diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index 7958b21..73dfd8b 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -115,6 +115,19 @@ EOF
         --keep-until-expiring
 fi
 
+# `certonly` renews the files but tells nothing to pick them up, so without a
+# deploy hook nginx keeps serving the old certificate until something reloads it
+# by chance — i.e. it silently expires. `--nginx` would have done this for us;
+# this is the price of keeping the vhost in git.
+say "Installing the renewal hook"
+install -d /etc/letsencrypt/renewal-hooks/deploy
+cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'HOOK'
+#!/bin/sh
+# Installed by kadence's deploy/deploy.sh. Runs after any successful renewal.
+nginx -t && systemctl reload nginx
+HOOK
+chmod 755 /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
+
 say "Installing the vhost"
 install -m 644 "$VHOST_SRC" "$VHOST_DST"
 ln -sfn "$VHOST_DST" "/etc/nginx/sites-enabled/${DOMAIN}"