diff --git a/docs/debian-conf.d/router/250_vexim_virtual_domains b/docs/debian-conf.d/router/250_vexim_virtual_domains
index c55863c7..9795f0b7 100644
--- a/docs/debian-conf.d/router/250_vexim_virtual_domains
+++ b/docs/debian-conf.d/router/250_vexim_virtual_domains
@@ -38,6 +38,25 @@ virtual_forward:
                                 and users.on_forward = '1' \
                                 and users.domain_id=domains.domain_id}}}{1} }} {yes}{no} }
 
+virtual_piped:
+  driver = redirect
+  domains = +local_domains
+  allow_fail
+  data = ${lookup mysql{select smtp from users,domains \
+        where localpart = '${quote_mysql:$local_part}' \
+        and domain = '${quote_mysql:$domain}' \
+        and users.on_piped = '1' \
+        and domains.pipe = '1' \
+        and domains.enabled = '1' \
+        and users.enabled = '1' \
+        and users.domain_id = domains.domain_id}}
+  .ifdef VEXIM_LOCALPART_SUFFIX
+    local_part_suffix = VEXIM_LOCALPART_SUFFIX
+    local_part_suffix_optional
+  .endif
+  retry_use_local_part
+  pipe_transport = address_pipe
+
 virtual_domains:
   driver = redirect
   domains = +local_domains
@@ -67,7 +86,10 @@ virtual_domains:
   retry_use_local_part
   file_transport = virtual_delivery
   reply_transport = address_reply
-  pipe_transport = address_pipe
+  # Piped delivery is handled by the virtual_piped router, which checks that
+  # the user is on_piped and the domain allows pipe. Refuse pipes here so a
+  # stray "|command" in the smtp field can never be executed by this router.
+  forbid_pipe
 
 # A group is a list of users
 #