diff --git a/config/schema.cue b/config/schema.cue
index 4bd0cae97..69247865e 100644
--- a/config/schema.cue
+++ b/config/schema.cue
@@ -246,7 +246,7 @@ import "path"
     listen_backlog?: uint
     error_log_level: string | *"notice"
     api_user: {
-      email_regex: string | *"\\A[^@\\s]+@[^@\\s]+\\.[^@\\s]+\\z"
+      email_regex: string | *"\\A[^@<>\\s]+@[^@<>\\s]+\\.[^@<>\\s]+\\z"
       first_name_exclude_regex: string | *"(http|https|www|<|>|\\r|\\n)"
       last_name_exclude_regex: string | *"(http|https|www|<|>|\\r|\\n)"
       force_public_verify_email: bool | *false
@@ -256,7 +256,7 @@ import "path"
       username_is_email: bool | *true
       password_length_min: uint | *14
       password_length_max: uint | *72
-      email_regex: string | *"\\A[^@\\s]+@[^@\\s]+\\.[^@\\s]+\\z"
+      email_regex: string | *"\\A[^@<>\\s]+@[^@<>\\s]+\\.[^@<>\\s]+\\z"
       password_regex?: string
       login_header?: string
       login_footer?: string
diff --git a/test/apis/v1/users/test_create_welcome_email.rb b/test/apis/v1/users/test_create_welcome_email.rb
index d384c8192..e98a973a6 100644
--- a/test/apis/v1/users/test_create_welcome_email.rb
+++ b/test/apis/v1/users/test_create_welcome_email.rb
@@ -292,7 +292,7 @@ def test_html_escaping
     response = Typhoeus.post("https://127.0.0.1:9081/api-umbrella/v1/users.json", http_options.deep_merge(non_admin_key_creator_api_key).deep_merge({
       :headers => { "Content-Type" => "application/x-www-form-urlencoded" },
       :body => {
-        :user => FactoryBot.attributes_for(:api_user, :email => "foo<script>&bar@example.com", :first_name => "Test&First", :last_name => "Test&Last"),
+        :user => FactoryBot.attributes_for(:api_user, :email => "foo&bar@example.com", :first_name => "Test&First", :last_name => "Test&Last"),
         :options => { :send_welcome_email => true },
       },
     }))
@@ -309,12 +309,12 @@ def test_html_escaping
     assert_match("Hi,</p>", message.fetch("HTML"))
     assert_match("Hi,", message.fetch("Text"))
 
-    assert_match("Your API key for <strong>foo&lt;script&gt;&amp;bar@example.com</strong> is:</p>", message.fetch("HTML"))
-    assert_match("Your API key for foo<script>&bar@example.com is:", message.fetch("Text"))
+    assert_match("Your API key for <strong>foo&amp;bar@example.com</strong> is:</p>", message.fetch("HTML"))
+    assert_match("Your API key for foo&bar@example.com is:", message.fetch("Text"))
 
     # Support footer
-    assert_match("Account Email: foo&lt;script&gt;&amp;bar@example.com", message.fetch("HTML"))
-    assert_match("Account Email: foo<script>&bar@example.com", message.fetch("Text"))
+    assert_match("Account Email: foo&amp;bar@example.com", message.fetch("HTML"))
+    assert_match("Account Email: foo&bar@example.com", message.fetch("Text"))
 
     assert_match("Account ID: #{user.id}", message.fetch("HTML"))
     assert_match("Account ID: #{user.id}", message.fetch("Text"))