diff --git a/deploy.sh b/deploy.sh
index 56a48bc..20c8959 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -113,19 +113,11 @@ if [ "$GREENFIELD" = true ]; then
         echo "[INFO] .env deployed from backup"
     fi
 
-    # Copy certificates from backup vault or lego cache to Zoraxy cert dir
+    # Copy certificates from backup vault to Zoraxy cert dir
     for DOMAIN_SUB in app dns www; do
         FQDN="${DOMAIN_SUB}.${DOMAIN}"
         CERT_SRC="$BACKUP_DIR/certs/${FQDN}/fullchain.pem"
         KEY_SRC="$BACKUP_DIR/certs/${FQDN}/privkey.pem"
-        # Fallback to lego's SAN cert (named after first domain)
-        if [ ! -f "$CERT_SRC" ] && [ -d "$BACKUP_DIR/lego/certificates" ]; then
-            LECHO=$(ls "$BACKUP_DIR/lego/certificates/"*.crt 2>/dev/null | grep -v issuer | head -1)
-            if [ -n "$LECHO" ]; then
-                CERT_SRC="$LECHO"
-                KEY_SRC="${LECHO%.crt}.key"
-            fi
-        fi
         if [ -f "$CERT_SRC" ] && [ -f "$KEY_SRC" ]; then
             cp "$CERT_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${FQDN}.crt"
             cp "$KEY_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${FQDN}.key"
diff --git a/tools/nextwks-tool/main.go b/tools/nextwks-tool/main.go
index 3ff18f9..246b37a 100644
--- a/tools/nextwks-tool/main.go
+++ b/tools/nextwks-tool/main.go
@@ -97,7 +97,7 @@ func runCert(args []string) {
 	domainsStr := fs.String("domains", "", "Comma-separated domain list")
 	email := fs.String("email", "", "ACME email")
 	backupDir := fs.String("backup-dir", "/opt/backup/certs", "Backup directory for certs")
-	legoDir := fs.String("lego-dir", "/opt/backup/lego", "Lego working directory")
+	legoDir := fs.String("lego-dir", "/opt/backup/certs", "Lego working directory")
 	fs.Parse(args)
 
 	if *domainsStr == "" || *email == "" {