diff --git a/board/common/overlay/etc/crontabs/root b/board/common/overlay/etc/crontabs/root
index 9572f6559f..b67d28d62d 100644
--- a/board/common/overlay/etc/crontabs/root
+++ b/board/common/overlay/etc/crontabs/root
@@ -1,3 +1,3 @@
 14 3 * * * /usr/sbin/logrotate /etc/logrotate.conf
-0 2 * * 0 /usr/sbin/dehydrated-wrapper
+0 2 * * 0 /usr/sbin/https-update
 */15 * * * * /usr/sbin/dyndns-update
diff --git a/board/common/overlay/usr/sbin/dehydrated-wrapper b/board/common/overlay/usr/sbin/dehydrated-wrapper
index 2d31c273af..531cc23772 100755
--- a/board/common/overlay/usr/sbin/dehydrated-wrapper
+++ b/board/common/overlay/usr/sbin/dehydrated-wrapper
@@ -13,4 +13,4 @@ mkdir -p "${BASE_DIR}"
 mkdir -p "${TMP_DIR}"
 
 logger -t dehydrated "checking for certificate renewal"
-dehydrated -c
+dehydrated "$@"
diff --git a/board/common/overlay/usr/sbin/https-update b/board/common/overlay/usr/sbin/https-update
new file mode 100755
index 0000000000..8c1ac1ddaf
--- /dev/null
+++ b/board/common/overlay/usr/sbin/https-update
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+PROG="/usr/sbin/dehydrated-wrapper"
+SSL_DIR="/data/etc/ssl"
+
+if ! [[ -d "${SSL_DIR}" ]]; then
+    exit 0
+fi
+
+logger -t dehydrated "updating SSL certificates"
+${PROG} -c 2>&1 | logger -t dehydrated
+exit ${PIPESTATUS[0]}