diff --git a/assets/policy-extras/dkim_sign.lua b/assets/policy-extras/dkim_sign.lua
index 145edac9..b60cedda 100644
--- a/assets/policy-extras/dkim_sign.lua
+++ b/assets/policy-extras/dkim_sign.lua
@@ -231,6 +231,7 @@ local function do_dkim_sign(msg, data)
             or base.header_canonicalization,
           body_canonicalization = sig_config.body_canonicalization
             or base.body_canonicalization,
+          over_sign = sig_config.over_sign or base.over_sign,
         }
 
         if base.vault_mount then
diff --git a/crates/message/src/dkim.rs b/crates/message/src/dkim.rs
index 06f641b9..405937c0 100644
--- a/crates/message/src/dkim.rs
+++ b/crates/message/src/dkim.rs
@@ -54,6 +54,7 @@ pub struct SignerConfig {
     body_canonicalization: Canon,
 
     key: KeySource,
+    #[serde(default)]
     over_sign: bool,
 
     #[serde(default = "SignerConfig::default_ttl")]