diff --git a/certbot/Dockerfile b/certbot/Dockerfile
index 545da18..71fad56 100644
--- a/certbot/Dockerfile
+++ b/certbot/Dockerfile
@@ -14,11 +14,17 @@ RUN set -eux; \
 RUN mkdir -p /service/temp \
  && chown -R $USER_NAME:$GROUP_NAME /service/temp
 
-# create and set permission for proxy mounts
+# create and set permission mounts
 RUN mkdir -p /service/html \
  && chown -R $USER_NAME:$GROUP_NAME /service/html \
  && mkdir -p /service/ssl \
- && chown -R $USER_NAME:$GROUP_NAME /service/ssl
+ && chown -R $USER_NAME:$GROUP_NAME /service/ssl \
+ && mkdir -p /service/letsencrypt/ssl \
+ && chown -R $USER_NAME:$GROUP_NAME /service/letsencrypt/ssl \
+ && mkdir -p /service/letsencrypt/work \
+ && chown -R $USER_NAME:$GROUP_NAME /service/letsencrypt/work \
+ && mkdir -p /service/letsencrypt/log \
+ && chown -R $USER_NAME:$GROUP_NAME /service/letsencrypt/log
 
 COPY ./files/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
diff --git a/certbot/files/entrypoint.sh b/certbot/files/entrypoint.sh
index 5506b6d..64251a2 100644
--- a/certbot/files/entrypoint.sh
+++ b/certbot/files/entrypoint.sh
@@ -4,7 +4,9 @@
 web_root_path="/service/html"
 cert_root_path="/service/ssl"
 temp_path="/service/temp"
-cert_bot_path="/etc/letsencrypt"
+cert_bot_ssl="/service/letsencrypt/ssl"
+cert_bot_work="/service/letsencrypt/work"
+cert_bot_log="/service/letsencrypt/log"
 server_retries=10
 log_file="" # leave empty for stdout
 
@@ -100,12 +102,12 @@ function copy_cert()
 {
     local domain=$1
     local cert_path="$cert_root_path/$domain"
-    if [[ -f "$cert_bot_path/live/$domain/privkey.pem" ]]; then
-        cp "$cert_bot_path/live/$domain/privkey.pem" "$cert_path/privkey.pem"
-        cp "$cert_bot_path/live/$domain/fullchain.pem" "$cert_path/fullchain.pem"
+    if [[ -f "$cert_bot_ssl/live/$domain/privkey.pem" ]]; then
+        cp "$cert_bot_ssl/live/$domain/privkey.pem" "$cert_path/privkey.pem"
+        cp "$cert_bot_ssl/live/$domain/fullchain.pem" "$cert_path/fullchain.pem"
         return 0
     else
-        log ERROR copy_cert "No key exists at "$cert_bot_path/live/$domain/privkey.pem" for [$domain]"
+        log ERROR copy_cert "No key exists at "$cert_bot_ssl/live/$domain/privkey.pem" for [$domain]"
         return 1
     fi
 }
@@ -145,7 +147,9 @@ function get_cert()
         fi
         log get_cert "Running certbot"
         certbot certonly \
-            --config-dir "$cert_bot_path" \
+            --config-dir "$cert_bot_ssl" \
+            --work-dir "$cert_bot_work" \
+            --logs-dir "$cert_bot_log" \
             --agree-tos \
             --domains "$domains" \
             --email "contact@${root_domain}" \
diff --git a/docker-compose.yml b/docker-compose.yml
index 4c6c492..8fac37f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -46,9 +46,9 @@ services:
       # /.well-known/acme-challenge/ volume (webroot)
       - proxy_certbot:/service/html:rw
       # certbot directories
-      - certbot_ssl:/etc/letsencrypt:rw
-      - certbot_work:/var/lib/letsencrypt:rw
-      - certbot_logs:/var/log/letsencrypt:rw
+      - certbot_ssl:/service/letsencrypt/ssl:rw
+      - certbot_work:/service/letsencrypt/work:rw
+      - certbot_logs:/service/letsencrypt/log:rw
 
   # TODO: put this in its own docker-compose
   # as the proxy does not require it