diff --git a/mail-mta/postfix/Manifest b/mail-mta/postfix/Manifest
index 2826b071..3922a75d 100644
--- a/mail-mta/postfix/Manifest
+++ b/mail-mta/postfix/Manifest
@@ -1 +1 @@
-DIST postfix-3.5.8.tar.gz 4614733 BLAKE2B 13166e854f70987f981bb5e7e5dabfaa73b3170ab16fc1ff8f70f6b98a0697ac980bdf74bbfb39fdfd1972f922a31a28882b1575b79fd8f01d81e08e68d756bc SHA512 0abb07d99e343b76e6a26b4a090af9d592f4dfd03c8c737cc72bfb0f4267dafcbb0cb0aa7b6255f8b834c9289d89a5c47b167be3758239309937cb77e0d9464b
+DIST postfix-3.5.19.tar.gz 4628308 BLAKE2B f194e42041429766fbf46f0b034269793451df1dd19be1b31a65f9615a581e461a89f7d4f862fb0d23bfdff0c7d64423003c3b017ffde1fa26ab2ac61c74d2c1 SHA512 93abf97c2d9d7d72b18f837e14f9041839abc596e6cfba6aaca360efc3fb04e5fdfc33f4cd9bc48576df9cbbec320c1921fec298eb350e7e0f3464ca3063e7d4
diff --git a/mail-mta/postfix/files/postfix-libressl-server.patch b/mail-mta/postfix/files/postfix-3.5.8-libressl.patch
similarity index 50%
rename from mail-mta/postfix/files/postfix-libressl-server.patch
rename to mail-mta/postfix/files/postfix-3.5.8-libressl.patch
index 8573bb80..10cbf995 100644
--- a/mail-mta/postfix/files/postfix-libressl-server.patch
+++ b/mail-mta/postfix/files/postfix-3.5.8-libressl.patch
@@ -1,5 +1,18 @@
 see https://bugs.gentoo.org/678874
 
+--- a/src/tls/tls_certkey.c.orig	2019-03-07 23:57:10 UTC
++++ b/src/tls/tls_certkey.c
+@@ -144,7 +144,7 @@ static void init_pem_load_state(pem_load
+ 
+ /* use_chain - load cert, key and chain into ctx or ssl */
+ 
+-#if OPENSSL_VERSION_NUMBER >= 0x1010100fUL
++#if OPENSSL_VERSION_NUMBER >= 0x1010100fUL && !defined(LIBRESSL_VERSION_NUMBER)
+ static int use_chain(pem_load_state_t *st)
+ {
+     int     ret;
+see https://bugs.gentoo.org/678874
+
 --- a/src/tls/tls_server.c.orig	2018-12-26 19:21:49 UTC
 +++ b/src/tls/tls_server.c
 @@ -518,7 +518,9 @@ TLS_APPL_STATE *tls_server_init(const TL
diff --git a/mail-mta/postfix/files/postfix-libressl-certkey.patch b/mail-mta/postfix/files/postfix-libressl-certkey.patch
deleted file mode 100644
index b6ab8aeb..00000000
--- a/mail-mta/postfix/files/postfix-libressl-certkey.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-see https://bugs.gentoo.org/678874
-
---- a/src/tls/tls_certkey.c.orig	2019-03-07 23:57:10 UTC
-+++ b/src/tls/tls_certkey.c
-@@ -144,7 +144,7 @@ static void init_pem_load_state(pem_load
- 
- /* use_chain - load cert, key and chain into ctx or ssl */
- 
--#if OPENSSL_VERSION_NUMBER >= 0x1010100fUL
-+#if OPENSSL_VERSION_NUMBER >= 0x1010100fUL && !defined(LIBRESSL_VERSION_NUMBER)
- static int use_chain(pem_load_state_t *st)
- {
-     int     ret;
diff --git a/mail-mta/postfix/files/postfix.rc6.2.7 b/mail-mta/postfix/files/postfix.rc6.2.7
index 5d429a59..62f6dda3 100644
--- a/mail-mta/postfix/files/postfix.rc6.2.7
+++ b/mail-mta/postfix/files/postfix.rc6.2.7
@@ -45,7 +45,7 @@ start() {
 stop() {
 	ebegin "Stopping postfix ${CONF_MESSAGE}"
 	/usr/sbin/postfix ${CONF_PARAM} stop >/dev/null 2>&1
-	eend
+	eend $?
 }
 
 status() {
diff --git a/mail-mta/postfix/files/postfix.service b/mail-mta/postfix/files/postfix.service
index db585b3e..7a72aaa8 100644
--- a/mail-mta/postfix/files/postfix.service
+++ b/mail-mta/postfix/files/postfix.service
@@ -12,7 +12,7 @@ ExecReload=/usr/sbin/postfix reload
 PrivateTmp=yes
 PrivateDevices=yes
 ProtectSystem=full
-ReadWritePaths=-/etc/mail/aliases.db
+ReadWritePaths=-/etc/mail/aliases.db -/etc/mail/aliases.cdb -/etc/mail/aliases.lmdb
 CapabilityBoundingSet=~ CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE
 MemoryDenyWriteExecute=true
 ProtectKernelModules=true
diff --git a/mail-mta/postfix/postfix-3.5.8.ebuild b/mail-mta/postfix/postfix-3.5.19.ebuild
similarity index 97%
rename from mail-mta/postfix/postfix-3.5.8.ebuild
rename to mail-mta/postfix/postfix-3.5.19.ebuild
index 76b71980..4c1af31f 100644
--- a/mail-mta/postfix/postfix-3.5.8.ebuild
+++ b/mail-mta/postfix/postfix-3.5.19.ebuild
@@ -1,7 +1,7 @@
 # Copyright 1999-2021 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 inherit flag-o-matic pam systemd toolchain-funcs
 
@@ -16,7 +16,7 @@ SRC_URI="${MY_URI}/${MY_SRC}.tar.gz"
 
 LICENSE="|| ( IBM EPL-2.0 )"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~mips ppc ppc64 ~s390 ~sparc x86"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
 IUSE="+berkdb cdb dovecot-sasl +eai hardened ldap ldap-bind lmdb memcached mbox mysql nis pam postgres sasl selinux sqlite ssl"
 
 DEPEND="
@@ -45,15 +45,12 @@ RDEPEND="${DEPEND}
 	!mail-mta/courier
 	!mail-mta/esmtp
 	!mail-mta/exim
-	!mail-mta/mini-qmail
 	!mail-mta/msmtp[mta]
 	!mail-mta/netqmail
 	!mail-mta/nullmailer
-	!mail-mta/qmail-ldap
 	!mail-mta/sendmail
 	!mail-mta/opensmtpd
 	!mail-mta/ssmtp[mta]
-	!net-mail/fastforward
 	selinux? ( sec-policy/selinux-postfix )"
 
 REQUIRED_USE="ldap-bind? ( ldap sasl )"
@@ -61,8 +58,7 @@ REQUIRED_USE="ldap-bind? ( ldap sasl )"
 S="${WORKDIR}/${MY_SRC}"
 
 PATCHES=(
-	"${FILESDIR}/${PN}-libressl-certkey.patch"
-	"${FILESDIR}/${PN}-libressl-server.patch"
+	"${FILESDIR}/${PN}-3.5.8-libressl.patch"
 )
 
 src_prepare() {