diff --git a/README.md b/README.md
index 4340167..29b99e1 100644
--- a/README.md
+++ b/README.md
@@ -309,6 +309,9 @@ and sign out at `https://<any-app>/_google-auth/logout`.
   `location /foo` prefix blocks will be shadowed by this plugin's catch-all
   regex location — use `location ^~ /foo` in your own snippets if you need
   them to win.
+- **dokku-letsencrypt HTTP-01 renewals** keep working: the catch-all skips
+  `/.well-known/acme-challenge/`, so the challenge location letsencrypt
+  writes during a renewal is served without a Google session.
 - **Non-browser clients** (curl, fetch without `Accept: text/html`) get a
   JSON `401` instead of a redirect chain.
 - **Websockets** work — upgrade headers are forwarded exactly like dokku's
diff --git a/functions b/functions
index a4956dd..bd620ae 100644
--- a/functions
+++ b/functions
@@ -461,8 +461,11 @@ EOF
 
   cat <<EOF
 
-# Everything else requires a Google session.
-location ~ ^/ {
+# Everything else requires a Google session. The negative lookahead leaves
+# /.well-known/acme-challenge to the plain prefix location dokku-letsencrypt
+# writes during HTTP-01 renewal; a regex catch-all would otherwise shadow
+# it and the challenge would get a 401.
+location ~ ^/(?!\.well-known/acme-challenge(/|$)) {
     auth_request ${GOOGLE_AUTH_ROUTE_PREFIX}/verify;
     auth_request_set \$google_auth_user \$upstream_http_x_auth_request_user;
     auth_request_set \$google_auth_email \$upstream_http_x_auth_request_email;
diff --git a/test/nginx-conf-test.sh b/test/nginx-conf-test.sh
index 75562be..3e966c6 100755
--- a/test/nginx-conf-test.sh
+++ b/test/nginx-conf-test.sh
@@ -53,6 +53,7 @@ fn-ga-generate-conf "$APP" >"$CONF" || fail "conf generation failed"
 
 grep -q 'proxy_pass http://myapp-5000;' "$CONF" || fail "conf should proxy to the app upstream"
 grep -q 'auth_request /_google-auth/verify;' "$CONF" || fail "conf should gate with auth_request"
+grep -qF 'location ~ ^/(?!\.well-known/acme-challenge(/|$)) {' "$CONF" || fail "catch-all should leave the letsencrypt challenge path alone"
 grep -q 'location ^~ /api/webhooks {' "$CONF" || fail "conf should contain prefix exclusion"
 grep -q 'location ~ ^/healthz$ {' "$CONF" || fail "conf should contain regex exclusion"
 grep -q 'error_page 401 = @google_auth_signin;' "$CONF" || fail "conf should redirect 401s to signin"