diff --git a/src/Lib/Ssl.hs b/src/Lib/Ssl.hs
index 0173af7..b7de3ed 100644
--- a/src/Lib/Ssl.hs
+++ b/src/Lib/Ssl.hs
@@ -51,6 +51,6 @@ renewSslCerts :: ReaderT RegistryCtx IO ()
 renewSslCerts = do
     domain      <- asks $ registryHostname . appSettings
     (cert, key) <- asks $ (sslCertLocation &&& sslKeyLocation) . appSettings
-    void . liftIO $ system [i|certbot renew|]
+    void . liftIO $ system [i|certbot renew --webroot|]
     void . liftIO $ system [i|cp /etc/letsencrypt/live/#{domain}/fullchain.pem #{cert}|]
     void . liftIO $ system [i|cp /etc/letsencrypt/live/#{domain}/privkey.pem #{key}|]