diff --git a/deploy.sh b/deploy.sh
index b772d87..6e31390 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -294,6 +294,25 @@ EOF
             -H "X-CSRF-Token: ${CSRF}" -d "enable=true" > /dev/null
         echo "  [OK] LE auto-renew enabled"
 
+        # Upload existing certs to Zoraxy (so it registers them in sys.db)
+        echo "  Uploading certificates to Zoraxy..."
+        CERTS_DIR="$TARGET_DIR/config/zoraxy/conf/certs"
+        for FQDN in app.${DOMAIN} dns.${DOMAIN} www.${DOMAIN}; do
+            CRT_FILE="$CERTS_DIR/${FQDN}.crt"
+            KEY_FILE="$CERTS_DIR/${FQDN}.key"
+            if [ -f "$CRT_FILE" ] && [ -f "$KEY_FILE" ]; then
+                CSRF=$(fetch_csrf)
+                curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/cert/upload?ktype=pub&domain=${FQDN}" \
+                    -H "X-CSRF-Token: ${CSRF}" \
+                    --data-binary "@${CRT_FILE}" > /dev/null 2>&1 || true
+                CSRF=$(fetch_csrf)
+                curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/cert/upload?ktype=pri&domain=${FQDN}" \
+                    -H "X-CSRF-Token: ${CSRF}" \
+                    --data-binary "@${KEY_FILE}" > /dev/null 2>&1 || true
+                echo "    Uploaded cert for ${FQDN}"
+            fi
+        done
+
         # BoltDB Zoraxy Auth gateway
         SYS_DB="$TARGET_DIR/data/zoraxy/sys.db"
         if [ -f "$SYS_DB" ] && [ -f "$TOOL_BIN" ]; then