diff --git a/agent/src/Daemon/SslRenew.hs b/agent/src/Daemon/SslRenew.hs
index a0b47c97a..dedeb477b 100644
--- a/agent/src/Daemon/SslRenew.hs
+++ b/agent/src/Daemon/SslRenew.hs
@@ -13,8 +13,8 @@ import           Lib.Ssl
 import           Daemon.ZeroConf                ( getStart9AgentHostname )
 import           Lib.Tor
 import           Control.Carrier.Lift
-import           System.Directory               ( renameDirectory
-                                                , removeDirectory
+import           System.Directory               ( removePathForcibly
+                                                , renameDirectory
                                                 )
 import           Lib.SystemCtl
 import qualified Lib.Notifications             as Notifications
@@ -66,7 +66,7 @@ renewSslLeafCert ctx = do
                     $ Notifications.emit (AppId "EmbassyOS") agentVersion
                     $ Notifications.CertRenewFailed (ExitFailure n) out err
         let sslDir = toS $ sslDirectory `relativeTo` base
-        liftIO $ removeDirectory sslDir
+        liftIO $ removePathForcibly sslDir
         liftIO $ renameDirectory sslDirTmp sslDir
         liftIO $ systemCtl RestartService "nginx" $> ()
 
diff --git a/agent/src/Lib/Synchronizers.hs b/agent/src/Lib/Synchronizers.hs
index a22469676..4f1a618e4 100644
--- a/agent/src/Lib/Synchronizers.hs
+++ b/agent/src/Lib/Synchronizers.hs
@@ -526,7 +526,7 @@ replaceDerivativeCerts = do
         ExitFailure n -> throwError $ OpenSslE "leaf" n out' err'
 
     sslDir <- toS <$> getAbsoluteLocationFor sslDirectory
-    liftIO $ removeDirectory sslDir
+    liftIO $ removePathForcibly sslDir
     liftIO $ renameDirectory sslDirTmp sslDir
     liftIO $ systemCtl RestartService "nginx" $> ()