diff --git a/deploy.sh b/deploy.sh
index 9ea1475..56a48bc 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -113,14 +113,23 @@ if [ "$GREENFIELD" = true ]; then
         echo "[INFO] .env deployed from backup"
     fi
 
-    # Copy certificates from backup vault to Zoraxy cert dir
+    # Copy certificates from backup vault or lego cache to Zoraxy cert dir
     for DOMAIN_SUB in app dns www; do
-        CERT_SRC="$BACKUP_DIR/certs/${DOMAIN_SUB}.${DOMAIN}/fullchain.pem"
-        KEY_SRC="$BACKUP_DIR/certs/${DOMAIN_SUB}.${DOMAIN}/privkey.pem"
+        FQDN="${DOMAIN_SUB}.${DOMAIN}"
+        CERT_SRC="$BACKUP_DIR/certs/${FQDN}/fullchain.pem"
+        KEY_SRC="$BACKUP_DIR/certs/${FQDN}/privkey.pem"
+        # Fallback to lego's SAN cert (named after first domain)
+        if [ ! -f "$CERT_SRC" ] && [ -d "$BACKUP_DIR/lego/certificates" ]; then
+            LECHO=$(ls "$BACKUP_DIR/lego/certificates/"*.crt 2>/dev/null | grep -v issuer | head -1)
+            if [ -n "$LECHO" ]; then
+                CERT_SRC="$LECHO"
+                KEY_SRC="${LECHO%.crt}.key"
+            fi
+        fi
         if [ -f "$CERT_SRC" ] && [ -f "$KEY_SRC" ]; then
-            cp "$CERT_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${DOMAIN_SUB}.${DOMAIN}.crt"
-            cp "$KEY_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${DOMAIN_SUB}.${DOMAIN}.key"
-            echo "[INFO] Cert deployed: ${DOMAIN_SUB}.${DOMAIN}"
+            cp "$CERT_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${FQDN}.crt"
+            cp "$KEY_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${FQDN}.key"
+            echo "[INFO] Cert deployed: ${FQDN}"
         fi
     done