diff --git a/ansible/playbooks/create-rsync-unencrypted.yml b/ansible/playbooks/create-rsync-unencrypted.yml
index 7858f7335..6e3bba200 100644
--- a/ansible/playbooks/create-rsync-unencrypted.yml
+++ b/ansible/playbooks/create-rsync-unencrypted.yml
@@ -12,3 +12,4 @@
     - package-upgrade
     - baselayout
     - { role: nginx, sites: [ 'nodejs.org','unencrypted' ] }
+    - { role: certbot, certbot_domains: ['unencrypted.nodejs.org'], tags: certbot }
diff --git a/ansible/playbooks/create-webhost.yml b/ansible/playbooks/create-webhost.yml
index e8ce85940..2cb49590a 100644
--- a/ansible/playbooks/create-webhost.yml
+++ b/ansible/playbooks/create-webhost.yml
@@ -14,6 +14,7 @@
     - package-upgrade
     - baselayout
     - { role: nginx, sites: [ 'nodejs.org', 'iojs.org', 'dist.libuv.org' ] }
+    - { role: certbot, certbot_domains: ['direct.nodejs.org'], tags: certbot }
 
   pre_tasks:
     - name: check if secrets are properly set
diff --git a/ansible/playbooks/jenkins/host/create.yml b/ansible/playbooks/jenkins/host/create.yml
index 222ef9253..980d1f453 100644
--- a/ansible/playbooks/jenkins/host/create.yml
+++ b/ansible/playbooks/jenkins/host/create.yml
@@ -18,8 +18,10 @@
 
 - hosts: infra-digitalocean-ubuntu2204-x64-1 # ci.nodejs.org
   roles:
-  - { role: jenkins-nginx, jenkins_nginx_fqdn: 'ci.nodejs.org', jenkins_nginx_status_page: true }
+  - { role: jenkins-nginx, jenkins_nginx_fqdn: 'ci.nodejs.org', jenkins_nginx_status_page: true, tags: jenkins-nginx }
+  - { role: certbot, certbot_domains: ['ci.nodejs.org'], tags: certbot }
 
 - hosts: infra-ibm-ubuntu2404-x64-1 # ci-release.nodejs.org
   roles:
-  - { role: jenkins-nginx, jenkins_nginx_fqdn: 'ci-release.nodejs.org' }
+  - { role: jenkins-nginx, jenkins_nginx_fqdn: 'ci-release.nodejs.org', tags: jenkins-nginx }
+  - { role: certbot, certbot_domains: ['ci-release.nodejs.org'], tags: certbot }
diff --git a/ansible/roles/certbot/defaults/main.yml b/ansible/roles/certbot/defaults/main.yml
new file mode 100644
index 000000000..475de41cf
--- /dev/null
+++ b/ansible/roles/certbot/defaults/main.yml
@@ -0,0 +1,10 @@
+---
+
+certbot_email: build@iojs.org
+
+# Hostnames for one certificate; the first is also the certificate name.
+# Each must resolve straight to this host on port 80, and the nginx vhost
+# answering on port 80 must serve /.well-known/acme-challenge/ from
+# certbot_webroot.
+certbot_domains: []
+certbot_webroot: /var/www/letsencrypt
diff --git a/ansible/roles/certbot/files/reload-nginx.sh b/ansible/roles/certbot/files/reload-nginx.sh
new file mode 100644
index 000000000..05e53077f
--- /dev/null
+++ b/ansible/roles/certbot/files/reload-nginx.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+systemctl reload nginx
diff --git a/ansible/roles/certbot/tasks/main.yml b/ansible/roles/certbot/tasks/main.yml
new file mode 100644
index 000000000..a02116e00
--- /dev/null
+++ b/ansible/roles/certbot/tasks/main.yml
@@ -0,0 +1,58 @@
+---
+
+#
+# issues and auto-renews a Let's Encrypt certificate using the HTTP-01
+# challenge, answered by nginx from a webroot. Renewal runs from the
+# distro-packaged certbot.timer.
+#
+# expects:
+#   certbot_domains: list of hostnames on the certificate. The first is
+#     used as the certificate name. See defaults for the requirements.
+#   certbot_email: contact address passed to --email.
+#
+# The first run requests the certificate; later runs leave renewal to
+# certbot.timer.
+#
+
+- name: certbot | install certbot
+  package:
+    name: certbot
+    state: present
+
+- name: certbot | create the acme challenge webroot
+  file:
+    path: "{{ certbot_webroot }}"
+    state: directory
+    mode: 0755
+
+- name: certbot | ensure renewal deploy hook directory
+  file:
+    path: /etc/letsencrypt/renewal-hooks/deploy
+    state: directory
+    mode: 0755
+
+- name: certbot | install nginx reload deploy hook
+  copy:
+    src: reload-nginx.sh
+    dest: /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
+    mode: 0755
+
+- name: certbot | request certificate
+  command:
+    cmd: >-
+      certbot certonly
+      --webroot
+      --webroot-path {{ certbot_webroot }}
+      --cert-name {{ certbot_domains[0] }}
+      -d {{ certbot_domains | join(' -d ') }}
+      --email {{ certbot_email }}
+      --agree-tos
+      --non-interactive
+  args:
+    creates: "/etc/letsencrypt/live/{{ certbot_domains[0] }}/fullchain.pem"
+
+- name: certbot | enable and start renewal timer
+  service:
+    name: certbot.timer
+    state: started
+    enabled: yes
diff --git a/ansible/roles/jenkins-nginx/handlers/main.yml b/ansible/roles/jenkins-nginx/handlers/main.yml
new file mode 100644
index 000000000..edde81c50
--- /dev/null
+++ b/ansible/roles/jenkins-nginx/handlers/main.yml
@@ -0,0 +1,6 @@
+---
+
+- name: reload nginx
+  service:
+    name: nginx
+    state: reloaded
diff --git a/ansible/roles/jenkins-nginx/tasks/main.yml b/ansible/roles/jenkins-nginx/tasks/main.yml
index f65840101..7755bfd4a 100644
--- a/ansible/roles/jenkins-nginx/tasks/main.yml
+++ b/ansible/roles/jenkins-nginx/tasks/main.yml
@@ -41,6 +41,7 @@
     src: "{{ jenkins_nginx_fqdn }}.conf.j2"
     dest: /etc/nginx/sites-available/jenkins-iojs
     mode: 0644
+  notify: reload nginx
 
 - name: jenkins-nginx | symlink site into sites-enabled
   file:
diff --git a/ansible/roles/jenkins-nginx/templates/ci-release.nodejs.org.conf.j2 b/ansible/roles/jenkins-nginx/templates/ci-release.nodejs.org.conf.j2
index 32d4a2e3e..599ca2fca 100644
--- a/ansible/roles/jenkins-nginx/templates/ci-release.nodejs.org.conf.j2
+++ b/ansible/roles/jenkins-nginx/templates/ci-release.nodejs.org.conf.j2
@@ -1,15 +1,23 @@
 server {
     listen 80;
     server_name {{ jenkins_nginx_fqdn }};
-    return 301 https://{{ jenkins_nginx_fqdn }}$request_uri;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+        default_type text/plain;
+    }
+
+    location / {
+        return 301 https://{{ jenkins_nginx_fqdn }}$request_uri;
+    }
 }
 
 server {
     listen 443 default_server ssl http2;
     server_name {{ jenkins_nginx_fqdn }};
 
-    ssl_certificate     ssl/nodejs_chained.crt;
-    ssl_certificate_key ssl/nodejs.key;
+    ssl_certificate     /etc/letsencrypt/live/{{ jenkins_nginx_fqdn }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ jenkins_nginx_fqdn }}/privkey.pem;
 
     ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
     ssl_prefer_server_ciphers on;
@@ -18,9 +26,6 @@ server {
     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
     ssl_session_cache shared:SSL:50m;
 
-    ssl_stapling on;
-    ssl_stapling_verify on;
-    ssl_trusted_certificate ssl/nodejs_chained.crt;
     resolver 8.8.4.4 8.8.8.8 valid=300s;
     resolver_timeout 10s;
 
diff --git a/ansible/roles/jenkins-nginx/templates/ci.nodejs.org.conf.j2 b/ansible/roles/jenkins-nginx/templates/ci.nodejs.org.conf.j2
index 79313406a..9930aa207 100644
--- a/ansible/roles/jenkins-nginx/templates/ci.nodejs.org.conf.j2
+++ b/ansible/roles/jenkins-nginx/templates/ci.nodejs.org.conf.j2
@@ -23,6 +23,11 @@ server {
       autoindex on;
     }
 
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+        default_type text/plain;
+    }
+
     location / {
         rewrite ^ https://{{ jenkins_nginx_fqdn }}$request_uri permanent;
     }
@@ -34,8 +39,8 @@ server {
     listen 443 default_server ssl spdy;
     server_name {{ jenkins_nginx_fqdn }};
 
-    ssl_certificate     ssl/nodejs_chained.crt;
-    ssl_certificate_key ssl/nodejs.key;
+    ssl_certificate     /etc/letsencrypt/live/{{ jenkins_nginx_fqdn }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ jenkins_nginx_fqdn }}/privkey.pem;
 
     ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
     ssl_prefer_server_ciphers on;
@@ -44,9 +49,6 @@ server {
     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
     ssl_session_cache shared:SSL:50m;
 
-    ssl_stapling on;
-    ssl_stapling_verify on;
-    ssl_trusted_certificate ssl/nodejs_chained.crt;
     resolver 8.8.4.4 8.8.8.8 valid=300s;
     resolver_timeout 10s;
 
diff --git a/ansible/roles/nginx/handlers/main.yml b/ansible/roles/nginx/handlers/main.yml
new file mode 100644
index 000000000..edde81c50
--- /dev/null
+++ b/ansible/roles/nginx/handlers/main.yml
@@ -0,0 +1,6 @@
+---
+
+- name: reload nginx
+  service:
+    name: nginx
+    state: reloaded
diff --git a/ansible/roles/nginx/tasks/main.yml b/ansible/roles/nginx/tasks/main.yml
index e718fc02e..fdcad263c 100644
--- a/ansible/roles/nginx/tasks/main.yml
+++ b/ansible/roles/nginx/tasks/main.yml
@@ -20,6 +20,8 @@
   loop_control:
     loop_var: site
   with_items: "{{ sites }}"
+  notify: reload nginx
+  tags: nginx-sites
 
 - name: symlink sites to `sites-enabled`
   file:
@@ -29,6 +31,7 @@
   loop_control:
     loop_var: site
   with_indexed_items: "{{ sites }}"
+  tags: nginx-sites
 
 - name: remove default site
   file:
diff --git a/ansible/roles/nginx/templates/nodejs.org.conf.j2 b/ansible/roles/nginx/templates/nodejs.org.conf.j2
index a7d8cce17..a147a357c 100644
--- a/ansible/roles/nginx/templates/nodejs.org.conf.j2
+++ b/ansible/roles/nginx/templates/nodejs.org.conf.j2
@@ -37,6 +37,12 @@ server {
 
     error_page 404 /404.html;
 
+    # Let's Encrypt HTTP-01 validation, served from the certbot webroot
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+        default_type text/plain;
+    }
+
     # For the unencrypted Node.js server, we redirect any request to the HTTPS site
     # Unless it is within /dist or is for a JSON file
     location ~ ^/(?!(dist/|dist$|\.json$)) {
diff --git a/ansible/roles/nginx/templates/unencrypted.conf.j2 b/ansible/roles/nginx/templates/unencrypted.conf.j2
index 36ebd0ab5..b2d678f2f 100644
--- a/ansible/roles/nginx/templates/unencrypted.conf.j2
+++ b/ansible/roles/nginx/templates/unencrypted.conf.j2
@@ -7,6 +7,11 @@ server {
 
     root /home/dist/www;
 
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+        default_type text/plain;
+    }
+
     location /download {
         alias /home/dist/$dist_path;
         autoindex on;