diff --git a/dovecot/keyproxy.go b/dovecot/keyproxy.go
index c3c621f374099a6bd32d3c2cdac24a5b5da10747..265130fa2d046e2e87752eb4e08b87ec35b284c9 100644
--- a/dovecot/keyproxy.go
+++ b/dovecot/keyproxy.go
@@ -78,17 +78,22 @@ func NewKeyLookupProxy(config *Config) (*KeyLookupProxy, error) {
 	}, nil
 }
 
+const (
+	namespace    = "shared"
+	namespaceLen = len(namespace)
+)
+
 // Lookup a key using the dovecot dict proxy interface.
 //
 // We can be sent a userdb lookup, or a passdb lookup, and we can tell
 // them apart with the key prefix (passdb/ or userdb/).
 func (s *KeyLookupProxy) Lookup(ctx context.Context, key string) (interface{}, bool, error) {
 	switch {
-	case strings.HasPrefix(key, "passdb/"):
-		kparts := strings.SplitN(key[7:], passwordSep, 2)
+	case strings.HasPrefix(key, namespace+"/passdb/"):
+		kparts := strings.SplitN(key[namespaceLen+8:], passwordSep, 2)
 		return s.lookupPassdb(ctx, kparts[0], kparts[1])
-	case strings.HasPrefix(key, "userdb/"):
-		return s.lookupUserdb(ctx, key[7:])
+	case strings.HasPrefix(key, namespace+"/userdb/"):
+		return s.lookupUserdb(ctx, key[namespaceLen+8:])
 	default:
 		log.Printf("unknown key %s", key)
 		return nil, false, nil