diff --git a/doc/release-notes/rl-2009.adoc b/doc/release-notes/rl-2009.adoc
index 0562e046..7657033f 100644
--- a/doc/release-notes/rl-2009.adoc
+++ b/doc/release-notes/rl-2009.adoc
@@ -43,3 +43,5 @@ $ nix-shell '<home-manager>' -A install
 
 will automatically include these options, when necessary.
 --
+
+* Git's `smtpEncryption` option is now set to `tls` only if both <<opt-accounts.email.accounts.\_name_.smtp.tls.enable>> and <<opt-accounts.email.accounts.\_name_.smtp.tls.useStartTls>> are `true`. If only <<opt-accounts.email.accounts.\_name_.smtp.tls.enable>> is `true`, `ssl` is used instead.
diff --git a/modules/programs/git.nix b/modules/programs/git.nix
index a174fa0c..312269de 100644
--- a/modules/programs/git.nix
+++ b/modules/programs/git.nix
@@ -277,7 +277,14 @@ in {
         genIdentity = name: account:
           with account;
           nameValuePair "sendemail.${name}" ({
-            smtpEncryption = if smtp.tls.enable then "tls" else "";
+            smtpEncryption = if smtp.tls.enable then
+              (if smtp.tls.useStartTls
+              || versionOlder config.home.stateVersion "20.09" then
+                "tls"
+              else
+                "ssl")
+            else
+              "";
             smtpServer = smtp.host;
             smtpUser = userName;
             from = address;
diff --git a/tests/modules/accounts/email-test-accounts.nix b/tests/modules/accounts/email-test-accounts.nix
index 9c9c90cf..9a4e0b8e 100644
--- a/tests/modules/accounts/email-test-accounts.nix
+++ b/tests/modules/accounts/email-test-accounts.nix
@@ -21,6 +21,7 @@
         passwordCommand = "password-command 2";
         imap.host = "imap.example.org";
         smtp.host = "smtp.example.org";
+        smtp.tls.useStartTls = true;
       };
     };
   };
diff --git a/tests/modules/programs/git/git-with-email-expected.conf b/tests/modules/programs/git/git-with-email-expected.conf
index 44035a23..f48b7c33 100644
--- a/tests/modules/programs/git/git-with-email-expected.conf
+++ b/tests/modules/programs/git/git-with-email-expected.conf
@@ -6,7 +6,7 @@
 
 [sendemail "hm@example.com"]
 	from = "hm@example.com"
-	smtpEncryption = "tls"
+	smtpEncryption = "ssl"
 	smtpServer = "smtp.example.com"
 	smtpUser = "home.manager"
 
diff --git a/tests/modules/programs/git/git-with-email.nix b/tests/modules/programs/git/git-with-email.nix
index ca577eef..d7ed7e18 100644
--- a/tests/modules/programs/git/git-with-email.nix
+++ b/tests/modules/programs/git/git-with-email.nix
@@ -13,6 +13,8 @@ with lib;
       userName = "H. M. Test";
     };
 
+    home.stateVersion = "20.09";
+
     nmt.script = ''
       function assertGitConfig() {
         local value