diff --git a/CHANGELOG.md b/CHANGELOG.md
index e3a2cc9..9350b68 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- G1 default allow-lists include qbit-email's published API: artifact `com.kingsrook.qbits:qbit-email` and package `com.kingsrook.qbits.email.api` (as for qbit-object-storage), so consumers need no per-repo allow-list.
+
 ## [2.1.0] - 2026-10-13
 
 ### Added
diff --git a/README.md b/README.md
index 535cd43..68fcb42 100644
--- a/README.md
+++ b/README.md
@@ -64,8 +64,8 @@ Configuration properties:
 | Property | Default / meaning |
 | --- | --- |
 | `qbit.guardrails.enforce` | `false`; fail on G1, G3, G4 and G7 violations when `true`. |
-| `qbit.guardrails.allowedQbitArtifacts` | Comma-separated Maven `groupId:artifactId` patterns, with `*` wildcards. Default: `com.kingsrook.qbits:qbit-object-storage,com.kingsrook.qbits:*-api`. Replacing this property replaces the allow-list. |
-| `qbit.guardrails.allowedApiPackages` | Comma-separated package prefixes. Default: `com.kingsrook.qbits.objectstorage.api`. A trailing `..` is accepted. Package boundaries are exact (`apiInternal` is not `api`). |
+| `qbit.guardrails.allowedQbitArtifacts` | Comma-separated Maven `groupId:artifactId` patterns, with `*` wildcards. Default: `com.kingsrook.qbits:qbit-object-storage,com.kingsrook.qbits:qbit-email,com.kingsrook.qbits:*-api`. Replacing this property replaces the allow-list. |
+| `qbit.guardrails.allowedApiPackages` | Comma-separated package prefixes. Default: `com.kingsrook.qbits.objectstorage.api,com.kingsrook.qbits.email.api`. A trailing `..` is accepted. Package boundaries are exact (`apiInternal` is not `api`). |
 | `qbit.guardrails.ownPackage` | Optional JVM/CLI property: fourth segment (e.g. `alerts`) or full `com.kingsrook.qbits.alerts` prefix. Otherwise the most frequent fourth segment among main classes is used, with lexical tie-breaking. |
 | `qbit.guardrails.strictUiApiRoutes` | `false`; opt into core's strict runtime route audit in tests. |
 | `qbit.guardrails.skip` | Unset. `-Dqbit.guardrails.skip=true` disables the entire profile. Activation is based on property absence, so even setting it to `false` disables the profile; leave it unset to enable checks. |
diff --git a/pom.xml b/pom.xml
index 18deb01..42e4e4d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -50,8 +50,8 @@
       <!-- Do not use revision here: children override it with their own version. -->
       <qbit.guardrails.version>2.1.0</qbit.guardrails.version>
       <qbit.guardrails.enforce>false</qbit.guardrails.enforce>
-      <qbit.guardrails.allowedQbitArtifacts>com.kingsrook.qbits:qbit-object-storage,com.kingsrook.qbits:*-api</qbit.guardrails.allowedQbitArtifacts>
-      <qbit.guardrails.allowedApiPackages>com.kingsrook.qbits.objectstorage.api</qbit.guardrails.allowedApiPackages>
+      <qbit.guardrails.allowedQbitArtifacts>com.kingsrook.qbits:qbit-object-storage,com.kingsrook.qbits:qbit-email,com.kingsrook.qbits:*-api</qbit.guardrails.allowedQbitArtifacts>
+      <qbit.guardrails.allowedApiPackages>com.kingsrook.qbits.objectstorage.api,com.kingsrook.qbits.email.api</qbit.guardrails.allowedApiPackages>
       <qbit.guardrails.strictUiApiRoutes>false</qbit.guardrails.strictUiApiRoutes>
    </properties>
 
diff --git a/qbit-guardrails/src/main/java/com/kingsrook/qbits/guardrails/GuardrailProject.java b/qbit-guardrails/src/main/java/com/kingsrook/qbits/guardrails/GuardrailProject.java
index ab961f8..ca9b619 100644
--- a/qbit-guardrails/src/main/java/com/kingsrook/qbits/guardrails/GuardrailProject.java
+++ b/qbit-guardrails/src/main/java/com/kingsrook/qbits/guardrails/GuardrailProject.java
@@ -76,8 +76,8 @@ final class GuardrailProject
     ***************************************************************************/
    Set<String> apiPackages() throws IOException
    {
-      Set<String> packages = new TreeSet<>(csv(System.getProperty("qbit.guardrails.allowedApiPackages", "com.kingsrook.qbits.objectstorage.api")));
-      List<String> allowedArtifacts = csv(System.getProperty("qbit.guardrails.allowedQbitArtifacts", "com.kingsrook.qbits:qbit-object-storage,com.kingsrook.qbits:*-api"));
+      Set<String> packages = new TreeSet<>(csv(System.getProperty("qbit.guardrails.allowedApiPackages", "com.kingsrook.qbits.objectstorage.api,com.kingsrook.qbits.email.api")));
+      List<String> allowedArtifacts = csv(System.getProperty("qbit.guardrails.allowedQbitArtifacts", "com.kingsrook.qbits:qbit-object-storage,com.kingsrook.qbits:qbit-email,com.kingsrook.qbits:*-api"));
       String classpath = System.getProperty("surefire.test.class.path", System.getProperty("java.class.path"));
       for(String entry : classpath.split(Pattern.quote(File.pathSeparator)))
       {