEFAULT_QUOTA = int(os.environ.get("MAILU_DEFAULT_QUOTA", "20000000000"))
 MAILU_ENABLED_ATTR = os.environ.get("MAILU_ENABLED_ATTR", "mailu_enabled")
+MAILU_EMAIL_ATTR = "mailu_email"
 
 DB_CONFIG = {
     "host": os.environ["MAILU_DB_HOST"],
@@ -153,12 +154,12 @@ def get_attribute_value(attributes, key):
 def mailu_enabled(attributes) -> bool:
     raw = get_attribute_value(attributes, MAILU_ENABLED_ATTR)
     if raw is None:
-        return False
+        return bool(get_attribute_value(attributes, MAILU_EMAIL_ATTR))
     return str(raw).strip().lower() in {"1", "true", "yes", "y", "on"}
 
 
 def resolve_mailu_email(user, attributes):
-    explicit = get_attribute_value(attributes, "mailu_email")
+    explicit = get_attribute_value(attributes, MAILU_EMAIL_ATTR)
     if explicit:
         return explicit
 
@@ -227,14 +228,17 @@ def main():
         attrs = user.get("attributes", {}) or {}
         if user.get("enabled") is False:
             continue
+        needs_update = False
+        if get_attribute_value(attrs, MAILU_ENABLED_ATTR) is None and get_attribute_value(attrs, MAILU_EMAIL_ATTR):
+            attrs[MAILU_ENABLED_ATTR] = ["true"]
+            needs_update = True
         if not mailu_enabled(attrs):
             continue
         app_pw = get_attribute_value(attrs, "mailu_app_password")
         mailu_email = resolve_mailu_email(user, attrs)
 
-        needs_update = False
-        if not get_attribute_value(attrs, "mailu_email"):
-            attrs["mailu_email"] = [mailu_email]
+        if not get_attribute_value(attrs, MAILU_EMAIL_ATTR):
+            attrs[MAILU_EMAIL_ATTR] = [mailu_email]
             needs_update = True
 
         if not app_pw: