diff --git a/root/etc/e-smith/templates/etc/postfix/main.cf/70certificates b/root/etc/e-smith/templates/etc/postfix/main.cf/70certificates
index 1291c16..c8f47d6 100644
--- a/root/etc/e-smith/templates/etc/postfix/main.cf/70certificates
+++ b/root/etc/e-smith/templates/etc/postfix/main.cf/70certificates
@@ -11,7 +11,7 @@ smtp_tls_note_starttls_offer = yes
 # was issued by a CA that is trusted by the Postfix SMTP client
 }smtp_tls_security_level = {
   my $smarthost = $SMTPSmartHost || "off";
-  my $userid = ${smtp-auth-proxy}{'Userid'} || "";
+  my $userid = ${'smtp-auth-proxy'}{'Userid'} || "";
   my $tls_security_level = $postfix{'tls_security_level'} || "may";
   $tls_security_level = "encrypt" if ($smarthost ne "off" && $userid ne "");
   $OUT = $tls_security_level;
diff --git a/root/etc/e-smith/templates/etc/postfix/main.cf/75smarthost b/root/etc/e-smith/templates/etc/postfix/main.cf/75smarthost
index d73ff18..a79bc07 100644
--- a/root/etc/e-smith/templates/etc/postfix/main.cf/75smarthost
+++ b/root/etc/e-smith/templates/etc/postfix/main.cf/75smarthost
@@ -1,9 +1,9 @@
 ## SME relay outgoing mails to smarthost
 {
   my $smarthost = $SMTPSmartHost || "off";
-  my $userid = ${smtp-auth-proxy}{'Userid'} || "";
-  my $password = ${smtp-auth-proxy}{'Passwd'} || "";
-  my $port = ${smtp-auth-proxy}{'PeerPort'} || "25";
+  my $userid = ${'smtp-auth-proxy'}{'Userid'} || "";
+  my $password = ${'smtp-auth-proxy'}{'Passwd'} || "";
+  my $port = ${'smtp-auth-proxy'}{'PeerPort'} || "25";
   return "#Smarthost disabled" unless $smarthost ne "off";
   $OUT = "relayhost = [$smarthost]:$port\n";
   if ($userid ne "") 
diff --git a/root/etc/e-smith/templates/etc/postfix/sasl_passwd/20smarthost b/root/etc/e-smith/templates/etc/postfix/sasl_passwd/20smarthost
index b8fda55..f3d3c7f 100644
--- a/root/etc/e-smith/templates/etc/postfix/sasl_passwd/20smarthost
+++ b/root/etc/e-smith/templates/etc/postfix/sasl_passwd/20smarthost
@@ -1,9 +1,9 @@
 ## SME relay outgoing mails to smarthost
 {
   my $smarthost = $SMTPSmartHost || "off";
-  my $userid = ${smtp-auth-proxy}{'Userid'} || "";
-  my $password = ${smtp-auth-proxy}{'Passwd'} || "";
-  my $port = ${smtp-auth-proxy}{'PeerPort'} || "25";
+  my $userid = ${'smtp-auth-proxy'}{'Userid'} || "";
+  my $password = ${'smtp-auth-proxy'}{'Passwd'} || "";
+  my $port = ${'smtp-auth-proxy'}{'PeerPort'} || "25";
   return "#Smarthost disabled" unless $smarthost ne "off";
   $OUT = "";
   if ($userid ne "")
diff --git a/smeserver-postfix.spec b/smeserver-postfix.spec
index 23033b1..b3b75e9 100644
--- a/smeserver-postfix.spec
+++ b/smeserver-postfix.spec
@@ -1,6 +1,6 @@
 %define name smeserver-postfix
 %define version 1.0
-%define release 9
+%define release 10
 Summary: This is what smeserver-postfix does.
 Name: %{name}
 Version: %{version}
@@ -24,6 +24,9 @@ AutoReqProv: no
 Koozali SME Server wrapper to configure postfix
 
 %changelog
+* Sun Dec 29 2024 Brian Read <brianr@koozali.org> 1.0-10.sme
+- Quotes round smtp-auth-proxy in templates for main.cf and sasl-passwd [SME: 12836]
+
 * Mon Dec 23 2024 Jean-Philippe Pialasse <jpp@koozali.org> 1.0-9.sme
 - fix virtual  expected format: key whitespace value for empty group [SME: 12834]