diff --git a/scripts/21-le-deploy-hook.sh b/scripts/21-le-deploy-hook.sh
index 18c2abd..c6b4809 100644
--- a/scripts/21-le-deploy-hook.sh
+++ b/scripts/21-le-deploy-hook.sh
@@ -2,6 +2,16 @@
 set -euo pipefail
 source ./lib.sh
 
+install -d -m 0755 /etc/mailwolt
+cat >/etc/mailwolt/installer.env <<EOF
+UI_HOST=${UI_HOST}
+WEBMAIL_HOST=${WEBMAIL_HOST}
+MAIL_HOSTNAME=${MAIL_HOSTNAME}
+BASE_DOMAIN=${BASE_DOMAIN}
+LE_EMAIL=${LE_EMAIL:-admin@${BASE_DOMAIN}}
+APP_ENV=${APP_ENV:-production}
+EOF
+
 log "Let's Encrypt Deploy-Hooks und Wrapper anlegen …"
 
 # 1) Wrapper, den Certbot bei Issue/Renew aufruft
diff --git a/scripts/75-le-issue.sh b/scripts/75-le-issue.sh
index 37aae44..c506e12 100644
--- a/scripts/75-le-issue.sh
+++ b/scripts/75-le-issue.sh
@@ -52,11 +52,10 @@ issue() {
   # MX: Key wiederverwenden → stabiler TLSA-Hash (3 1 1)
   [[ "${host}" == "${MAIL_HOSTNAME}" ]] && EXTRA_ARGS+=(--reuse-key)
 
-  certbot certonly \
-    --agree-tos -m "${LE_MAIL}" --non-interactive \
-    --webroot -w "${ACME_WEBROOT}" -d "${host}" \
-    --deploy-hook /usr/local/sbin/mw-deploy.sh \
-    "${EXTRA_ARGS[@]}" "${CERTBOT_EXTRA[@]}" || true
+certbot certonly \
+  --agree-tos -m "${LE_MAIL}" --non-interactive \
+  --webroot -w "${ACME_WEBROOT}" -d "${host}" \
+  "${EXTRA_ARGS[@]}" "${CERTBOT_EXTRA[@]}" || true
 }
 
 # ------------------- Hauptlauf -------------------