Trying to use Hydroxide with Postfix produces "502 5.7.0 Please authenticate first"

[sin-ack]

I have the following configuration on a Postfix installation to set it up as a relay to Hydroxide:

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myhostname = -snip-
myorigin = /etc/mailname
mydestination =
relayhost = [127.0.0.1]:1025
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = loopback-only
inet_protocols = all

smtp_tls_security_level = none
sender_dependent_relayhost_maps = hash:/etc/postfix/sender_relay
smtp_sasl_auth_enable = yes
smtp_sasl_security_options =
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd

I made sure that /etc/postfix/sasl_passwd contains the bridge password as instructed:

user@proton.me     user@proton.me:-snip-

However, when I try to send a test e-mail using the mail command I get this:

2025-04-30T08:57:54.970127+00:00 -snip- postfix/pickup[85438]: ECA3EC062E: uid=1000 from=<user@proton.me>
2025-04-30T08:57:54.982115+00:00 -snip- postfix/cleanup[85446]: ECA3EC062E: message-id=<20250430085754.ECA3EC062E@-snip->
2025-04-30T08:57:54.992882+00:00 -snip- postfix/qmgr[85439]: ECA3EC062E: from=<user@proton.me>, size=316, nrcpt=1 (queue active)
2025-04-30T08:57:55.039561+00:00 -snip- postfix/smtp[85448]: ECA3EC062E: to=<user@proton.me>, relay=127.0.0.1[127.0.0.1]:1025, delay=0.08, delays=0.06/0.02/0/0, dsn=5.7.0, status=bounced (host 127.0.0.1[127.0.0.1] said: 502 5.7.0 Please authenticate first (in reply to MAIL FROM command))
2025-04-30T08:57:55.041932+00:00 -snip- postfix/cleanup[85446]: 09DE4C11AB: message-id=<20250430085755.09DE4C11AB@-snip->
2025-04-30T08:57:55.051251+00:00 -snip- postfix/bounce[85449]: ECA3EC062E: sender non-delivery notification: 09DE4C11AB
2025-04-30T08:57:55.051390+00:00 -snip- postfix/qmgr[85439]: 09DE4C11AB: from=<>, size=2240, nrcpt=1 (queue active)
2025-04-30T08:57:55.051941+00:00 -snip- postfix/qmgr[85439]: ECA3EC062E: removed
2025-04-30T08:57:55.063003+00:00 -snip- postfix/smtp[85448]: 09DE4C11AB: to=<user@proton.me>, relay=127.0.0.1[127.0.0.1]:1025, delay=0.01, delays=0.01/0/0/0, dsn=5.7.0, status=bounced (host 127.0.0.1[127.0.0.1] said: 502 5.7.0 Please authenticate first (in reply to MAIL FROM command))
2025-04-30T08:57:55.064352+00:00 -snip- postfix/qmgr[85439]: 09DE4C11AB: removed

Debug logs from hydroxide smtp say:

220 localhost ESMTP Service Ready
EHLO -snip-
250-Hello -snip-
250-PIPELINING
250-8BITMIME
250-ENHANCEDSTATUSCODES
250-CHUNKING
250-AUTH PLAIN
250 SIZE
MAIL FROM:<user@proton.me> SIZE=316
RCPT TO:<user@proton.me>
DATA
502 5.7.0 Please authenticate first
502 5.5.1 Missing MAIL FROM command.
502 5.5.1 Missing RCPT TO command.
RSET
QUIT
250 2.0.0 Session reset
221 2.0.0 Bye
220 localhost ESMTP Service Ready
EHLO -snip-
250-Hello -snip-
250-PIPELINING
250-8BITMIME
250-ENHANCEDSTATUSCODES
250-CHUNKING
250-AUTH PLAIN
250 SIZE
MAIL FROM:<> SIZE=2240 BODY=8BITMIME
RCPT TO:<user@proton.me>
DATA
502 5.7.0 Please authenticate first
502 5.5.1 Missing MAIL FROM command.
502 5.5.1 Missing RCPT TO command.
RSET
QUIT
250 2.0.0 Session reset
221 2.0.0 Bye

Did I misconfigure something or is something missing from Hydroxide for this?