diff --git a/CHANGELOG.md b/CHANGELOG.md
index 59a7a1b..8981c41 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -55,6 +55,11 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   it as quoted-printable for a server that does not announce 8BITMIME, after
   it was signed; `disable_mime_output_conversion=yes` now delivers it as
   signed. OpenDKIM's signatures were exposed to this too.
+- **A rotation of `mail.log` due at the container's start logged an error.**
+  It runs before Postfix does, and its `postfix reload` failed ("the Postfix
+  mail system is not running"); nothing was lost - the Postfix starting
+  next opens the new file - but logrotate reported a failure. It reloads
+  only a running Postfix now.
 - **A start on a queue of an earlier image could stop at `postfix check`.**
   The numbers the image's package accounts get depend on what else it
   installs, and the queue under `/data` kept the old ones; `postsuper`, which
diff --git a/build/logrotate-mail.conf b/build/logrotate-mail.conf
index f409f73..5f4d670 100644
--- a/build/logrotate-mail.conf
+++ b/build/logrotate-mail.conf
@@ -15,7 +15,15 @@
 	compress
 	delaycompress
 	create 0640 postfix selfpost
+	# A rotation due when the container starts runs before Postfix does
+	# (logrotate-loop.sh runs at once, the wrapper waits for the milter
+	# sockets): no postlogd holds the old file then, the one Postfix starts
+	# opens the new, and a reload would only fail - "fatal: the Postfix mail
+	# system is not running", seen at the test server's rollout of
+	# 2026-10-16. "postfix status" exits 1 while no master runs (Postfix
+	# 3.10.13, conf/postfix-script:297-307), reload then nothing.
 	postrotate
+		/usr/sbin/postfix status >/dev/null 2>&1 || exit 0
 		/usr/sbin/postfix reload
 	endscript
 }
diff --git a/test/e2e/upgrade_test.go b/test/e2e/upgrade_test.go
index 1c88758..c78d0ff 100644
--- a/test/e2e/upgrade_test.go
+++ b/test/e2e/upgrade_test.go
@@ -64,7 +64,10 @@ for d in active bounce corrupt defer deferred flush hold incoming private saved
 done
 mkdir -p $q/maildrop $q/public $q/pid
 chown 4242:4244 $q/maildrop $q/public; chmod 730 $q/maildrop; chmod 710 $q/public
-chown root:root $q $q/pid; chmod 755 $q $q/pid`
+chown root:root $q $q/pid; chmod 755 $q $q/pid
+mkdir -p /data/log
+echo "Oct 14 00:00:00 mail postfix/master[1]: daemon started" > /data/log/mail.log
+printf 'logrotate state -- version 2\n"/data/log/mail.log" 2026-10-14-0:0:0\n' > /data/log/.logrotate.status`
 	if out, err := exec.Command("docker", "run", "--rm", "--entrypoint", "sh",
 		"-v", dataDir+":/data", "selfpost:e2e", "-c", layout).CombinedOutput(); err != nil {
 		t.Fatalf("lay out the 2.7 /data: %v\n%s", err, out)
@@ -118,4 +121,14 @@ chown root:root $q $q/pid; chmod 755 $q $q/pid`
 	if !strings.Contains(logs(), "the DKIM keys were copied from /data/opendkim to /data/dkim") {
 		t.Errorf("the entrypoint did not say it copied the keys:\n%s", logs())
 	}
+	// A rotation due at the start runs before Postfix does: it rotates, and
+	// its postrotate asks no reload of a Postfix not running yet (the test
+	// server's rollout of 2026-10-16 logged "fatal: the Postfix mail system
+	// is not running"; build/logrotate-mail.conf).
+	if got := exec1(`test -f /data/log/mail.log.1 && echo rotated`); got != "rotated" {
+		t.Errorf("the rotation due at the start did not run: %q", got)
+	}
+	if l := logs(); strings.Contains(l, "error running non-shared postrotate script") || strings.Contains(l, "logrotate failed") {
+		t.Errorf("the rotation at the start failed:\n%s", l)
+	}
 }