diff --git a/README.md b/README.md
index 4ba78e7..f1ef8d4 100644
--- a/README.md
+++ b/README.md
@@ -9,8 +9,9 @@ This repository also contains configuration files and installation scripts insid
 This generator allows to build images for both Arch Linux and Debian Testing, you can replace `<sysid>` by either `sn-arch` or `sn-debian` in the following examples. Note that mkosi may require tools that are not available on your distribution.
 
 First:
+- Put the ServNest source code inside `mkosi.extra/srv/servnest/core/`
+- Put a SFTPGo binary compiled as bundle in `mkosi.extra/usr/local/bin/sftpgo` (`mkosi.extra/root/sftpgo.sh` is provided for this purpose)
 - Put your SSH public key in `mkosi.extra/root/.ssh/authorized_keys`
-- Put a SFTPGo binary as `mkosi.extra/usr/local/bin/sftpgo`
 
 You can generate a new image in `/var/lib/machines/<sysid>` by running `mkosi --force --image <sysid> build` from this repository (`--force` erases an already existing image).
 
diff --git a/mkosi.extra/install/certbot-dns-challenge-hook.sh b/mkosi.extra/install/certbot-dns-challenge-hook.sh
new file mode 100644
index 0000000..525c467
--- /dev/null
+++ b/mkosi.extra/install/certbot-dns-challenge-hook.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+set -euo pipefail
+
+knotc zone-begin servnest.example.
+knotc zone-set servnest.example. _acme-challenge.ht.servnest.example. 60 IN TXT $CERTBOT_VALIDATION
+knotc zone-commit servnest.example.
diff --git a/mkosi.extra/install/certbot-dns-cleanup-hook.sh b/mkosi.extra/install/certbot-dns-cleanup-hook.sh
new file mode 100644
index 0000000..59d1a8e
--- /dev/null
+++ b/mkosi.extra/install/certbot-dns-cleanup-hook.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+set -euo pipefail
+
+knotc zone-begin servnest.example.
+knotc zone-unset servnest.example. _acme-challenge.ht.servnest.example. 60 IN TXT $CERTBOT_VALIDATION
+knotc zone-commit servnest.example.
diff --git a/mkosi.extra/srv/servnest/core b/mkosi.extra/srv/servnest/core
index 7330f3a..0496feb 160000
--- a/mkosi.extra/srv/servnest/core
+++ b/mkosi.extra/srv/servnest/core
@@ -1 +1 @@
-Subproject commit 7330f3a7699b107de2df8547cc42af93f6a93fc3
+Subproject commit 0496feb8fb7dd1c76449426ecdb3fc6f9ae8bcbf