diff --git a/docker-compose.yml b/docker-compose.yml
index fa2bebc3..00bc2d42 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -41,6 +41,10 @@ x-worker-base: &worker-base
   environment: &worker-env
     <<: *aws-localstack
     APP_ENV: dev
+    # Worker command/result envelopes carry `any` bodies; only the JSON
+    # codec serializes them. Backend + consumer must match.
+    CODEC_PROVIDER: json
+    MAIL_TLS_INSECURE: "true"
     AWS_CONFIG_ENABLED: "false"
     REDIS: redis://redis:6379
     KAFKA_BOOTSTRAP_SERVERS: kafka:29092
@@ -199,6 +203,11 @@ services:
       - "-queue"
       - "projects/local/locations/local/queues/default"
     ports: ["8123:8123"]
+    # Native-dev callbacks: the emulator must reach the HOST-run backend at
+    # host.docker.internal (SELF_HOST default in the Makefile). Docker Desktop
+    # resolves it natively; this mapping makes it work on Linux too.
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
 
   mailpit:
     image: axllent/mailpit:latest
@@ -207,12 +216,36 @@ services:
     ports:
       - "18025:8025"   # web UI
       - "11025:1025"   # SMTP
+    # Accept SMTP AUTH with any credentials, without requiring TLS. The
+    # worker always authenticates, so the sandbox mailboxes (SMTP host ->
+    # mailpit) need the sink to accept their login (see /development/sandbox/).
+    environment:
+      MP_SMTP_AUTH_ACCEPT_ANY: 1
+      MP_SMTP_AUTH_ALLOW_INSECURE: 1
     healthcheck:
       test: ["CMD", "wget", "-q", "--spider", "http://localhost:8025"]
       interval: 5s
       timeout: 3s
       retries: 10
 
+  # Sandbox mailbox host: a real IMAP server so the worker's genuine
+  # IMAP sync path runs locally (mailpit is SMTP-only). Rootless Dovecot
+  # 2.4 with a static passdb: ANY username logs in with the single
+  # USER_PASSWORD below, and the maildir is auto-created on first use.
+  # Used by `make sandbox` (see docs /development/sandbox/).
+  dovecot:
+    image: dovecot/dovecot:latest
+    environment:
+      USER_PASSWORD: "{PLAIN}sandbox"
+    ports:
+      - "10143:31143"  # IMAP (cleartext auth disabled; debugging only)
+      - "10993:31993"  # IMAPS (self-signed cert; MAIL_TLS_INSECURE=true clients)
+    healthcheck:
+      test: ["CMD", "doveadm", "service", "status", "imap-login"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+
   localstack:
     image: localstack/localstack:3.7
     ports:
@@ -262,6 +295,8 @@ services:
     environment:
       <<: *aws-localstack
       APP_ENV: dev
+      CODEC_PROVIDER: json
+      CREDENTIALS_ENCRYPTION_KEY: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
       AWS_CONFIG_ENABLED: "false"
 
       API_HOST: "0.0.0.0:8080"
@@ -348,6 +383,8 @@ services:
     environment:
       <<: *aws-localstack
       APP_ENV: dev
+      CODEC_PROVIDER: json
+      CREDENTIALS_ENCRYPTION_KEY: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
       AWS_CONFIG_ENABLED: "false"
 
       PRIMARY_DB: postgres://warmbly:warmbly@postgres:5432/warmbly_dev?sslmode=disable