diff --git a/core/base/Dockerfile b/core/base/Dockerfile
index 82c8cb9b..7919738a 100644
--- a/core/base/Dockerfile
+++ b/core/base/Dockerfile
@@ -60,7 +60,7 @@ ENV PATH="${VIRTUAL_ENV}/bin:${PATH}"
 COPY requirements-${MAILU_DEPS}.txt ./
 COPY libs/ libs/
 
-ARG SNUFFLEUPAGUS_VERSION=0.8.3
+ARG SNUFFLEUPAGUS_VERSION=0.9.0
 ENV SNUFFLEUPAGUS_URL https://github.com/jvoisin/snuffleupagus/archive/refs/tags/v$SNUFFLEUPAGUS_VERSION.tar.gz
 
 RUN set -euxo pipefail \
diff --git a/towncrier/newsfragments/2618.misc b/towncrier/newsfragments/2618.misc
new file mode 100644
index 00000000..bb1d340a
--- /dev/null
+++ b/towncrier/newsfragments/2618.misc
@@ -0,0 +1 @@
+Upgrade to snuffleupagus 0.9.0
diff --git a/webmails/snuffleupagus.rules b/webmails/snuffleupagus.rules
index a2304fe0..cec99c29 100644
--- a/webmails/snuffleupagus.rules
+++ b/webmails/snuffleupagus.rules
@@ -130,5 +130,4 @@ sp.cookie.name("roundcube_sessid").samesite("strict");
 sp.ini_protection.policy_silent_fail();
 
 # roundcube uses unserialize() everywhere.
-# This should do the job until https://github.com/jvoisin/snuffleupagus/issues/438 is implemented.
-sp.disable_function.function("unserialize").param("data").value_r("[cCoO]:\d+:[\"{]").drop();
+sp.unserialize_noclass.enable();