diff --git a/core/admin/mailu/internal/views/auth.py b/core/admin/mailu/internal/views/auth.py
index 7de885b8..4aa31407 100644
--- a/core/admin/mailu/internal/views/auth.py
+++ b/core/admin/mailu/internal/views/auth.py
@@ -37,7 +37,7 @@ def nginx_authentication():
     is_valid_user = False
     username = response.headers.get('Auth-User', None)
     if response.headers.get("Auth-User-Exists") == "True":
-        if not is_app_token and utils.limiter.should_rate_limit_user(username, client_ip):
+        if not is_from_webmail and not is_app_token and utils.limiter.should_rate_limit_user(username, client_ip):
             # FIXME could be done before handle_authentication()
             status, code = nginx.get_status(flask.request.headers['Auth-Protocol'], 'ratelimit')
             response = flask.Response()
diff --git a/towncrier/newsfragments/3094.bugfix b/towncrier/newsfragments/3094.bugfix
new file mode 100644
index 00000000..e6706714
--- /dev/null
+++ b/towncrier/newsfragments/3094.bugfix
@@ -0,0 +1 @@
+Ensure we do not block logins from webmails when there is a valid SSO session