diff --git a/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb b/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb
index c196054..052a15c 100644
--- a/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb
+++ b/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb
@@ -16,6 +16,37 @@ whitelist_auth <%= @whitelist_auth %>
 #    _CONTACTADDRESS_ in the report template)
 report_contact <%= @report_contact %>
 
+###########################################################################
+# Kosmos custom score overrides
+#
+# The Validity (Return Path / SenderScore) "certified sender" whitelists
+# (RCVD_IN_VALIDITY_CERTIFIED, RCVD_IN_VALIDITY_SAFE) hand out up to -5.0
+# of credit to sending IPs. These lists are commercially gamed and
+# routinely award -5.0 to IPs that are simultaneously listed on Spamhaus
+# SBL-CSS, SpamCop, MSPIKE and Validity's own RPBL. Neutralise them.
+###########################################################################
+score RCVD_IN_VALIDITY_CERTIFIED 0
+score RCVD_IN_VALIDITY_SAFE 0
+
+###########################################################################
+# Bayes hardening
+###########################################################################
+use_bayes 1
+bayes_auto_learn 1
+
+# Do not let Bayes learn from SpamAssassin's own result headers or from
+# Authentication-Results, which leak signal about prior scoring runs.
+bayes_ignore_header X-Spam-Flag
+bayes_ignore_header X-Spam-Status
+bayes_ignore_header X-Spam-Level
+bayes_ignore_header X-Spam-Checker-Version
+bayes_ignore_header Authentication-Results
+
+# Only learn ham when the message is clearly clean, and only learn spam
+# when it is clearly spam. The defaults (0.1 / 6.0) let marginally-spam
+# or marginally-ham messages poison the database.
+bayes_auto_learn_threshold_nonspam -1.0
+bayes_auto_learn_threshold_spam 8.0
 
 #   Add *****SPAM***** to the Subject header of spam e-mails
 #