diff --git a/emailnotif.js b/emailnotif.js
index c0fe72e..c0c800d 100644
--- a/emailnotif.js
+++ b/emailnotif.js
@@ -1,7 +1,10 @@
 const http = require('http');
 const db = require('./config/dbproc.js');
 
-const RECIPIENT = 'rizki.rmdhn1304@gmail.com';
+const ALLOWED_EMAILS = new Set([
+    'david.rodriques@telin.net',
+    'syam.thasya@telin.net',
+]);
 
 function buildHtml(approverName, title, priorName, idxjustification, remark, status) {
     const url = status === 'RETURNED'
@@ -43,13 +46,18 @@ function logEmail(trxId, toEmail, subject, html, fromEmail, status, requestPaylo
     });
 }
 
-function postEmail(approverName, title, priorName, idxjustification, remark, status) {
+function postEmail(toEmail, approverName, title, priorName, idxjustification, remark, status) {
+    if (!ALLOWED_EMAILS.has(toEmail)) {
+        console.log('[email-notif] skipped (not in allowed list):', toEmail);
+        return;
+    }
+
     const subject = status === 'RETURNED'
         ? `[Returned] Justification for ${title}`
         : `[Approval Required] Justification for ${title}`;
     const html = buildHtml(approverName, title, priorName, idxjustification, remark, status);
     const payload = JSON.stringify({
-        to: [RECIPIENT],
+        to: [toEmail],
         cc: [],
         bcc: [],
         subject,
@@ -78,14 +86,14 @@ function postEmail(approverName, title, priorName, idxjustification, remark, sta
             } catch (_) {}
 
             const logStatus = res.statusCode >= 200 && res.statusCode < 300 ? 'success' : 'failed';
-            console.log('[email-notif] sent, status:', res.statusCode, '| trxId:', trxId);
-            logEmail(trxId, RECIPIENT, subject, html, '', logStatus, payload, responseMessage);
+            console.log('[email-notif] sent, status:', res.statusCode, '| trxId:', trxId, '| to:', toEmail);
+            logEmail(trxId, toEmail, subject, html, '', logStatus, payload, responseMessage);
         });
     });
 
     req.on('error', (err) => {
         console.error('[email-notif] failed:', err.message);
-        logEmail('', RECIPIENT, subject, html, '', 'failed', payload, err.message);
+        logEmail('', toEmail, subject, html, '', 'failed', payload, err.message);
     });
 
     req.write(payload);
@@ -112,7 +120,7 @@ function notifyOnSubmit(idxjustification) {
         const creatorName = rows[0].creator_name;
 
         const qryApprover = `
-            select t.nik, e.fullname
+            select t.nik, e.fullname, e.email
             from tbl_justificationttd t
             join dbssotcel.tbl_employee e on e.nik = t.nik
             where t.idxjustification = '${idxjustification}' and t.issigned = 0 and t.isdeleted = 0
@@ -123,7 +131,7 @@ function notifyOnSubmit(idxjustification) {
                 console.error('[email-notif] notifyOnSubmit: no approver found', err2);
                 return;
             }
-            postEmail(rows2[0].fullname, title, creatorName, idxjustification, remark);
+            postEmail(rows2[0].email, rows2[0].fullname, title, creatorName, idxjustification, remark);
         });
     });
 }
@@ -150,7 +158,7 @@ function notifyOnSigned(idxjustification, signerNik) {
             const signerName = rows2[0].fullname;
 
             const qryNext = `
-                select t.nik, e.fullname
+                select t.nik, e.fullname, e.email
                 from tbl_justificationttd t
                 join dbssotcel.tbl_employee e on e.nik = t.nik
                 where t.idxjustification = '${idxjustification}' and t.issigned = 0 and t.isdeleted = 0
@@ -161,7 +169,7 @@ function notifyOnSigned(idxjustification, signerNik) {
                     console.log('[email-notif] notifyOnSigned: no more approvers to notify');
                     return;
                 }
-                postEmail(rows3[0].fullname, title, signerName, idxjustification, remark);
+                postEmail(rows3[0].email, rows3[0].fullname, title, signerName, idxjustification, remark);
             });
         });
     });
@@ -172,7 +180,7 @@ function notifyOnSigned(idxjustification, signerNik) {
  */
 function notifyOnReturn(idxjustification, returnerNik) {
     const qryJustification = `
-        select j.title, j.remark, e.fullname as creator_name
+        select j.title, j.remark, e.fullname as creator_name, e.email as creator_email
         from tbl_justification j
         join dbssotcel.tbl_employee e on e.nik = j.iby
         where j._idx = '${idxjustification}' limit 1
@@ -185,6 +193,7 @@ function notifyOnReturn(idxjustification, returnerNik) {
         const title = rows[0].title;
         const remark = rows[0].remark || '';
         const creatorName = rows[0].creator_name;
+        const creatorEmail = rows[0].creator_email;
 
         const qryReturner = `select fullname from dbssotcel.tbl_employee where nik = '${returnerNik}' limit 1`;
         db.query(qryReturner, [], function(err2, rows2) {
@@ -193,7 +202,7 @@ function notifyOnReturn(idxjustification, returnerNik) {
                 return;
             }
             const returnerName = rows2[0].fullname;
-            postEmail(creatorName, title, returnerName, idxjustification, remark, 'RETURNED');
+            postEmail(creatorEmail, creatorName, title, returnerName, idxjustification, remark, 'RETURNED');
         });
     });
 }