diff --git a/firestore-send-email/CHANGELOG.md b/firestore-send-email/CHANGELOG.md
index 63d7fc7c61..6f25b6c607 100644
--- a/firestore-send-email/CHANGELOG.md
+++ b/firestore-send-email/CHANGELOG.md
@@ -1,3 +1,7 @@
+## Version 0.2.11
+
+fixed - anchor the `SMTP_CONNECTION_URI` validation regex so a valid prefix followed by trailing text is rejected
+
 ## Version 0.2.10
 
 chore: bump nodemailer to v9 and remove unused rimraf dependency
diff --git a/firestore-send-email/extension.yaml b/firestore-send-email/extension.yaml
index 3e8c1df014..ebfd516b01 100644
--- a/firestore-send-email/extension.yaml
+++ b/firestore-send-email/extension.yaml
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 name: firestore-send-email
-version: 0.2.10
+version: 0.2.11
 specVersion: v1beta
 
 displayName: Trigger Email from Firestore
@@ -229,7 +229,7 @@ params:
     type: string
     example: smtps://username@smtp.hostname.com:465
     validationRegex:
-      "^(smtp[s]*://(.*?(:[^:@]*)?@)?[^:@]+:[0-9]+(\\?[^ ]*)?)|^$"
+      "^(smtp[s]*://(.*?(:[^:@]*)?@)?[^:@]+:[0-9]+(\\?[^ ]*)?)$|^$"
     validationErrorMessage:
       Invalid SMTP connection URI. Must be in the form
       `smtp(s)://username:password@hostname:port` or
diff --git a/kits/firestore-send-email/src/config.ts b/kits/firestore-send-email/src/config.ts
index ed80adb223..ff82be5b2f 100644
--- a/kits/firestore-send-email/src/config.ts
+++ b/kits/firestore-send-email/src/config.ts
@@ -169,7 +169,7 @@ const params = {
         example: "smtps://username@smtp.hostname.com:465",
 
         validationRegex:
-          /^(smtp[s]*:\/\/(.*?(:[^:@]*)?@)?[^:@]+:[0-9]+(\?[^ ]*)?)|^$/,
+          /^(smtp[s]*:\/\/(.*?(:[^:@]*)?@)?[^:@]+:[0-9]+(\?[^ ]*)?)$|^$/,
         validationErrorMessage:
           "Invalid SMTP connection URI. Must be in the form `smtp(s)://username:password@hostname:port` or `smtp(s)://username@hostname:port` or to be left blank.",
       },
diff --git a/kits/firestore-send-email/tests/config.test.ts b/kits/firestore-send-email/tests/config.test.ts
index 2b18ceb5be..85cd3ccce8 100644
--- a/kits/firestore-send-email/tests/config.test.ts
+++ b/kits/firestore-send-email/tests/config.test.ts
@@ -164,6 +164,8 @@ describe("SMTP_CONNECTION_URI validationRegex", () => {
       "smtps://smtp.gmail.com:465",
       "smtps://username@gmail.com:password@smtp.gmail.com:465",
       "smtp://smtp.gmail.com:587?pool=true",
+      // Password containing the separator characters the regex reasons about.
+      "smtp://fakeemail@gmail.com:4,h?dhuNTbv9zMrP4&7&7%*3@smtp.gmail.com:465?pool=true&service=gmail",
       "",
     ]) {
       expect(connectionUriRegex().test(uri)).toBe(true);
@@ -175,13 +177,15 @@ describe("SMTP_CONNECTION_URI validationRegex", () => {
     expect(connectionUriRegex().test("smtp://smtp.gmail.com")).toBe(false);
   });
 
-  // Inherited from the legacy extension.yaml regex; anchoring is tracked in #3067.
-  test("accepts trailing garbage after a valid prefix because the first alternative is unanchored", () => {
+  // #3067: the first alternative used to be unanchored, so anything following a
+  // valid prefix was accepted. The legacy suite already asserted the first case
+  // is invalid, but against an anchored copy of the regex that never shipped.
+  test("rejects trailing text after an otherwise valid URI", () => {
     for (const uri of [
       "smtp://fakeemail@gmail.com:4,h?dhuNTbv9zMrP4&7&7%*3:smtp.gmail.com:465?pool=true&service=gmail",
       "smtps://smtp.gmail.com:465 and then total garbage",
     ]) {
-      expect(connectionUriRegex().test(uri)).toBe(true);
+      expect(connectionUriRegex().test(uri)).toBe(false);
     }
   });
 });