diff --git a/serving/fleet-manager/acme/renew-loop.sh b/serving/fleet-manager/acme/renew-loop.sh
index ccf5134..ae2df53 100755
--- a/serving/fleet-manager/acme/renew-loop.sh
+++ b/serving/fleet-manager/acme/renew-loop.sh
@@ -26,6 +26,12 @@ STAGING=""
   echo "acme: using LE STAGING — certs are UNTRUSTED (dry run)"
 }
 
+# The goacme/lego image ships the binary at /lego (not on PATH); fall back to it
+# when we've overridden the entrypoint with the shell.
+LEGO=$(command -v lego 2>/dev/null || true)
+[ -z "$LEGO" ] && [ -x /lego ] && LEGO=/lego
+[ -z "$LEGO" ] && { echo "acme: FATAL lego binary not found (looked on PATH and /lego)"; exit 1; }
+
 while true; do
   # First pass issues; later passes renew when near expiry.
   if [ -f "/le/certificates/$DOMAIN.crt" ]; then
@@ -36,7 +42,7 @@ while true; do
   echo "acme: lego $* for $DOMAIN (Route 53 DNS-01)"
 
   # shellcheck disable=SC2086  # $STAGING is intentionally two words when set
-  if lego --accept-tos --email "$EMAIL" --dns route53 --domains "$DOMAIN" \
+  if "$LEGO" --accept-tos --email "$EMAIL" --dns route53 --domains "$DOMAIN" \
           --path /le $STAGING "$@"; then
     install -m 644 "/le/certificates/$DOMAIN.crt" /out/fullchain.pem
     install -m 600 "/le/certificates/$DOMAIN.key" /out/privkey.pem