diff --git a/npm_install.py b/npm_install.py
index 38d8991..b035ee4 100644
--- a/npm_install.py
+++ b/npm_install.py
@@ -210,6 +210,43 @@ def sync_backup_nginx_conf():
             except Exception as e:
                 print(f"Warning: sync failed for {p} -> {target}: {e}")
 
+
+def _setup_certbot_venv(venv_dir: Path = Path("/opt/certbot")):
+    try:
+        apt_try_install([
+            "python3-venv", "python3-dev", "gcc", "libffi-dev", "libssl-dev",
+            "pkg-config", "build-essential"
+        ])
+    except Exception:
+        run(["apt-get", "update"], check=False)
+        run(["apt-get", "install", "-y",
+             "python3-venv","python3-dev","gcc","libffi-dev","libssl-dev",
+             "pkg-config","build-essential"], check=False)
+
+    venv_bin = venv_dir / "bin"
+    pip_path = venv_bin / "pip"
+    certbot_path = venv_bin / "certbot"
+
+    with step(f"Preparing Certbot venv at {venv_dir}"):
+        if not venv_dir.exists() or not pip_path.exists():
+            run(["python3", "-m", "venv", str(venv_dir)])
+
+        run([str(pip_path), "install", "-U", "pip", "setuptools", "wheel"])
+
+        run([str(pip_path), "install", "-U",
+             "cryptography", "cffi", "certbot", "tldextract"])
+
+        Path("/usr/local/bin").mkdir(parents=True, exist_ok=True)
+        target = Path("/usr/local/bin/certbot")
+        if target.exists() or target.is_symlink():
+            try: target.unlink()
+            except Exception: pass
+        target.symlink_to(certbot_path)
+
+        cb_ver = run_out([str(certbot_path), "--version"], check=False) or ""
+        pip_ver = run_out([str(pip_path), "--version"], check=False) or ""
+        print(f"Certbot: {cb_ver.strip()} | Pip: {pip_ver.strip()}")
+
 def ensure_nginx_symlink():
     from pathlib import Path
     target = Path("/etc/angie")
@@ -1147,6 +1184,7 @@ def main():
     install_node_and_yarn(args.nodejs_pkg)
     ensure_user_and_dirs()
     create_sudoers_for_npm()
+    _setup_certbot_venv()
 
     npm_app_version = deploy_npm_app(args.npm_version)