diff --git a/apps/api/src/settings/settings.service.ts b/apps/api/src/settings/settings.service.ts
index 0e5d76c..de2234f 100644
--- a/apps/api/src/settings/settings.service.ts
+++ b/apps/api/src/settings/settings.service.ts
@@ -124,11 +124,18 @@ export class SettingsService {
    */
   async testSmtpConfig(tenantId: string, dto: SmtpConfigDto): Promise<boolean> {
     let password: string | undefined = dto.password;
+    let username: string | undefined = dto.username;
 
-    // If no password submitted, fall back to the stored password
-    if (!password) {
+    // Fall back to stored credentials for anything not provided in the DTO.
+    // The form never pre-fills the password field (T-07-17), so we always
+    // need to load it from storage. Username may also be absent if the form
+    // field was cleared, so load it too.
+    if (!password || !username) {
       const stored = await this.getDecryptedSmtpConfig(tenantId);
-      password = stored?.decryptedPassword ?? undefined;
+      if (stored) {
+        if (!password) password = stored.decryptedPassword ?? undefined;
+        if (!username) username = stored.username ?? undefined;
+      }
     }
 
     try {
@@ -137,8 +144,11 @@ export class SettingsService {
         port: dto.port,
         secure: dto.encryption === 'ssl-tls',
         requireTLS: dto.encryption === 'starttls',
-        auth: dto.username
-          ? { user: dto.username, pass: password ?? '' }
+        connectionTimeout: 10_000,
+        greetingTimeout: 10_000,
+        socketTimeout: 10_000,
+        auth: username
+          ? { user: username, pass: password ?? '' }
           : undefined,
       });