diff --git a/go.mod b/go.mod
index fb7c1e85..663eb055 100644
--- a/go.mod
+++ b/go.mod
@@ -31,7 +31,7 @@ require (
 	github.com/libdns/alidns v1.0.3-0.20230628155627-8d5d630d5516
 	github.com/libdns/cloudflare v0.1.1-0.20221006221909-9d3ab3c3cddd
 	github.com/libdns/digitalocean v0.0.0-20230728223659-4f9064657aea
-	github.com/libdns/gandi v1.0.3-0.20220921161957-dcd0274d2c79
+	github.com/libdns/gandi v1.0.3
 	github.com/libdns/googleclouddns v1.1.0
 	github.com/libdns/hetzner v0.0.1
 	github.com/libdns/leaseweb v0.3.1
@@ -168,3 +168,5 @@ require (
 )
 
 replace github.com/emersion/go-imap => github.com/foxcpp/go-imap v1.0.0-beta.1.0.20220623182312-df940c324887
+
+replace github.com/libdns/gandi => github.com/foxcpp/libdns-gandi v1.0.4-0.20240127130558-4782f9d5ce3e // v1.0.3+maddy.1
diff --git a/go.sum b/go.sum
index 3d025b0c..4455bdc6 100644
--- a/go.sum
+++ b/go.sum
@@ -325,6 +325,8 @@ github.com/foxcpp/go-mockdns v1.0.0 h1:7jBqxd3WDWwi/6WhDvacvH1XsN3rOLXyHM1uhvIx6
 github.com/foxcpp/go-mockdns v1.0.0/go.mod h1:lgRN6+KxQBawyIghpnl5CezHFGS9VLzvtVlwxvzXTQ4=
 github.com/foxcpp/go-mtasts v0.0.0-20191219193356-62bc3f1f74b8 h1:k8w0iy6GP9oeSZWUH3p2DqZHaXDKZGNs3NZGZMGfQHc=
 github.com/foxcpp/go-mtasts v0.0.0-20191219193356-62bc3f1f74b8/go.mod h1:HO1YOCbBM8KjpgThMMFejHx6K/UsnEv2Oh9YGtBIlOU=
+github.com/foxcpp/libdns-gandi v1.0.4-0.20240127130558-4782f9d5ce3e h1:hKk+CGUtwnKDGKINPEojeo91kx0tnV6V4tlzHehJPfg=
+github.com/foxcpp/libdns-gandi v1.0.4-0.20240127130558-4782f9d5ce3e/go.mod h1:G6dw58Xnji2xX+lb+uZxGbtmfxKllm1CGHE2bOPG3WA=
 github.com/frankban/quicktest v1.5.0/go.mod h1:jaStnuzAqU1AJdCO0l53JDCJrVDKcS03DbaAcR7Ks/o=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
@@ -498,8 +500,6 @@ github.com/libdns/cloudflare v0.1.1-0.20221006221909-9d3ab3c3cddd h1:c5hc0b5/pFq
 github.com/libdns/cloudflare v0.1.1-0.20221006221909-9d3ab3c3cddd/go.mod h1:ob9J/elFVmPWKNHOMynwtH0h+T3pBrEL18amCSliwAQ=
 github.com/libdns/digitalocean v0.0.0-20230728223659-4f9064657aea h1:IGlMNZCUp8Ho7NYYorpP5ZJgg2mFXARs6eHs/pSqFkA=
 github.com/libdns/digitalocean v0.0.0-20230728223659-4f9064657aea/go.mod h1:B2TChhOTxvBflpRTHlguXWtwa1Ha5WI6JkB6aCViM+0=
-github.com/libdns/gandi v1.0.3-0.20220921161957-dcd0274d2c79 h1:s5zuoIehXkSKg6Yfd5Oh1jEfvWXSn+eAttVHufSzDPE=
-github.com/libdns/gandi v1.0.3-0.20220921161957-dcd0274d2c79/go.mod h1:VN+Lh8Teq6nYszNsPSLKdIv24hOCcQu0rJWHQa2jPZc=
 github.com/libdns/googleclouddns v1.1.0 h1:murPR1LfTZZObLV2OLxUVmymWH25glkMFKpDjkk2m0E=
 github.com/libdns/googleclouddns v1.1.0/go.mod h1:3tzd056dfqKlf71V8Oy19En4WjJ3ybyuWx6P9bQSCIw=
 github.com/libdns/hetzner v0.0.1 h1:WsmcsOKnfpKmzwhfyqhGQEIlEeEaEUvb7ezoJgBKaqU=
diff --git a/internal/libdns/gandi.go b/internal/libdns/gandi.go
index 91e8d87e..62c7c2d0 100644
--- a/internal/libdns/gandi.go
+++ b/internal/libdns/gandi.go
@@ -4,7 +4,10 @@
 package libdns
 
 import (
+	"fmt"
+
 	"github.com/foxcpp/maddy/framework/config"
+	"github.com/foxcpp/maddy/framework/log"
 	"github.com/foxcpp/maddy/framework/module"
 	"github.com/libdns/gandi"
 )
@@ -16,7 +19,17 @@ func init() {
 			RecordDeleter:  &p,
 			RecordAppender: &p,
 			setConfig: func(c *config.Map) {
-				c.String("api_token", false, true, "", &p.APIToken)
+				c.String("api_token", false, false, "", &p.APIToken)
+				c.String("personal_token", false, false, "", &p.BearerToken)
+			},
+			afterConfig: func() error {
+				if p.APIToken != "" {
+					log.Println("libdns.gandi: api_token is deprecated, use personal_token instead (https://api.gandi.net/docs/authentication/)")
+				}
+				if p.APIToken == "" && p.BearerToken == "" {
+					return fmt.Errorf("libdns.gandi: either api_token or personal_token should be specified")
+				}
+				return nil
 			},
 			instName: instName,
 			modName:  modName,
diff --git a/internal/libdns/provider_module.go b/internal/libdns/provider_module.go
index 74d201ef..75561501 100644
--- a/internal/libdns/provider_module.go
+++ b/internal/libdns/provider_module.go
@@ -8,7 +8,8 @@ import (
 type ProviderModule struct {
 	libdns.RecordDeleter
 	libdns.RecordAppender
-	setConfig func(c *config.Map)
+	setConfig   func(c *config.Map)
+	afterConfig func() error
 
 	instName string
 	modName  string
@@ -17,6 +18,11 @@ type ProviderModule struct {
 func (p *ProviderModule) Init(cfg *config.Map) error {
 	p.setConfig(cfg)
 	_, err := cfg.Process()
+	if p.afterConfig != nil {
+		if err := p.afterConfig(); err != nil {
+			return err
+		}
+	}
 	return err
 }