diff --git a/scripts/cert_renew_hook.sh b/scripts/cert_renew_hook.sh
index 9ebd36f..381c2cf 100755
--- a/scripts/cert_renew_hook.sh
+++ b/scripts/cert_renew_hook.sh
@@ -3,4 +3,6 @@ set -euf -o pipefail
 
 cd "$(dirname "$(realpath "$0")")/../"
 
+install -m 400 -o 101 -g 101 "./data/.lego/certificates"/{sso.base23.de.crt,sso.base23.de.issuer.crt,sso.base23.de.key} "./data/nginx/certs"
+
 docker compose restart nginx