diff --git a/src/email.js b/src/email.js
index 8c8da72..e560266 100644
--- a/src/email.js
+++ b/src/email.js
@@ -33,6 +33,11 @@ async function getTransporter() {
   return _transporter
 }
 
+export function invalidateCache() {
+  _smtpCache = null
+  _transporter = null
+}
+
 export async function sendPinEmail(to, name, pin) {
   const config = await getSmtpConfig()
   const transport = await getTransporter()
diff --git a/src/routes/internal.js b/src/routes/internal.js
index 5271052..0f49183 100644
--- a/src/routes/internal.js
+++ b/src/routes/internal.js
@@ -1,5 +1,7 @@
 import { pool } from '../db.js'
 import { syncAllWorkforceUsers } from '../sync.js'
+import { invalidateCache as invalidateWorkforceCache } from '../workforce.js'
+import { invalidateCache as invalidateSmtpCache } from '../email.js'
 
 function isAuthorised(request) {
   const auth = request.headers.authorization || ''
@@ -7,6 +9,12 @@ function isAuthorised(request) {
   return secret && auth === `Bearer ${secret}`
 }
 
+function isSettingsAuthorised(request) {
+  const auth = request.headers.authorization || ''
+  const secret = process.env.SETTINGS_SECRET || ''
+  return secret && auth === `Bearer ${secret}`
+}
+
 // Service-to-service endpoints — no user cookie, Bearer token = CENTRAL_AUTH_SECRET.
 export async function internalRoutes(app) {
   app.get('/registry', async (request, reply) => {
@@ -29,4 +37,12 @@ export async function internalRoutes(app) {
       return reply.status(502).send({ error: e.message })
     }
   })
+
+  // Called by settings service after saving workforce/smtp integrations
+  app.post('/cache-bust', async (request, reply) => {
+    if (!isSettingsAuthorised(request)) return reply.status(401).send({ error: 'Unauthorized' })
+    invalidateWorkforceCache()
+    invalidateSmtpCache()
+    return { ok: true }
+  })
 }