Certbot stores wildcard certs under the base domain (e.g., *.example.com → /etc/letsencrypt/live/example.com/), but the path helpers were using the raw wildcard domain. This caused deploy hooks to reference nonexistent paths, silently failing and leaving certs unrenewable.