diff --git a/lib/__tests__/email-sanitization.test.ts b/lib/__tests__/email-sanitization.test.ts
index 4691b0e0..103d2dcf 100644
--- a/lib/__tests__/email-sanitization.test.ts
+++ b/lib/__tests__/email-sanitization.test.ts
@@ -6,6 +6,7 @@ import {
   parseHtmlSafely,
   hasRichFormatting,
   plainTextToSafeHtml,
+  sanitizePlainTextRenderedHtml,
   EMAIL_SANITIZE_CONFIG,
   EMAIL_IFRAME_SANITIZE_CONFIG,
   isExternalResourceUrl,
@@ -580,4 +581,24 @@ describe('email-sanitization', () => {
       expect(result).toContain('javascript:alert(1)');
     });
   });
+
+  describe('sanitizePlainTextRenderedHtml', () => {
+    // This branch renders into the main document, not the sandboxed iframe, so
+    // an anchor that loses target="_blank" navigates the whole app away.
+    it('preserves target and rel on links emitted by plainTextToSafeHtml', () => {
+      const rendered = sanitizePlainTextRenderedHtml(
+        plainTextToSafeHtml('see https://github.com/honzup/webmail/pull/560'),
+      );
+      expect(rendered).toContain('target="_blank"');
+      expect(rendered).toContain('rel="noopener noreferrer"');
+    });
+
+    it('still strips dangerous schemes and tags', () => {
+      const rendered = sanitizePlainTextRenderedHtml(
+        '<a href="javascript:alert(1)" target="_blank">x</a><script>alert(1)</script>',
+      );
+      expect(rendered).not.toContain('javascript:');
+      expect(rendered).not.toContain('<script');
+    });
+  });
 });
diff --git a/lib/email-sanitization.ts b/lib/email-sanitization.ts
index f1b39c90..fe1bbff7 100644
--- a/lib/email-sanitization.ts
+++ b/lib/email-sanitization.ts
@@ -132,6 +132,12 @@ export function sanitizeI18nHtml(html: string): string {
 const PLAIN_TEXT_RENDERED_CONFIG = {
   ALLOWED_TAGS: ['a', 'br', 'p', 'div', 'span'],
   ALLOWED_ATTR: ['href', 'target', 'rel', 'class', 'style'],
+  // DOMPurify URI-tests every attribute value not on its URI-safe list, so the
+  // strict ALLOWED_URI_REGEXP below would strip target="_blank" (and rel) —
+  // "_blank" is not a URI. This branch renders into the main document rather
+  // than the sandboxed iframe, so losing target turns every link into a
+  // whole-app navigation. Exempt the two from the URI check.
+  ADD_URI_SAFE_ATTR: ['target', 'rel'],
   ALLOW_DATA_ATTR: false,
   ALLOWED_URI_REGEXP: /^(?:https?:|mailto:|tel:|cid:|#)/i,
 };