Setting qualify-domain on authenticated submission

I have a couple of users who want to inject outgoing email via authenticated submission.

In authenticators I have:

lookup_cram:
  driver = cram_md5
  public_name = CRAM-MD5
  server_secret = ${extract{auth_pass}{${lookup{$auth1}lsearch{/etc/exim/smtp_users}{$value}fail}}{$value}}
  server_set_id = ${extract{from}{${lookup{$auth1}lsearch{/etc/exim/smtp_users}{$value}fail}}{$auth1}}

smtp_users contains lines like:

bilbo	auth_pass=ringbearer from=bilbo.baggins

But it sets outgoing domain to mailhost.example.com, thus
[email protected] whereas what is wanted is [email protected]

I do not want to set "primary_hostname = example.com" as locally generated
emails should be from @mailhost.example.com

This should be easy - but I cannot work out how to do it.

Even better would be to be able to set the domain differently for users in
smtp_users, but that is not needed -- for now.

Thanks in advance for hints.

-- 
Alain Williams
Linux/GNU Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer.
+44 (0) 787 668 0256  https://www.phcomp.co.uk/
Parliament Hill Computers. Registration Information: https://www.phcomp.co.uk/Contact.html
#include <std_disclaimer.h>

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki