diff --git a/board/common/overlay/etc/crontabs/root b/board/common/overlay/etc/crontabs/root
index b106e1c3a3..bf0d404956 100644
--- a/board/common/overlay/etc/crontabs/root
+++ b/board/common/overlay/etc/crontabs/root
@@ -1,2 +1,2 @@
 14 3 * * * /usr/sbin/logrotate /etc/logrotate.conf
-
+0 2 * * 0 /usr/sbin/dehydrated-wrapper
diff --git a/board/common/overlay/usr/sbin/dehydrated-wrapper b/board/common/overlay/usr/sbin/dehydrated-wrapper
new file mode 100755
index 0000000000..2d31c273af
--- /dev/null
+++ b/board/common/overlay/usr/sbin/dehydrated-wrapper
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+PROG="/usr/bin/dehydrated"
+BASE_DIR="/var/lib/dehydrated"
+TMP_DIR="/tmp/dehydrated"
+SSL_DIR="/data/etc/ssl"
+
+if ! [[ -x "${PROG}" && -r "${SSL_DIR}/domain" && -r "${SSL_DIR}/email" ]]; then
+    exit 0  # not installed or not configured
+fi
+
+mkdir -p "${BASE_DIR}"
+mkdir -p "${TMP_DIR}"
+
+logger -t dehydrated "checking for certificate renewal"
+dehydrated -c