diff --git a/deploy/le-deploy-hook.sh b/deploy/le-deploy-hook.sh
new file mode 100755
index 0000000..36b6563
--- /dev/null
+++ b/deploy/le-deploy-hook.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Let's Encrypt deploy hook for echoIRCd.
+#
+# echoircd runs as an unprivileged user and can't read /etc/letsencrypt/live
+# (privkey.pem is root-only). This copies the renewed cert+key into the location
+# echoircd already reads (its tls/ dir), owned by that user, then restarts it.
+#
+# Runs in two ways:
+#   * manually, to install the cert the first time:   sudo deploy/le-deploy-hook.sh
+#   * automatically by certbot on renewal — symlink it into
+#     /etc/letsencrypt/renewal-hooks/deploy/ so `certbot renew` invokes it.
+# When certbot runs it, $RENEWED_LINEAGE names the cert that was renewed; we act
+# only for ours (and always, when run by hand with no such variable set).
+set -eu
+
+DOMAIN=irc.devtronic.pro
+SRC=/etc/letsencrypt/live/$DOMAIN
+DST=/home/debian/irc/ircd/echoIRCd/tls
+UNIT=echoircd-dev.service
+
+# skip other certs when certbot fires this for a renewal that isn't ours
+if [ -n "${RENEWED_LINEAGE:-}" ] && [ "$RENEWED_LINEAGE" != "$SRC" ]; then
+    exit 0
+fi
+
+# only restart if the cert actually changed (so an unrelated renewal is a no-op)
+changed=0
+cmp -s "$SRC/fullchain.pem" "$DST/cert.pem" || changed=1
+
+install -o debian -g debian -m 644 "$SRC/fullchain.pem" "$DST/cert.pem"
+install -o debian -g debian -m 640 "$SRC/privkey.pem"   "$DST/key.pem"
+
+if [ "$changed" = 1 ]; then
+    systemctl restart "$UNIT"
+    echo "echoircd: installed LE cert for $DOMAIN and restarted $UNIT"
+else
+    echo "echoircd: LE cert for $DOMAIN unchanged; nothing to do"
+fi