diff --git a/terraform/modules/docker-network/templates/cloud-init-manager-node.yaml.tftpl b/terraform/modules/docker-network/templates/cloud-init-manager-node.yaml.tftpl
index 599cd5e..3721838 100644
--- a/terraform/modules/docker-network/templates/cloud-init-manager-node.yaml.tftpl
+++ b/terraform/modules/docker-network/templates/cloud-init-manager-node.yaml.tftpl
@@ -19,7 +19,7 @@ users:
       - ${github_public_ssh_key}
   - name: certsync
     groups: users
-    sudo: ALL=(ALL) NOPASSWD:/usr/bin/rsync
+    sudo: ALL=(ALL) NOPASSWD:/usr/bin/rsync,/usr/bin/chown
     ssh_authorized_keys:
       - ${certsync_public_ssh_key}
 package_update: true
diff --git a/terraform/modules/docker-network/templates/scripts/certsync.sh.tftpl b/terraform/modules/docker-network/templates/scripts/certsync.sh.tftpl
index 92429f1..9638880 100644
--- a/terraform/modules/docker-network/templates/scripts/certsync.sh.tftpl
+++ b/terraform/modules/docker-network/templates/scripts/certsync.sh.tftpl
@@ -1,8 +1,10 @@
 #!/bin/sh
 
-rsync -avzr /etc/letsencrypt /home/certsync/letsencrypt
+rsync -azr /etc/letsencrypt /home/certsync/letsencrypt
+chown -R certsync:certsync /home/certsync/letsencrypt
 %{for manager_node_ip in manager_nodes ~}
-su -c "rsync -avzr /home/certsync/letsencrypt certsync@${manager_node_ip}:/home/certsync/" - certsync
-su -c "ssh certsync@${manager_node_ip} sudo rsync -avzr /home/certsync/letsencrypt /etc/letsencrypt" - certsync
+su -c "rsync -azr /home/certsync/letsencrypt certsync@${manager_node_ip}:/home/certsync/" - certsync
+su -c "ssh certsync@${manager_node_ip} sudo rsync -azr /home/certsync/letsencrypt/. /etc/letsencrypt"
+su -c "ssh certsync@${manager_node_ip} sudo chown -R root:root /etc/letsencrypt" - certsync
 %{endfor ~}
 docker service update --force nginx_nginx-proxy