diff --git a/plugin.conf b/plugin.conf
index fa03ff7..7218776 100644
--- a/plugin.conf
+++ b/plugin.conf
@@ -2,7 +2,7 @@ name=mail-login
 id=mail-login
 type=user
 author=HITME.PL
-version=1.0.3
+version=1.0.4
 active=no
 installed=no
 user_run_as=root
diff --git a/scripts/keygen.sh b/scripts/keygen.sh
index f4f4da1..4224b46 100755
--- a/scripts/keygen.sh
+++ b/scripts/keygen.sh
@@ -5,7 +5,6 @@ KEY_DIR="${MAIL_LOGIN_KEY_DIR:-/usr/local/hitme_plugins/mail-login/secrets}"
 KEY_NAME="${MAIL_LOGIN_KEY_NAME:-mx1_ed25519}"
 KEY_PATH="$KEY_DIR/$KEY_NAME"
 MX_MODE="${MX_LOGIN_MODE:-1}"
-SOURCE_IP="${SOURCE_IP:-SOURCE_SERVER_PUBLIC_IP}"
 HELPER_COMMAND="${MAIL_LOGIN_HELPER_COMMAND:-/usr/local/hitme_plugins/mail-login-helper/bin/create-login-url}"
 
 derive_servername() {
@@ -21,6 +20,31 @@ clean_label() {
   printf '%s' "$1" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]/-/g; s/^-*//; s/-*$//'
 }
 
+detect_source_ip() {
+  if [ -n "${SOURCE_IP:-}" ]; then
+    printf '%s' "$SOURCE_IP"
+    return
+  fi
+
+  if command -v ip >/dev/null 2>&1; then
+    detected="$(ip route get 1.1.1.1 2>/dev/null | awk '{for (i=1;i<=NF;i++) if ($i=="src") {print $(i+1); exit}}')"
+    if [ -n "$detected" ]; then
+      printf '%s' "$detected"
+      return
+    fi
+  fi
+
+  if command -v hostname >/dev/null 2>&1; then
+    detected="$(hostname -I 2>/dev/null | awk '{print $1}')"
+    if [ -n "$detected" ]; then
+      printf '%s' "$detected"
+      return
+    fi
+  fi
+
+  return 1
+}
+
 SERVER_LABEL="$(clean_label "$(derive_servername)")"
 if [ -z "$SERVER_LABEL" ]; then
   echo "Cannot determine SERVERNAME" >&2
@@ -35,9 +59,10 @@ case "$MX_MODE" in
     ;;
 esac
 
+SOURCE_IP="$(detect_source_ip || true)"
 case "$SOURCE_IP" in
   *[!A-Za-z0-9:./_-]*|'')
-    echo "SOURCE_IP contains unsupported characters" >&2
+    echo "Cannot determine SOURCE_IP automatically. Set SOURCE_IP explicitly." >&2
     exit 1
     ;;
 esac
@@ -82,4 +107,3 @@ MAIL_LOGIN_SSH_KNOWN_HOSTS=/root/.ssh/known_hosts
 Add this line to /root/.ssh/authorized_keys on mx1:
 $AUTH_OPTIONS $PUB_KEY $COMMENT
 EOF
-
diff --git a/tests/keygen_script_test.php b/tests/keygen_script_test.php
index c5c38cc..71388dd 100644
--- a/tests/keygen_script_test.php
+++ b/tests/keygen_script_test.php
@@ -24,6 +24,29 @@ test('keygen script creates plugin key and direct ssh authorized keys line', fun
     assert_contains('KLUCZ PLUGINU mail-autologin DLA SERWERA h4', $output);
 });
 
+test('keygen script detects source ip without parameters', function (): void {
+    $keyDir = TEST_TMP . '/keys-auto';
+    $binDir = TEST_TMP . '/fake-bin';
+    mkdir($binDir, 0700, true);
+    test_write($binDir . '/ip', "#!/bin/sh\nif [ \"$1 $2 $3\" = 'route get 1.1.1.1' ]; then echo '1.1.1.1 via 203.0.113.1 dev eth0 src 203.0.113.55 uid 0'; exit 0; fi\nexit 1\n");
+    chmod($binDir . '/ip', 0755);
+
+    $script = PLUGIN_ROOT . '/scripts/keygen.sh';
+    $cmd = sprintf(
+        'PATH=%s:$PATH MAIL_LOGIN_KEY_DIR=%s %s',
+        escapeshellarg($binDir),
+        escapeshellarg($keyDir),
+        escapeshellarg($script)
+    );
+
+    exec($cmd, $out, $code);
+
+    assert_same(0, $code, implode("\n", $out));
+    $output = implode("\n", $out);
+    assert_contains('from="203.0.113.55"', $output);
+    assert_not_contains('SOURCE_SERVER_PUBLIC_IP', $output);
+});
+
 test('keygen script prints helper forced command line when mx login mode is helper', function (): void {
     $keyDir = TEST_TMP . '/keys-helper';
     $script = PLUGIN_ROOT . '/scripts/keygen.sh';
@@ -42,4 +65,3 @@ test('keygen script prints helper forced command line when mx login mode is help
     assert_contains('command="/usr/local/hitme_plugins/mail-login-helper/bin/create-login-url"', $output);
     assert_contains('KLUCZ PLUGINU mail-autologin DLA SERWERA h4', $output);
 });
-
diff --git a/tests/package_contents_test.php b/tests/package_contents_test.php
index 8592d14..c41b5b7 100644
--- a/tests/package_contents_test.php
+++ b/tests/package_contents_test.php
@@ -8,7 +8,7 @@ test('plugin metadata and packaging docs match project rules', function (): void
     assert_contains('name=mail-login', $conf);
     assert_contains('id=mail-login', $conf);
     assert_contains('type=user', $conf);
-    assert_contains('version=1.0.3', $conf);
+    assert_contains('version=1.0.4', $conf);
     assert_contains('user_run_as=root', $conf);
     assert_contains('/Users/marek/GPT/ChatGPT/da_plugins/mail-login/src', $packing);
     assert_contains('/Users/marek/GPT/ChatGPT/da_plugins/mail-login/archives/X.Y.Z/mail-login.tar.gz', $packing);