diff --git a/src/batou_ext/resources/cert.sh b/src/batou_ext/resources/cert.sh
index 50d07da..f31aedd 100644
--- a/src/batou_ext/resources/cert.sh
+++ b/src/batou_ext/resources/cert.sh
@@ -17,6 +17,7 @@ source /etc/profile
     --preferred-chain "{{component.letsencrypt_alternative_chain}}" \
 {%- endif %}
     -c "$@"
+setfacl -Rm u:{{component.granted_user}}:rX {{component.workdir}}/"$@"
 {% if component.extracommand %}
 {{component.extracommand}}
 {% endif %}