diff --git a/CHANGELOG.md b/CHANGELOG.md
index f652dade..6d18f120 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,7 @@ The **patch** part changes is incremented if multiple releases happen the same m
 * evocheck: upstream release 23.10
 * evolinux-base: dump-server-state upstream release 23.11
 * evolinux-base: use separate default config file for rsyslog
+* log2mail: move custom config in separate file
 * nagios: rename var `nagios_nrpe_process_processes` into `nagios_nrpe_processes` and check systemd-timesyncd instead of ntpd in Debian 12
 * proftpd: in SFTP vhost, enable SSH keys login, enable ed25549 host key for Debian >= 11
 
diff --git a/evolinux-base/tasks/log2mail.yml b/evolinux-base/tasks/log2mail.yml
index 9a1f3314..79e4f5e0 100644
--- a/evolinux-base/tasks/log2mail.yml
+++ b/evolinux-base/tasks/log2mail.yml
@@ -17,18 +17,23 @@
     state: started
     enabled: yes
 
-- name: log2mail config is present
+- name: log2mail evolinux config is absent from default config
   ansible.builtin.blockinfile:
     dest: /etc/log2mail/config/default
-    owner: log2mail
-    group: adm
-    mode: "0640"
     marker: "# {mark} ANSIBLE MANAGED RULES FOR DEFAULT INSTANCE"
-    block: |
-      file = /var/log/syslog
-      pattern = "Out of memory: Kill"
-      mailto = {{ log2mail_alert_email or general_alert_email | mandatory }}
-      template = /etc/log2mail/mail
+    state: absent
+  notify: restart log2mail
+  tags:
+    - log2mail
+
+- name: log2mail evolinux-defaults config is present
+  ansible.builtin.template:
+    src: log2mail/evolinux-defaults.j2
+    dest: /etc/log2mail/config/evolinux-defaults
+    owner: log2mail
+    group: adm
+    mode: "0640"
+    force: yes
   notify: restart log2mail
   tags:
     - log2mail