diff --git a/agent/src/Daemon/SslRenew.hs b/agent/src/Daemon/SslRenew.hs
index dedeb477b..ed47d4527 100644
--- a/agent/src/Daemon/SslRenew.hs
+++ b/agent/src/Daemon/SslRenew.hs
@@ -25,7 +25,7 @@ import           Constants
 renewSslLeafCert :: AgentCtx -> IO ()
 renewSslLeafCert ctx = do
     let base = appFilesystemBase . appSettings $ ctx
-    hn  <- injectFilesystemBase base getStart9AgentHostname
+    hn  <- (<> ".local") <$> injectFilesystemBase base getStart9AgentHostname
     tor <- injectFilesystemBase base getAgentHiddenServiceUrl
     putStr @Text "SSL Renewal Required? "
     needsRenew <- doesSslNeedRenew (toS $ entityCertPath hn `relativeTo` base)
diff --git a/agent/src/Lib/Synchronizers.hs b/agent/src/Lib/Synchronizers.hs
index 0a05ac4df..af72e9fb0 100644
--- a/agent/src/Lib/Synchronizers.hs
+++ b/agent/src/Lib/Synchronizers.hs
@@ -467,7 +467,7 @@ syncConvertEcdsaCerts = SyncOp "Convert Intermediate Cert to ECDSA P256" check m
 
 replaceDerivativeCerts :: (HasFilesystemBase sig m, Fused.Has (Error S9Error) sig m, MonadIO m) => m ()
 replaceDerivativeCerts = do
-    hn             <- getStart9AgentHostname
+    hn             <- (<> ".local") <$> getStart9AgentHostname
     tor            <- getAgentHiddenServiceUrl
 
     caKeyPath      <- toS <$> getAbsoluteLocationFor rootCaKeyPath