`certbot certonly` replaces the files on disk but signals nothing, so nginx would have gone on serving the old certificate until some unrelated reload happened — which is to say the cert would have quietly expired in January. `--nginx` installs this hook itself; keeping the vhost in git means we install it ourselves. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>