diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 9e69758bfed..df762654135 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -491,7 +491,9 @@ jobs:
       package: ${{ matrix.js-package }}
       # The platform test suite's default command drives a live network, so it
       # runs from the E2E jobs. Its unit tests need nothing and run here.
-      test-command: ${{ (matrix.js-package == 'dashmate' || contains(matrix.js-package, 'platform-test-suite')) && 'test:unit' || 'test' }}
+      # Dashmate also runs its integration tests here: they need Docker, which
+      # this runner has, but not a live network.
+      test-command: ${{ matrix.js-package == 'dashmate' && 'test:ci' || (contains(matrix.js-package, 'platform-test-suite') && 'test:unit' || 'test') }}
       direct-packages: ${{ needs.changes.outputs.js-packages-direct }}
 
   js-deps-versions:
diff --git a/.pnp.cjs b/.pnp.cjs
index 062aa0f7409..f2c82efb91a 100755
--- a/.pnp.cjs
+++ b/.pnp.cjs
@@ -9698,6 +9698,7 @@ const RAW_RUNTIME_STATE =
           ["oclif", "npm:4.0.3"],\
           ["pretty-bytes", "npm:5.6.0"],\
           ["pretty-ms", "npm:7.0.1"],\
+          ["proper-lockfile", "npm:4.1.2"],\
           ["public-ip", "npm:6.0.1"],\
           ["qs", "npm:6.15.0"],\
           ["rxjs", "npm:6.6.7"],\
@@ -9707,7 +9708,8 @@ const RAW_RUNTIME_STATE =
           ["systeminformation", "npm:5.31.1"],\
           ["table", "npm:6.8.1"],\
           ["tar", "npm:7.5.10"],\
-          ["wrap-ansi", "npm:7.0.0"]\
+          ["wrap-ansi", "npm:7.0.0"],\
+          ["write-file-atomic", "npm:5.0.1"]\
         ],\
         "linkType": "SOFT"\
       }]\
@@ -18295,6 +18297,16 @@ const RAW_RUNTIME_STATE =
           ["signal-exit", "npm:3.0.7"]\
         ],\
         "linkType": "HARD"\
+      }],\
+      ["npm:4.1.2", {\
+        "packageLocation": "./.yarn/cache/proper-lockfile-npm-4.1.2-a140a3c928-000a4875f5.zip/node_modules/proper-lockfile/",\
+        "packageDependencies": [\
+          ["graceful-fs", "npm:4.2.10"],\
+          ["proper-lockfile", "npm:4.1.2"],\
+          ["retry", "npm:0.12.0"],\
+          ["signal-exit", "npm:3.0.7"]\
+        ],\
+        "linkType": "HARD"\
       }]\
     ]],\
     ["protobufjs", [\
@@ -23536,6 +23548,15 @@ const RAW_RUNTIME_STATE =
           ["write-file-atomic", "npm:4.0.1"]\
         ],\
         "linkType": "HARD"\
+      }],\
+      ["npm:5.0.1", {\
+        "packageLocation": "./.yarn/cache/write-file-atomic-npm-5.0.1-52283db6ee-648efddba5.zip/node_modules/write-file-atomic/",\
+        "packageDependencies": [\
+          ["imurmurhash", "npm:0.1.4"],\
+          ["signal-exit", "npm:4.1.0"],\
+          ["write-file-atomic", "npm:5.0.1"]\
+        ],\
+        "linkType": "HARD"\
       }]\
     ]],\
     ["ws", [\
diff --git a/.yarn/cache/proper-lockfile-npm-4.1.2-a140a3c928-000a4875f5.zip b/.yarn/cache/proper-lockfile-npm-4.1.2-a140a3c928-000a4875f5.zip
new file mode 100644
index 00000000000..a7389ae2254
Binary files /dev/null and b/.yarn/cache/proper-lockfile-npm-4.1.2-a140a3c928-000a4875f5.zip differ
diff --git a/.yarn/cache/write-file-atomic-npm-5.0.1-52283db6ee-648efddba5.zip b/.yarn/cache/write-file-atomic-npm-5.0.1-52283db6ee-648efddba5.zip
new file mode 100644
index 00000000000..4b1680c8f31
Binary files /dev/null and b/.yarn/cache/write-file-atomic-npm-5.0.1-52283db6ee-648efddba5.zip differ
diff --git a/packages/dashmate/configs/defaults/getBaseConfigFactory.js b/packages/dashmate/configs/defaults/getBaseConfigFactory.js
index fbcbbc15dc7..7a2c866122f 100644
--- a/packages/dashmate/configs/defaults/getBaseConfigFactory.js
+++ b/packages/dashmate/configs/defaults/getBaseConfigFactory.js
@@ -6,6 +6,7 @@ import Config from '../../src/config/Config.js';
 import {
   NETWORK_MAINNET,
   PACKAGE_ROOT_DIR,
+  LETSENCRYPT_ACME_DIRECTORY_URL,
 } from '../../src/constants.js';
 
 const { version } = JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT_DIR, 'package.json'), 'utf8'));
@@ -255,6 +256,7 @@ export default function getBaseConfigFactory() {
               },
               letsencrypt: {
                 email: null,
+                acmeDirectoryUrl: LETSENCRYPT_ACME_DIRECTORY_URL,
               },
             },
           },
diff --git a/packages/dashmate/configs/getConfigFileMigrationsFactory.js b/packages/dashmate/configs/getConfigFileMigrationsFactory.js
index 23fe3f0fbaa..be7f3f340fa 100644
--- a/packages/dashmate/configs/getConfigFileMigrationsFactory.js
+++ b/packages/dashmate/configs/getConfigFileMigrationsFactory.js
@@ -1701,6 +1701,24 @@ export default function getConfigFileMigrationsFactory(homeDir, defaultConfigs)
 
         return configFile;
       },
+      '4.2.0': (configFile) => {
+        // The ACME directory certificates are requested from became
+        // configurable. Existing configs have no value for it, and the schema
+        // requires one, so fill in the directory they were already using.
+        Object.entries(configFile.configs)
+          .forEach(([, options]) => {
+            const providerConfigs = options.platform?.gateway?.ssl?.providerConfigs;
+
+            if (providerConfigs?.letsencrypt
+              && providerConfigs.letsencrypt.acmeDirectoryUrl === undefined) {
+              providerConfigs.letsencrypt.acmeDirectoryUrl = base.get(
+                'platform.gateway.ssl.providerConfigs.letsencrypt.acmeDirectoryUrl',
+              );
+            }
+          });
+
+        return configFile;
+      },
     };
   }
 
diff --git a/packages/dashmate/docs/config/gateway.md b/packages/dashmate/docs/config/gateway.md
index 7a5a3a92da5..90581e39d69 100644
--- a/packages/dashmate/docs/config/gateway.md
+++ b/packages/dashmate/docs/config/gateway.md
@@ -142,8 +142,27 @@ These settings control SSL/TLS for secure connections:
 | `platform.gateway.ssl.providerConfigs.zerossl.apiKey` | ZeroSSL API key | `null` | `"your-api-key"` |
 | `platform.gateway.ssl.providerConfigs.zerossl.id` | ZeroSSL certificate ID | `null` | `"certificate_id"` |
 
+### Let's Encrypt Provider Configuration
+
+| Option | Description | Default | Example |
+|--------|-------------|---------|---------|
+| `platform.gateway.ssl.providerConfigs.letsencrypt.email` | Contact address for expiry notices | `null` | `"admin@example.com"` |
+| `platform.gateway.ssl.providerConfigs.letsencrypt.acmeDirectoryUrl` | ACME directory certificates are requested from | `https://acme-v02.api.letsencrypt.org/directory` | `https://acme-staging-v02.api.letsencrypt.org/directory` |
+
+A node is identified by its external IP rather than a domain name, and Let's Encrypt
+issues IP address certificates only under its short-lived profile, so these
+certificates are valid for about six days and are renewed automatically by the
+Dashmate helper.
+
+Point `acmeDirectoryUrl` at the staging directory to rehearse issuance. Production
+allows only a few failed validations per hour, and the usual cause of failure —
+inbound port 80 being unreachable — takes several attempts to sort out. Certificates
+from staging are not publicly trusted, so set it back afterwards and obtain again
+with `dashmate ssl obtain --force`.
+
 Available SSL providers:
 - `zerossl`: Commercial certificate provider with automated issuance
+- `letsencrypt`: Free certificates issued over ACME; requires inbound port 80 during issuance and renewal
 - `selfSigned`: Self-signed certificates (not trusted by browsers)
 - `file`: Use existing certificate files (requires certificate and key files to be manually provided)
 
diff --git a/packages/dashmate/docs/config/index.md b/packages/dashmate/docs/config/index.md
index a81ac218c61..adbb6d0e5ac 100644
--- a/packages/dashmate/docs/config/index.md
+++ b/packages/dashmate/docs/config/index.md
@@ -179,3 +179,71 @@ dashmate config get <option>
 # Enable debug logging
 dashmate config set core.log.debug.enabled true
 ```
+
+## Running Dashmate commands concurrently
+
+Dashmate keeps all configuration in a single `config.json` inside its home directory
+(`~/.dashmate` by default).
+
+Commands that change a configuration option — `dashmate config set` and friends — read,
+change and save that file as one locked step. Two of them running at once cannot lose each
+other's work: if one sets a Core RPC port while another pins a Drive image, both settings
+survive. When no long-running operation owns the lock, a command waits only for the locked
+read and write.
+
+Read-only commands such as `dashmate config get`, `dashmate status` and `dashmate core cli`
+normally do not write configuration. The first command after an upgrade may migrate and save
+`config.json`; that migration needs the same lock and can time out behind a long-running
+configuration change.
+
+### While a node is being reconfigured
+
+`dashmate setup`, `dashmate reset`, `dashmate group reset`, `dashmate ssl obtain`,
+`dashmate core reindex` and `dashmate group core reindex` change or render configuration
+while doing long work, so they take the lock for their whole run. Another command that
+needs the lock waits briefly and then reports that something else is modifying it — nothing
+is lost, and running it again once the first command finishes works normally.
+
+The Dashmate helper uses the same whole-operation lock while renewing an SSL certificate.
+For ZeroSSL this includes HTTP validation and may take minutes. A configuration-changing
+command started during background renewal can therefore reach its 15-second timeout and
+report that another Dashmate command is modifying configuration. Retry it after renewal
+finishes. Keeping the lock for issuance is intentional: releasing it earlier would require
+replaying selected renewal fields later, which could undo an operator's provider switch or
+SSL disable.
+
+Ordinary reads remain available: `dashmate status`, `dashmate config get` and
+`dashmate core cli` do not take the lock unless loading the configuration discovers a
+migration that must be saved.
+
+Graceful termination releases the lock. After `SIGKILL` or a power loss, the next writer
+takes over after about a minute.
+
+### Recovering interrupted filesystem work
+
+`config.json` is the authoritative configuration. For normal configuration changes and
+certificate renewal, Dashmate saves it before writing the derived service files. If a
+command reports a service-file rendering error, or is killed after saving, those files can
+still describe the previous configuration. Repair the affected config explicitly:
+
+```bash
+dashmate config render --config=<name>
+```
+
+Removing a config also saves `config.json` before deleting its service directory. If the
+directory deletion fails, Dashmate leaves the orphan in place and will refuse to create a
+new config with that name. Inspect `~/.dashmate/<name>` for keys or other state that must be
+kept, then move or delete the directory manually before retrying `dashmate config create`.
+An absent name passed to `dashmate config remove` is rejected; it is not an orphan-cleanup
+command.
+
+If a command loses its lock before saving, Dashmate preserves the pending JSON in a private
+`~/.dashmate/.config.json.rescue-<id>` file and reports that path. Compare it with
+`config.json` and retain any needed values. Delete the rescue file manually only after its
+contents have been acknowledged; Dashmate does not remove rescue files automatically.
+
+The lock coordinates versions of Dashmate that implement this protocol. An older Dashmate
+process that does not use the lock can still write concurrently, so finish rolling out the
+new version before relying on this guarantee. The protocol is intended for a Dashmate home
+directory on a local filesystem; network filesystems may not provide the required lock and
+atomic-replacement semantics.
diff --git a/packages/dashmate/package.json b/packages/dashmate/package.json
index 6ed77abc9a8..70bc26f3b7a 100644
--- a/packages/dashmate/package.json
+++ b/packages/dashmate/package.json
@@ -7,8 +7,10 @@
     "postpack": "rm -f oclif.manifest.json",
     "prepack": "oclif manifest && oclif readme",
     "version": "oclif readme && git add README.md",
-    "test": "yarn run test:unit && yarn run test:e2e",
+    "test": "yarn run test:unit && yarn run test:integration && yarn run test:e2e",
     "test:unit": "mocha --recursive test/unit",
+    "test:integration": "mocha --recursive test/integration",
+    "test:ci": "yarn run test:unit && yarn run test:integration",
     "test:e2e": "mocha --recursive test/e2e",
     "helper": "node scripts/helper.js"
   },
@@ -87,6 +89,7 @@
     "node-graceful": "^3.0.1",
     "pretty-bytes": "^5.3.0",
     "pretty-ms": "^7.0.0",
+    "proper-lockfile": "^4.1.2",
     "public-ip": "^6.0.1",
     "qs": "^6.14.2",
     "rxjs": "^6.6.7",
@@ -94,7 +97,8 @@
     "systeminformation": "^5.31.1",
     "table": "^6.8.1",
     "tar": "7.5.10",
-    "wrap-ansi": "^7.0.0"
+    "wrap-ansi": "^7.0.0",
+    "write-file-atomic": "^5.0.1"
   },
   "devDependencies": {
     "@babel/core": "^7.26.10",
diff --git a/packages/dashmate/scripts/helper.js b/packages/dashmate/scripts/helper.js
index 484a67558a8..6cdf09894a4 100644
--- a/packages/dashmate/scripts/helper.js
+++ b/packages/dashmate/scripts/helper.js
@@ -2,6 +2,8 @@ import dotenv from 'dotenv';
 import { asValue } from 'awilix';
 import graceful from 'node-graceful';
 import createDIContainer from '../src/createDIContainer.js';
+import scheduleRenewCertificate from '../src/helper/scheduleRenewCertificate.js';
+import watchCertificateConfig from '../src/helper/watchCertificateConfig.js';
 
 // The ephemeral containers SSL providers bind to port 80 during issuance.
 // Either can be left orphaned if a previous helper run crashed mid-renewal.
@@ -90,16 +92,10 @@ async function removeOrphanedSslContainers(docker) {
    */
   const writeConfigTemplates = container.resolve('writeConfigTemplates');
 
-  const configFile = await configFileRepository.read();
-
-  // Persist config if it was migrated
-  if (configFile.isChanged()) {
-    await configFileRepository.write(configFile);
-
-    configFile.getAllConfigs()
-      .filter((config) => config.isChanged())
-      .forEach(writeConfigTemplates);
-  }
+  const { configFile } = configFileRepository.readAndMigrate(
+    {},
+    (migratedConfigs) => migratedConfigs.forEach(writeConfigTemplates),
+  );
 
   const config = configFile.getConfig(configName);
 
@@ -119,17 +115,35 @@ async function removeOrphanedSslContainers(docker) {
     await removeOrphanedSslContainers(docker);
   }
 
-  if (isEnabled && provider === 'zerossl') {
-    const scheduleRenewZeroSslCertificate = container.resolve('scheduleRenewZeroSslCertificate');
-    await scheduleRenewZeroSslCertificate(config);
-  } else if (isEnabled && provider === 'letsencrypt') {
-    const scheduleRenewLetsEncryptCertificate = container.resolve('scheduleRenewLetsEncryptCertificate');
-    await scheduleRenewLetsEncryptCertificate(config);
-  } else {
-    // prevent infinite restarts
-    setInterval(() => {
-    }, 60 * 1000);
-  }
+  const scheduleRenewZeroSslCertificate = container.resolve('scheduleRenewZeroSslCertificate');
+  const scheduleRenewLetsEncryptCertificate = container.resolve('scheduleRenewLetsEncryptCertificate');
+  const watchInactiveConfig = (inactiveConfig, onActivated) => watchCertificateConfig(
+    inactiveConfig,
+    null,
+    configFileRepository,
+    async (currentConfig) => {
+      if (!currentConfig) {
+        return false;
+      }
+
+      return onActivated(currentConfig);
+    },
+    (e) => {
+      // eslint-disable-next-line no-console
+      console.error(`Failed to check configuration for certificate renewal: ${e.message}`);
+    },
+  );
+  await scheduleRenewCertificate(
+    config,
+    scheduleRenewZeroSslCertificate,
+    scheduleRenewLetsEncryptCertificate,
+    watchInactiveConfig,
+  );
+
+  // Keep the helper alive when renewal is disabled, the config is removed, or
+  // a provider change stops the only scheduled job.
+  setInterval(() => {
+  }, 60 * 1000);
 
   if (config.get('dashmate.helper.api.enable')) {
     const createHttpApiServer = container.resolve('createHttpApiServer');
diff --git a/packages/dashmate/src/commands/config/create.js b/packages/dashmate/src/commands/config/create.js
index c567251949e..bf2f32aa0c7 100644
--- a/packages/dashmate/src/commands/config/create.js
+++ b/packages/dashmate/src/commands/config/create.js
@@ -1,5 +1,11 @@
+import fs from 'fs';
 import { Args } from '@oclif/core';
 import BaseCommand from '../../oclif/command/BaseCommand.js';
+import resolveConfigDirectory, {
+  assertConfigNameAvailable,
+  getPortableConfigName,
+} from '../../config/resolve-config-directory.js';
+import ConfigAlreadyPresentError from '../../config/errors/ConfigAlreadyPresentError.js';
 
 export default class ConfigCreateCommand extends BaseCommand {
   static description = 'Create new config';
@@ -22,6 +28,9 @@ export default class ConfigCreateCommand extends BaseCommand {
    * @param {Object} args
    * @param {Object} flags
    * @param {ConfigFile} configFile
+   * @param {ConfigFileJsonRepository} configFileRepository
+   * @param {writeConfigTemplates} writeConfigTemplates
+   * @param {HomeDir} homeDir
    * @return {Promise<void>}
    */
   async runWithDependencies(
@@ -31,8 +40,39 @@ export default class ConfigCreateCommand extends BaseCommand {
     },
     flags,
     configFile,
+    configFileRepository,
+    writeConfigTemplates,
+    homeDir,
   ) {
-    configFile.createConfig(configName, fromConfigName);
+    assertConfigNameAvailable(configName);
+
+    const serviceConfigsPath = resolveConfigDirectory(homeDir, configName);
+
+    // Read, change and save in one locked step, so a config created here cannot
+    // revert a change another command saved in the meantime.
+    configFileRepository.update((updatedConfigFile) => {
+      const portableConfigName = getPortableConfigName(configName);
+      const hasPortableNameCollision = updatedConfigFile.getAllConfigs()
+        .some((existingConfig) => getPortableConfigName(existingConfig.getName())
+          === portableConfigName);
+
+      if (hasPortableNameCollision) {
+        throw new ConfigAlreadyPresentError(configName);
+      }
+
+      // A directory without a matching config belongs to an interrupted create
+      // or remove and may contain private files that a new node must not adopt.
+      if (!updatedConfigFile.isConfigExists(configName) && fs.existsSync(serviceConfigsPath)) {
+        throw new Error(`Service files for '${configName}' already exist without a config.`
+          + ` Inspect '${serviceConfigsPath}' and move or delete it manually, then retry.`);
+      }
+
+      updatedConfigFile.createConfig(configName, fromConfigName);
+    }, {
+      // Keep the lock through rendering so another writer cannot save and
+      // render newer state in between this save and its service files.
+      onSaved: (freshConfigFile) => writeConfigTemplates(freshConfigFile.getConfig(configName)),
+    });
 
     // eslint-disable-next-line no-console
     console.log(`${configName} created`);
diff --git a/packages/dashmate/src/commands/config/default.js b/packages/dashmate/src/commands/config/default.js
index 91a67d25a33..d4ba6110c8f 100644
--- a/packages/dashmate/src/commands/config/default.js
+++ b/packages/dashmate/src/commands/config/default.js
@@ -30,12 +30,17 @@ Shows default config name or sets another config as default
     },
     flags,
     configFile,
+    configFileRepository,
   ) {
     if (configName === null) {
       // eslint-disable-next-line no-console
       console.log(configFile.getDefaultConfigName());
     } else {
-      configFile.setDefaultConfigName(configName);
+      // Read, change and save in one locked step, so pointing the default at a
+      // config cannot revert a change another command saved in the meantime.
+      configFileRepository.update((freshConfigFile) => {
+        freshConfigFile.setDefaultConfigName(configName);
+      });
 
       // eslint-disable-next-line no-console
       console.log(`${configName} config set as default`);
diff --git a/packages/dashmate/src/commands/config/remove.js b/packages/dashmate/src/commands/config/remove.js
index 99d58730002..836f8c8d2fe 100644
--- a/packages/dashmate/src/commands/config/remove.js
+++ b/packages/dashmate/src/commands/config/remove.js
@@ -1,7 +1,10 @@
 import fs from 'fs';
 import { Args } from '@oclif/core';
 import BaseCommand from '../../oclif/command/BaseCommand.js';
-import resolveConfigDirectory from '../../config/resolve-config-directory.js';
+import resolveConfigDirectory, {
+  getPortableConfigName,
+  isConfigNameAvailable,
+} from '../../config/resolve-config-directory.js';
 
 export default class ConfigRemoveCommand extends BaseCommand {
   static description = 'Remove config';
@@ -32,6 +35,7 @@ export default class ConfigRemoveCommand extends BaseCommand {
     configFile,
     defaultConfigs,
     homeDir,
+    configFileRepository,
   ) {
     if (defaultConfigs.has(configName)) {
       throw new Error(`system config ${configName} can't be removed.\nPlease use 'dashmate reset --hard --config=${configName}' command to reset the configuration`);
@@ -39,11 +43,22 @@ export default class ConfigRemoveCommand extends BaseCommand {
 
     const serviceConfigsPath = resolveConfigDirectory(homeDir, configName);
 
-    configFile.removeConfig(configName);
+    configFileRepository.update((freshConfigFile) => {
+      freshConfigFile.removeConfig(configName);
+    }, {
+      onSaved: (freshConfigFile) => {
+        // Old config files may contain names that are now reserved. Their JSON
+        // entries remain removable, but their paths are never deletion targets.
+        // They may also contain names that alias on portable filesystems. Keep
+        // a shared directory while any exact JSON entry can still refer to it.
+        const portableConfigName = getPortableConfigName(configName);
+        const isDirectoryStillReferenced = freshConfigFile.getAllConfigs()
+          .some((config) => getPortableConfigName(config.getName()) === portableConfigName);
 
-    fs.rmSync(serviceConfigsPath, {
-      recursive: true,
-      force: true,
+        if (isConfigNameAvailable(configName) && !isDirectoryStillReferenced) {
+          fs.rmSync(serviceConfigsPath, { recursive: true, force: true });
+        }
+      },
     });
 
     // eslint-disable-next-line no-console
diff --git a/packages/dashmate/src/commands/config/render.js b/packages/dashmate/src/commands/config/render.js
index 0e9c58ae0bb..3a4536366e9 100644
--- a/packages/dashmate/src/commands/config/render.js
+++ b/packages/dashmate/src/commands/config/render.js
@@ -3,6 +3,10 @@ import { OUTPUT_FORMATS } from '../../constants.js';
 import ConfigBaseCommand from '../../oclif/command/ConfigBaseCommand.js';
 
 export default class ConfigRenderCommand extends ConfigBaseCommand {
+  // Rendering replaces the service configuration files, so serialize it with
+  // commands that save and render config.json.
+  static mutatesConfig = true;
+
   static description = `Render config's service configs
 
 Force dashmate to render all config's service configs
diff --git a/packages/dashmate/src/commands/config/set.js b/packages/dashmate/src/commands/config/set.js
index 4f6e27992ce..4887542343d 100644
--- a/packages/dashmate/src/commands/config/set.js
+++ b/packages/dashmate/src/commands/config/set.js
@@ -39,6 +39,8 @@ Sets a configuration option in the default config
     },
     flags,
     config,
+    configFileRepository,
+    writeConfigTemplates,
   ) {
     // Validate the path against the schema, not against the currently-set
     // value. `config.get(...)` would throw `InvalidOptionPathError` for any
@@ -59,7 +61,20 @@ Sets a configuration option in the default config
       value = optionValue;
     }
 
-    config.set(optionPath, value);
+    // Read, change and save in one locked step, against the config name resolved
+    // for this command rather than re-resolving the default, which another
+    // process may have changed. Mutating the copy loaded at startup and saving it
+    // on exit would write a snapshot that is already out of date, reverting
+    // anything saved in between.
+    const configName = config.getName();
+
+    configFileRepository.update((freshConfigFile) => {
+      freshConfigFile.getConfig(configName).set(optionPath, value);
+    }, {
+      // Rendered after saving and inside the lock, so two commands changing the
+      // same config cannot save in one order and render in the other.
+      onSaved: (freshConfigFile) => writeConfigTemplates(freshConfigFile.getConfig(configName)),
+    });
 
     // eslint-disable-next-line no-console
     console.log(`${optionPath} set to ${optionValue}`);
diff --git a/packages/dashmate/src/commands/core/reindex.js b/packages/dashmate/src/commands/core/reindex.js
index 4f71988194d..252100c9c63 100644
--- a/packages/dashmate/src/commands/core/reindex.js
+++ b/packages/dashmate/src/commands/core/reindex.js
@@ -5,6 +5,10 @@ import ConfigBaseCommand from '../../oclif/command/ConfigBaseCommand.js';
 import MuteOneLineError from '../../oclif/errors/MuteOneLineError.js';
 
 export default class ReindexCommand extends ConfigBaseCommand {
+  // Reindex temporarily replaces the Core service configuration, so other
+  // configuration renderers must wait until it restores the ordinary files.
+  static mutatesConfig = true;
+
   static description = 'Reindex Core data';
 
   static flags = {
diff --git a/packages/dashmate/src/commands/group/core/reindex.js b/packages/dashmate/src/commands/group/core/reindex.js
index 1664f88668f..dfc26af475a 100644
--- a/packages/dashmate/src/commands/group/core/reindex.js
+++ b/packages/dashmate/src/commands/group/core/reindex.js
@@ -5,6 +5,10 @@ import GroupBaseCommand from '../../../oclif/command/GroupBaseCommand.js';
 import MuteOneLineError from '../../../oclif/errors/MuteOneLineError.js';
 
 export default class GroupReindexCommand extends GroupBaseCommand {
+  // Reindex temporarily replaces each Core service configuration, so other
+  // configuration renderers must wait until it restores the ordinary files.
+  static mutatesConfig = true;
+
   static description = 'Reindex group Core data';
 
   static flags = {
diff --git a/packages/dashmate/src/commands/group/default.js b/packages/dashmate/src/commands/group/default.js
index 775ec88352a..141ea558e66 100644
--- a/packages/dashmate/src/commands/group/default.js
+++ b/packages/dashmate/src/commands/group/default.js
@@ -30,12 +30,17 @@ Shows default group name or sets another group as default
     },
     flags,
     configFile,
+    configFileRepository,
   ) {
     if (groupName === null) {
       // eslint-disable-next-line no-console
       console.log(configFile.getDefaultGroupName());
     } else {
-      configFile.setDefaultGroupName(groupName);
+      // Read, change and save in one locked step, so pointing the default at a
+      // group cannot revert a change another command saved in the meantime.
+      configFileRepository.update((freshConfigFile) => {
+        freshConfigFile.setDefaultGroupName(groupName);
+      });
 
       // eslint-disable-next-line no-console
       console.log(`${groupName} group set as default`);
diff --git a/packages/dashmate/src/commands/group/reset.js b/packages/dashmate/src/commands/group/reset.js
index 2f3128014a7..7a9dc373427 100644
--- a/packages/dashmate/src/commands/group/reset.js
+++ b/packages/dashmate/src/commands/group/reset.js
@@ -5,6 +5,23 @@ import MuteOneLineError from '../../oclif/errors/MuteOneLineError.js';
 import { PRESET_LOCAL } from '../../constants.js';
 
 export default class GroupResetCommand extends GroupBaseCommand {
+  // Reconfigures the node: changes configuration repeatedly while doing long,
+  // partly irreversible work, so it holds the config lock for its whole run.
+  static mutatesConfig = true;
+
+  // A total reset can repair configs whose old options no longer validate.
+  static shouldSkipConfigValidation({
+    force, hard, platform, group,
+  }) {
+    if (!force || !hard || platform) {
+      return false;
+    }
+
+    return ({ options, configFileData }) => (
+      options?.group === (group ?? configFileData.defaultGroupName)
+    );
+  }
+
   static description = 'Reset group nodes';
 
   static flags = {
diff --git a/packages/dashmate/src/commands/reset.js b/packages/dashmate/src/commands/reset.js
index 571b3b2ff31..8f459405bb2 100644
--- a/packages/dashmate/src/commands/reset.js
+++ b/packages/dashmate/src/commands/reset.js
@@ -5,6 +5,23 @@ import ConfigBaseCommand from '../oclif/command/ConfigBaseCommand.js';
 import MuteOneLineError from '../oclif/errors/MuteOneLineError.js';
 
 export default class ResetCommand extends ConfigBaseCommand {
+  // Reconfigures the node: changes configuration repeatedly while doing long,
+  // partly irreversible work, so it holds the config lock for its whole run.
+  static mutatesConfig = true;
+
+  // A total reset can repair a config whose old options no longer validate.
+  static shouldSkipConfigValidation({
+    force, hard, platform, config,
+  }) {
+    if (!force || !hard || platform) {
+      return false;
+    }
+
+    return ({ name, configFileData }) => (
+      name === (config ?? configFileData.defaultConfigName)
+    );
+  }
+
   static description = 'Reset node data';
 
   static flags = {
diff --git a/packages/dashmate/src/commands/setup.js b/packages/dashmate/src/commands/setup.js
index f3ca8217c83..bb79bf928bc 100644
--- a/packages/dashmate/src/commands/setup.js
+++ b/packages/dashmate/src/commands/setup.js
@@ -13,6 +13,10 @@ import {
 } from '../constants.js';
 
 export default class SetupCommand extends BaseCommand {
+  // Reconfigures the node: changes configuration repeatedly while doing long,
+  // partly irreversible work, so it holds the config lock for its whole run.
+  static mutatesConfig = true;
+
   static description = 'Set up a new Dash node';
 
   static args = {
diff --git a/packages/dashmate/src/commands/ssl/obtain.js b/packages/dashmate/src/commands/ssl/obtain.js
index 754b6d1e6bc..7fa2f37a309 100644
--- a/packages/dashmate/src/commands/ssl/obtain.js
+++ b/packages/dashmate/src/commands/ssl/obtain.js
@@ -7,6 +7,10 @@ import LegoCertificate from '../../ssl/letsencrypt/LegoCertificate.js';
 import { SSL_PROVIDERS } from '../../constants.js';
 
 export default class ObtainCommand extends ConfigBaseCommand {
+  // Reconfigures the node: changes configuration repeatedly while doing long,
+  // partly irreversible work, so it holds the config lock for its whole run.
+  static mutatesConfig = true;
+
   static description = `Obtain SSL certificate
 
 Create a new SSL certificate or download an already existing one using ZeroSSL or Let's Encrypt as provider
@@ -34,6 +38,8 @@ Certificate will be renewed if it is about to expire (see 'expiration-days' flag
    * @param {Config} config
    * @param {obtainZeroSSLCertificateTask} obtainZeroSSLCertificateTask
    * @param {obtainLetsEncryptCertificateTask} obtainLetsEncryptCertificateTask
+   * @param {ConfigFileJsonRepository} configFileRepository
+   * @param {ConfigFile} configFile
    * @return {Promise<void>}
    */
   async runWithDependencies(
@@ -48,6 +54,8 @@ Certificate will be renewed if it is about to expire (see 'expiration-days' flag
     config,
     obtainZeroSSLCertificateTask,
     obtainLetsEncryptCertificateTask,
+    configFileRepository,
+    configFile,
   ) {
     const provider = providerFlag || config.get('platform.gateway.ssl.provider');
 
@@ -68,11 +76,17 @@ Certificate will be renewed if it is about to expire (see 'expiration-days' flag
         + `Supported providers: ${SSL_PROVIDERS.ZEROSSL}, ${SSL_PROVIDERS.LETSENCRYPT}`);
     }
 
+    const taskOptions = provider === SSL_PROVIDERS.ZEROSSL
+      ? {
+        onCertificateCreated: () => configFileRepository.write(configFile),
+      }
+      : {};
+
     const tasks = new Listr(
       [
         {
           title: taskTitle,
-          task: () => task(config),
+          task: () => task(config, taskOptions),
         },
       ],
       {
diff --git a/packages/dashmate/src/config/Config.js b/packages/dashmate/src/config/Config.js
index 7e13e6e8a8b..8989865d31d 100644
--- a/packages/dashmate/src/config/Config.js
+++ b/packages/dashmate/src/config/Config.js
@@ -39,9 +39,15 @@ export default class Config {
     assertSafeConfigName(name);
 
     this.name = name;
-    this.changed = false;
 
     this.setOptions(options, skipValidation);
+
+    // Hydration is not a mutation. setOptions() marks the config changed because
+    // it is a genuine edit when called on an existing config, but a config that
+    // was just loaded has nothing unsaved. Callers that build a config which must
+    // reach disk - the default set for a new config file, createConfig() - mark it
+    // changed themselves.
+    this.changed = false;
   }
 
   /**
@@ -360,4 +366,4 @@ export default class Config {
 }
 
 Config.ajv = new Ajv({ coerceTypes: true });
-addFormats(Config.ajv, { mode: 'fast', formats: ['ipv4'] });
+addFormats(Config.ajv, { mode: 'fast', formats: ['ipv4', 'uri'] });
diff --git a/packages/dashmate/src/config/configFile/ConfigFileJsonRepository.js b/packages/dashmate/src/config/configFile/ConfigFileJsonRepository.js
index 528fedf3fd2..b3add6cef0d 100644
--- a/packages/dashmate/src/config/configFile/ConfigFileJsonRepository.js
+++ b/packages/dashmate/src/config/configFile/ConfigFileJsonRepository.js
@@ -1,6 +1,10 @@
 import fs from 'fs';
 import Ajv from 'ajv';
 import path from 'path';
+import { randomUUID } from 'crypto';
+import lockfile from 'proper-lockfile';
+import semver from 'semver';
+import writeFileAtomic from 'write-file-atomic';
 import Config from '../Config.js';
 import { PACKAGE_ROOT_DIR } from '../../constants.js';
 import ConfigFileNotFoundError from '../errors/ConfigFileNotFoundError.js';
@@ -8,22 +12,100 @@ import InvalidConfigFileFormatError from '../errors/InvalidConfigFileFormatError
 import configFileJsonSchema from './configFileJsonSchema.js';
 import ConfigFile from './ConfigFile.js';
 
+/**
+ * How long a lock may go un-refreshed before another process may break it.
+ *
+ * A command that reconfigures a node holds this across its whole run, and the
+ * refresh that keeps it alive cannot happen while the event loop is busy - so
+ * this has to comfortably outlast the longest synchronous stretch such a command
+ * has, or its live lock gets stolen and two processes write. The cost of the
+ * generous value is that a process killed while holding the lock blocks the next
+ * writer for this long.
+ */
+const LOCK_STALE_MS = 60000;
+
+/**
+ * How long to wait for someone else's lock before giving up.
+ *
+ * Deliberately much shorter than the stale threshold: waiting is synchronous, so
+ * signal handlers do not run meanwhile, and an operator is better served by a
+ * quick "something else is changing configuration" than by a long silent stall.
+ */
+const LOCK_ACQUIRE_TIMEOUT_MS = 15000;
+
+const LOCK_RETRY_INTERVAL_MS = 50;
+
+/**
+ * Block without spinning. The write path is synchronous, so there is no event
+ * loop to yield to here.
+ *
+ * @param {number} ms
+ */
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
 export default class ConfigFileJsonRepository {
+  /**
+   * Release function for a lock held across a whole command, or null when this
+   * process is not holding one.
+   *
+   * @type {function|null}
+   */
+  #heldRelease = null;
+
+  /**
+   * Number of matching acquire() calls for the current process-held lease.
+   *
+   * @type {number}
+   */
+  #leaseDepth = 0;
+
+  /**
+   * Set when the lock was lost while we believed we still held it. Continuing
+   * would mean writing without exclusivity, which is the lost update this exists
+   * to prevent, so the next save refuses instead.
+   *
+   * @type {boolean}
+   */
+  #compromised = false;
+
   /**
    * @param {migrateConfigFile} migrateConfigFile
    * @param {HomeDir} homeDir
+   * @param {createConfigFile} createConfigFile
+   * @param {string} configFormatVersion - the format this build produces, used
+   *   to tell a migrating read from a clean one without running any migration
+   * @param {Object} [configFileLockOptions={}] - lock timing overrides
+   * @param {number} [configFileLockOptions.stale]
+   * @param {number} [configFileLockOptions.acquireTimeout]
    */
-  constructor(migrateConfigFile, homeDir) {
+  constructor(
+    migrateConfigFile,
+    homeDir,
+    createConfigFile,
+    configFormatVersion,
+    configFileLockOptions = {},
+  ) {
     this.migrateConfigFile = migrateConfigFile;
+    this.configFormatVersion = configFormatVersion;
+    this.createConfigFile = createConfigFile;
     this.ajv = new Ajv();
+    this.lockStaleMs = configFileLockOptions.stale ?? LOCK_STALE_MS;
+    this.lockAcquireTimeoutMs = configFileLockOptions.acquireTimeout ?? LOCK_ACQUIRE_TIMEOUT_MS;
+    this.homeDirPath = homeDir.getPath();
     this.configFilePath = homeDir.joinPath('config.json');
+    // Locking a sibling rather than the config file itself keeps first run
+    // working, where there is no config file to lock yet.
+    this.lockFilePath = homeDir.joinPath('.config.json.lock');
   }
 
   /**
    * Load configs from file
    *
    * @param {Object} [options={}]
-   * @param {boolean} [options.skipValidation=false] - Skip per-config schema validation
+   * @param {boolean|function(Object): boolean} [options.skipValidation=false]
+   *   Skip per-config schema validation globally or for configs selected by a predicate
    * @returns {ConfigFile}
    */
   read(options = {}) {
@@ -62,7 +144,17 @@ export default class ConfigFileJsonRepository {
     let configs;
     try {
       configs = Object.entries(migratedConfigFileData.configs)
-        .map(([name, opts]) => new Config(name, opts, skipValidation));
+        .map(([name, opts]) => {
+          const isValidationSkipped = typeof skipValidation === 'function'
+            ? skipValidation({
+              name,
+              options: opts,
+              configFileData: migratedConfigFileData,
+            })
+            : skipValidation;
+
+          return new Config(name, opts, isValidationSkipped);
+        });
     } catch (e) {
       throw new InvalidConfigFileFormatError(this.configFilePath, e);
     }
@@ -84,17 +176,353 @@ export default class ConfigFileJsonRepository {
     return configFile;
   }
 
+  /**
+   * Read, change and save the config file as one indivisible step.
+   *
+   * Everything happens while the file is locked, and the state handed to the
+   * mutator is read after taking the lock - so a change made by another process
+   * in between cannot be reverted, and two commands editing different options
+   * both survive. The locked read ensures the mutator never receives a stale
+   * snapshot from an earlier operation.
+   *
+   * The lock is held for a read, a mutation and a rename - milliseconds - so it
+   * is not a meaningful serialization point for commands that only edit config.
+   *
+   * @param {function(ConfigFile): void} mutate
+   * @param {Object} [options={}]
+   * @param {function(ConfigFile): void} [options.onSaved] - runs after the save
+   *   and before the lock is released
+   * @returns {void}
+   */
+  update(mutate, { onSaved } = {}) {
+    this.#locked(() => {
+      // First run has nothing to read yet, and creating the defaults here rather
+      // than separately keeps that on the same locked path as every other change
+      // - two nodes being set up at once cannot both create the file.
+      const configFile = fs.existsSync(this.configFilePath)
+        ? this.read()
+        : this.createConfigFile();
+
+      mutate(configFile);
+
+      this.#save(configFile);
+
+      if (!this.isExclusive()) {
+        throw new Error('Lost the configuration lock after saving the config file;'
+          + ' follow-up filesystem changes were not run. Re-run the command.');
+      }
+
+      if (onSaved) {
+        onSaved(configFile);
+      }
+    });
+  }
+
+  /**
+   * Read the config file, saving the result when reading migrated it.
+   *
+   * Migrating produces a new shape that has to reach disk. Doing both under one
+   * lock keeps it from reverting anything saved between the read and the save.
+   *
+   * Clean reads do not acquire the lock. When the first read discovers a
+   * migration, the file is read again and migrated under the lock before it is
+   * saved. This keeps ordinary read-only commands available during long-running
+   * configuration changes without letting a migrated snapshot overwrite a newer
+   * write.
+   *
+   * @param {Object} [options={}] - passed through to read()
+   * @param {function(Config[]): void} [onMigrated] - runs before the migrated
+   *   config file is saved and while the lock is held
+   * @returns {{configFile: ConfigFile}}
+   */
+  readAndMigrate(options = {}, onMigrated = undefined) {
+    const readResult = () => {
+      const configFile = this.read(options);
+      const migrated = configFile.getAllConfigs().filter((config) => config.isChanged());
+
+      return { configFile, migrated };
+    };
+
+    // Decide whether a migration is due from the recorded version alone.
+    // Migrations are not all pure - some move service files on disk and delete
+    // the originals - so running them to find out would do that work outside
+    // the lock, and again inside it.
+    if (!this.#isMigrationDue()) {
+      return { configFile: this.read(options) };
+    }
+
+    return this.#locked(() => {
+      if (!this.isExclusive()) {
+        throw new Error('Lost the configuration lock before the config file was migrated.');
+      }
+
+      // Another process may have migrated or changed the file while this
+      // process waited, so never save the result of the unlocked probe.
+      const result = readResult();
+
+      const { configFile, migrated } = result;
+
+      if (configFile.isChanged()) {
+        if (onMigrated) {
+          onMigrated(migrated);
+        }
+
+        this.#save(configFile);
+      }
+
+      return { configFile };
+    });
+  }
+
+  /**
+   * Whether the file on disk records an older format than this build produces.
+   *
+   * Reads the recorded version only. Running the migrations to find out would
+   * perform their side effects - the 0.25.7 migration moves TLS files and
+   * deletes the originals - before this process holds the lock.
+   *
+   * @returns {boolean}
+   */
+  #isMigrationDue() {
+    // Without a target to compare against there is no way to tell, and guessing
+    // wrong means running a migration's file moves outside the lock. Taking the
+    // lock costs a reader nothing it would not already pay when a migration is
+    // genuinely due.
+    if (typeof this.configFormatVersion !== 'string') {
+      return true;
+    }
+
+    let recordedVersion;
+
+    try {
+      recordedVersion = JSON.parse(
+        fs.readFileSync(this.configFilePath, 'utf8'),
+      ).configFormatVersion;
+    } catch {
+      // An unreadable or malformed file is read()'s to report, with the error
+      // that names the file and the reason.
+      return true;
+    }
+
+    if (typeof recordedVersion !== 'string' || semver.valid(recordedVersion) === null) {
+      return true;
+    }
+
+    return semver.lt(recordedVersion, this.configFormatVersion);
+  }
+
+  /**
+   * Whether this process still holds the lock it took.
+   *
+   * A caller with a side effect of its own to run - rendering service files -
+   * has to know before running it, not after. Losing the lock means another
+   * process may already have saved and rendered newer state, and writing over
+   * that from a stale copy is the lost update this exists to prevent.
+   *
+   * @returns {boolean}
+   */
+  isExclusive() {
+    return !this.#compromised;
+  }
+
+  /**
+   * Hold the lock for as long as this process is changing configuration.
+   *
+   * For a command that reconfigures a node over minutes, taking the lock before
+   * it reads is what makes its state current: there is no window between reading
+   * and saving for another process to write into. Short changes should use
+   * update() instead - this blocks every other writer until release() is called.
+   *
+   * Every acquire adds a lease level that needs a matching release. Locked
+   * repository operations reuse the held lease without adding another level.
+   *
+   * @returns {void}
+   */
+  acquire() {
+    if (this.#heldRelease !== null) {
+      this.#leaseDepth += 1;
+      return;
+    }
+
+    this.#compromised = false;
+    this.#heldRelease = this.#acquireLock();
+    this.#leaseDepth = 1;
+  }
+
+  /**
+   * Give up a lock taken with acquire(). Safe to call when not holding one, so
+   * it can be used from every exit path without checking first.
+   *
+   * @returns {void}
+   */
+  release() {
+    if (this.#heldRelease === null) {
+      return;
+    }
+
+    if (this.#leaseDepth > 1) {
+      this.#leaseDepth -= 1;
+      return;
+    }
+
+    const release = this.#heldRelease;
+
+    this.#heldRelease = null;
+    this.#leaseDepth = 0;
+
+    this.#release(release);
+  }
+
+  /**
+   * Run fn with the lock held, taking it only if this process is not already
+   * holding one across a command.
+   *
+   * @param {function(): *} fn
+   * @returns {*}
+   */
+  #locked(fn) {
+    if (this.#heldRelease !== null) {
+      return fn();
+    }
+
+    // A compromise belongs to the lock that was lost. A later independent
+    // acquisition restores exclusivity and must not inherit that failure.
+    this.#compromised = false;
+    const release = this.#acquireLock();
+    this.#heldRelease = release;
+    this.#leaseDepth = 1;
+
+    try {
+      return fn();
+    } finally {
+      if (this.#heldRelease === release) {
+        this.release();
+      }
+    }
+  }
+
   /**
    * Save configs to file
    *
+   * Prefer update() for changing configuration: it reads the current state under
+   * the same lock, so it cannot save something another process has already
+   * moved on from. This remains for callers that mutate a config file they are
+   * holding and then save it as a separate step.
+   *
    * @param {ConfigFile} configFile
    * @returns {void}
    */
   write(configFile) {
-    const configFileJSON = JSON.stringify(configFile.toObject(), undefined, 2);
+    this.#locked(() => this.#save(configFile));
+  }
+
+  /**
+   * Serialize and replace the file, then mark the config collection saved.
+   *
+   * Individual configs remain changed until their service templates are
+   * rendered. A mid-command save may persist JSON before those files should take
+   * effect, so clearing their flags here would make successful command
+   * finalization skip the render.
+   *
+   * Caller must hold the lock.
+   *
+   * @param {ConfigFile} configFile
+   */
+  #save(configFile) {
+    const configFileJSON = `${JSON.stringify(configFile.toObject(), undefined, 2)}\n`;
+
+    if (this.#compromised) {
+      // One path per rescue. A later command that also loses its lease must not
+      // replace a copy nobody has looked at yet - it may be the only record of
+      // an operator key typed into a setup that already registered a masternode
+      // on chain.
+      const rescuePath = path.join(this.homeDirPath, `.config.json.rescue-${randomUUID()}`);
+
+      try {
+        writeFileAtomic.sync(rescuePath, configFileJSON, {
+          encoding: 'utf8',
+          mode: 0o600,
+        });
+        fs.chmodSync(rescuePath, 0o600);
+      } catch (e) {
+        throw new Error(
+          `Lost the lock on '${this.configFilePath}' while changing it,`
+            + ` and could not preserve the pending configuration at '${rescuePath}': ${e.message}`,
+          { cause: e },
+        );
+      }
+
+      throw new Error(`Lost the lock on '${this.configFilePath}' while changing it,`
+        + ` so saving now could overwrite another process. The pending configuration was saved`
+        + ` to '${rescuePath}'. Review it before re-running the command.`);
+    }
+
+    writeFileAtomic.sync(this.configFilePath, configFileJSON, 'utf8');
 
+    // Only now is the state actually on disk. Clearing these beforehand would
+    // leave the config file claiming to be saved after a failed write.
     configFile.markAsSaved();
+  }
+
+  /**
+   * @param {function} release
+   */
+
+  #release(release) {
+    try {
+      release();
+    } catch {
+      // Releasing reports ERELEASED/ENOTACQUIRED when the lock was already
+      // gone. Nothing thrown from here may escape - it would replace the
+      // outcome the caller actually needs with a message about lock
+      // bookkeeping. A lock that cannot be released goes stale and is reclaimed
+      // by the next writer anyway.
+    }
+  }
 
-    fs.writeFileSync(this.configFilePath, `${configFileJSON}\n`, 'utf8');
+  /**
+   * Take the config file lock, waiting out a concurrent writer.
+   *
+   * proper-lockfile's sync API has no built-in retry, and failing on the first
+   * contended attempt would surface a spurious error for a lock that is only
+   * held for a rename.
+   *
+   * @returns {function} release
+   */
+  #acquireLock() {
+    const deadline = Date.now() + this.lockAcquireTimeoutMs;
+
+    for (;;) {
+      try {
+        return lockfile.lockSync(this.configFilePath, {
+          lockfilePath: this.lockFilePath,
+          // The config file legitimately does not exist on first run, and
+          // realpath resolution would fail on it.
+          realpath: false,
+          stale: this.lockStaleMs,
+          // Rethrowing here would kill the process - the handler runs from a
+          // refresh timer, not this call stack. Recording it instead lets the
+          // next save refuse, which matters because a command holding the lock
+          // across its run relies on it for exclusivity.
+          onCompromised: () => {
+            this.#compromised = true;
+          },
+        });
+      } catch (e) {
+        if (e.code !== 'ELOCKED') {
+          throw e;
+        }
+
+        if (Date.now() >= deadline) {
+          throw new Error(`Timed out waiting for configuration lock '${this.lockFilePath}'.`
+            + ' It may be held by a Dashmate command, the dashmate helper during certificate'
+            + ' renewal, or a running reindex. An abandoned lock after SIGKILL or power loss'
+            + ' clears itself after about a minute; do not remove it manually while another'
+            + ' process may still be running.');
+        }
+
+        sleepSync(LOCK_RETRY_INTERVAL_MS);
+      }
+    }
   }
 }
diff --git a/packages/dashmate/src/config/configJsonSchema.js b/packages/dashmate/src/config/configJsonSchema.js
index 191f3845f08..3202283a072 100644
--- a/packages/dashmate/src/config/configJsonSchema.js
+++ b/packages/dashmate/src/config/configJsonSchema.js
@@ -746,8 +746,17 @@ export default {
                         email: {
                           type: ['string', 'null'],
                         },
+                        acmeDirectoryUrl: {
+                          type: 'string',
+                          format: 'uri',
+                          // The response decides what certificate this node
+                          // will serve, so it has to be authenticated. Every
+                          // real ACME directory is HTTPS; a plaintext one lets
+                          // anyone on the path choose the certificate.
+                          pattern: '^https://',
+                        },
                       },
-                      required: ['email'],
+                      required: ['email', 'acmeDirectoryUrl'],
                       additionalProperties: false,
                     },
                   },
diff --git a/packages/dashmate/src/config/resolve-config-directory.js b/packages/dashmate/src/config/resolve-config-directory.js
index 3892f57e493..cf9a5177f84 100644
--- a/packages/dashmate/src/config/resolve-config-directory.js
+++ b/packages/dashmate/src/config/resolve-config-directory.js
@@ -2,9 +2,36 @@ import path from 'path';
 
 export const CONFIG_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
 
+/**
+ * Names whose directory would sit on top of a file the repository owns.
+ *
+ * Everything the repository writes alongside the config file is dot-prefixed,
+ * which no config name can reach, so only the config file itself remains. A
+ * name is still compared case-insensitively and without trailing periods,
+ * because Windows aliases those and common macOS filesystems fold case.
+ */
+const RESERVED_CONFIG_NAMES = new Set([
+  'config.json',
+]);
+
+/**
+ * Normalize names that portable local filesystems can map to the same path.
+ *
+ * @param {string} name
+ * @returns {string}
+ */
+export function getPortableConfigName(name) {
+  return name.replace(/\.+$/u, '').toLowerCase();
+}
+
 /**
  * Require a config or group name to be one portable path-safe segment.
  *
+ * Rejecting a reserved name is checked separately, on the way in. A config file
+ * written before this rule existed has to stay loadable, or the collection
+ * cannot be read at all and there is no way to run the command that would
+ * remove the offending entry.
+ *
  * @param {string} name
  */
 export function assertSafeConfigName(name) {
@@ -13,6 +40,36 @@ export function assertSafeConfigName(name) {
   }
 }
 
+/**
+ * Reject a name Dashmate cannot give a directory to.
+ *
+ * Applied where a name is chosen - creating a config or a group - rather than
+ * where one is loaded.
+ *
+ * @param {string} name
+ */
+export function isConfigNameAvailable(name) {
+  return !RESERVED_CONFIG_NAMES.has(getPortableConfigName(name));
+}
+
+/**
+ * Reject a name Dashmate cannot give a directory to.
+ *
+ * Applied where a name is chosen - creating a config or a group - rather than
+ * where one is loaded.
+ *
+ * @param {string} name
+ */
+export function assertConfigNameAvailable(name) {
+  assertSafeConfigName(name);
+
+  const canonicalName = getPortableConfigName(name);
+
+  if (RESERVED_CONFIG_NAMES.has(canonicalName)) {
+    throw new Error(`Config name '${name}' is reserved by Dashmate`);
+  }
+}
+
 /**
  * Resolve a configuration directory and prove it is a direct child of the
  * Dashmate home directory.
diff --git a/packages/dashmate/src/constants.js b/packages/dashmate/src/constants.js
index d9bb31140d6..f4377e181b3 100644
--- a/packages/dashmate/src/constants.js
+++ b/packages/dashmate/src/constants.js
@@ -54,6 +54,18 @@ export const OUTPUT_FORMATS = {
   PLAIN: 'plain',
 };
 
+/**
+ * ACME directory certificates are requested from.
+ *
+ * Let's Encrypt is the only public CA that issues certificates for IP
+ * addresses over ACME, and Dashmate identifies a node by its external IP, so
+ * this is the only value that obtains a publicly trusted certificate today.
+ * It is configurable so an operator can rehearse against the staging directory
+ * without spending the production failed-validation budget, and so a test can
+ * point at a local ACME server.
+ */
+export const LETSENCRYPT_ACME_DIRECTORY_URL = 'https://acme-v02.api.letsencrypt.org/directory';
+
 export const SSL_PROVIDERS = {
   ZEROSSL: 'zerossl',
   LETSENCRYPT: 'letsencrypt',
diff --git a/packages/dashmate/src/createDIContainer.js b/packages/dashmate/src/createDIContainer.js
index e8d98f4ddfb..9b8b1c74e96 100644
--- a/packages/dashmate/src/createDIContainer.js
+++ b/packages/dashmate/src/createDIContainer.js
@@ -7,6 +7,8 @@ import {
 } from 'awilix';
 
 import Docker from 'dockerode';
+import fs from 'fs';
+import path from 'path';
 
 import getServiceListFactory from './docker/getServiceListFactory.js';
 import ensureFileMountExistsFactory from './docker/ensureFileMountExistsFactory.js';
@@ -116,6 +118,8 @@ import getLocalConfigFactory from '../configs/defaults/getLocalConfigFactory.js'
 import getTestnetConfigFactory from '../configs/defaults/getTestnetConfigFactory.js';
 import getMainnetConfigFactory from '../configs/defaults/getMainnetConfigFactory.js';
 import getConfigFileMigrationsFactory from '../configs/getConfigFileMigrationsFactory.js';
+import getConfigFormatVersion from './config/configFile/getConfigFormatVersion.js';
+import { PACKAGE_ROOT_DIR } from './constants.js';
 import assertLocalServicesRunningFactory from './test/asserts/assertLocalServicesRunningFactory.js';
 import assertServiceRunningFactory from './test/asserts/assertServiceRunningFactory.js';
 import generateEnvsFactory from './config/generateEnvsFactory.js';
@@ -150,6 +154,13 @@ export default async function createDIContainer(options = {}) {
       HomeDir.createWithPathOrDefault(options.DASHMATE_HOME_DIR)
     )).singleton(),
     getServiceList: asFunction(getServiceListFactory).singleton(),
+    configFileLockOptions: asValue({}),
+    // Obtaining a certificate from an ACME directory that is not publicly
+    // trusted needs its CA, and reaching one that is not on the internet needs
+    // different container networking. Neither applies to Let's Encrypt, so both
+    // are empty outside a test that runs a local ACME server.
+    legoCaCertificatePath: asValue(null),
+    legoContainerOptions: asValue({}),
     configFileRepository: asClass(ConfigFileJsonRepository).singleton(),
     getBaseConfig: asFunction(getBaseConfigFactory).singleton(),
     getLocalConfig: asFunction(getLocalConfigFactory).singleton(),
@@ -169,6 +180,10 @@ export default async function createDIContainer(options = {}) {
     createConfigFile: asFunction(createConfigFileFactory).singleton(),
     getConfigFileMigrations: asFunction(getConfigFileMigrationsFactory).singleton(),
     migrateConfigFile: asFunction(migrateConfigFileFactory).singleton(),
+    configFormatVersion: asFunction((getConfigFileMigrations) => getConfigFormatVersion(
+      getConfigFileMigrations(),
+      JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT_DIR, 'package.json'), 'utf8')).version,
+    )).singleton(),
     isHelper: asValue(process.env.DASHMATE_HELPER === '1'),
     getConnectionHost: asFunction(getConnectionHostFactory).singleton(),
     generateEnvs: asFunction(generateEnvsFactory).singleton(),
diff --git a/packages/dashmate/src/helper/renewCertificate.js b/packages/dashmate/src/helper/renewCertificate.js
new file mode 100644
index 00000000000..992ec317fe7
--- /dev/null
+++ b/packages/dashmate/src/helper/renewCertificate.js
@@ -0,0 +1,79 @@
+/**
+ * Obtain and persist a renewed certificate against the latest configuration.
+ *
+ * The lock intentionally spans certificate issuance and HTTP validation. This can
+ * make foreground writers hit their acquire timeout, but prevents a provider switch
+ * or SSL disable from being overwritten by replaying renewal fields after the fact.
+ *
+ * @param {Object} options
+ * @param {string} options.configName
+ * @param {string} options.provider
+ * @param {number} options.expirationDays
+ * @param {function(Config): Listr} options.obtainCertificateTask
+ * @param {ConfigFileJsonRepository} options.configFileRepository
+ * @param {writeConfigTemplates} options.writeConfigTemplates
+ * @return {Promise<{config: Config, renewed: boolean}>}
+ */
+export default async function renewCertificate({
+  configName,
+  provider,
+  expirationDays,
+  obtainCertificateTask,
+  configFileRepository,
+  writeConfigTemplates,
+}) {
+  configFileRepository.acquire();
+
+  try {
+    const { configFile } = configFileRepository.readAndMigrate(
+      {},
+      (migratedConfigs) => migratedConfigs.forEach(writeConfigTemplates),
+    );
+    const config = configFile.getConfig(configName);
+
+    if (!config.get('platform.gateway.ssl.enabled')
+      || config.get('platform.gateway.ssl.provider') !== provider) {
+      return { config, renewed: false };
+    }
+
+    const tasks = obtainCertificateTask(config, {
+      onCertificateCreated: () => configFileRepository.write(configFile),
+    });
+
+    try {
+      await tasks.run({
+        expirationDays,
+        noRetry: true,
+      });
+    } catch (e) {
+      if (config.isChanged()) {
+        // Preserve recoverable provider state before propagating a failed renewal.
+        configFileRepository.write(configFile);
+      }
+
+      throw e;
+    }
+
+    if (config.isChanged()) {
+      // Issuance can take minutes, which is long enough for this lease to be
+      // lost and another command to save and render newer state. Rendering from
+      // this configuration would overwrite that, and the save's own check comes
+      // too late to prevent it.
+      if (!configFileRepository.isExclusive()) {
+        throw new Error('Lost the configuration lock while renewing the certificate,'
+          + ' so the gateway service files were not written. The certificate was'
+          + ' obtained; re-run renewal once no other command is changing configuration.');
+      }
+
+      // JSON is authoritative. If rendering fails or the helper is killed next,
+      // an explicit config render repairs the stale gateway service files.
+      configFileRepository.write(configFile);
+
+      writeConfigTemplates(config);
+    }
+
+    return { config, renewed: true };
+  } finally {
+    configFileRepository.release();
+  }
+}
diff --git a/packages/dashmate/src/helper/scheduleRenewCertificate.js b/packages/dashmate/src/helper/scheduleRenewCertificate.js
new file mode 100644
index 00000000000..48ffce35a79
--- /dev/null
+++ b/packages/dashmate/src/helper/scheduleRenewCertificate.js
@@ -0,0 +1,41 @@
+/**
+ * Schedule renewal for the provider selected by the current configuration.
+ *
+ * @param {Config} config
+ * @param {scheduleRenewZeroSslCertificate} scheduleRenewZeroSslCertificate
+ * @param {scheduleRenewLetsEncryptCertificate} scheduleRenewLetsEncryptCertificate
+ * @param {function(Config, function(Config|null): *): void} watchInactiveConfig
+ * @return {Promise<void>}
+ */
+export default async function scheduleRenewCertificate(
+  config,
+  scheduleRenewZeroSslCertificate,
+  scheduleRenewLetsEncryptCertificate,
+  watchInactiveConfig,
+) {
+  const scheduleCurrentProvider = (currentConfig) => {
+    if (currentConfig === null) {
+      return watchInactiveConfig(config, scheduleCurrentProvider);
+    }
+
+    return scheduleRenewCertificate(
+      currentConfig,
+      scheduleRenewZeroSslCertificate,
+      scheduleRenewLetsEncryptCertificate,
+      watchInactiveConfig,
+    );
+  };
+  const provider = config.get('platform.gateway.ssl.provider');
+
+  if (config.get('platform.gateway.ssl.enabled') && provider === 'zerossl') {
+    await scheduleRenewZeroSslCertificate(config, scheduleCurrentProvider);
+    return;
+  }
+
+  if (config.get('platform.gateway.ssl.enabled') && provider === 'letsencrypt') {
+    await scheduleRenewLetsEncryptCertificate(config, scheduleCurrentProvider);
+    return;
+  }
+
+  watchInactiveConfig(config, scheduleCurrentProvider);
+}
diff --git a/packages/dashmate/src/helper/scheduleRenewLetsEncryptCertificateFactory.js b/packages/dashmate/src/helper/scheduleRenewLetsEncryptCertificateFactory.js
index f14f1c937a2..0788709a661 100644
--- a/packages/dashmate/src/helper/scheduleRenewLetsEncryptCertificateFactory.js
+++ b/packages/dashmate/src/helper/scheduleRenewLetsEncryptCertificateFactory.js
@@ -1,13 +1,15 @@
 import { CronJob } from 'cron';
 import path from 'path';
 
+import ConfigIsNotPresentError from '../config/errors/ConfigIsNotPresentError.js';
 import LegoCertificate from '../ssl/letsencrypt/LegoCertificate.js';
+import isCertificatePairInstalled from '../ssl/letsencrypt/isCertificatePairInstalled.js';
+import scheduleRenewalJob from './scheduleRenewalJob.js';
 
 /**
  * @param {obtainLetsEncryptCertificateTask} obtainLetsEncryptCertificateTask
  * @param {DockerCompose} dockerCompose
  * @param {ConfigFileJsonRepository} configFileRepository
- * @param {ConfigFile} configFile
  * @param {writeConfigTemplates} writeConfigTemplates
  * @param {HomeDir} homeDir
  * @return {scheduleRenewLetsEncryptCertificate}
@@ -16,19 +18,52 @@ export default function scheduleRenewLetsEncryptCertificateFactory(
   obtainLetsEncryptCertificateTask,
   dockerCompose,
   configFileRepository,
-  configFile,
   writeConfigTemplates,
   homeDir,
 ) {
   /**
    * @typedef scheduleRenewLetsEncryptCertificate
    * @param {Config} config
+   * @param {function(Config|null): Promise<boolean|void>} onConfigurationChanged
    * @return {Promise<void>}
    */
-  async function scheduleRenewLetsEncryptCertificate(config) {
-    const externalIp = config.get('externalIp');
-    const legoDir = homeDir.joinPath(config.getName(), 'platform', 'gateway', 'lego');
+  async function scheduleRenewLetsEncryptCertificate(config, onConfigurationChanged) {
+    const configName = config.getName();
+    let currentConfig;
+
+    try {
+      currentConfig = configFileRepository.read().getConfig(configName);
+    } catch (e) {
+      if (e instanceof ConfigIsNotPresentError) {
+        await onConfigurationChanged(null);
+        return;
+      }
+
+      // A transient read failure must not terminate the helper's only renewal chain.
+      // eslint-disable-next-line no-console
+      console.error(`Failed to read configuration for Let's Encrypt renewal, retrying in 1 hour: ${e.message}`);
+
+      setTimeout(() => {
+        scheduleRenewLetsEncryptCertificate(config, onConfigurationChanged);
+      }, 60 * 60 * 1000);
+
+      return;
+    }
+
+    if (!currentConfig.get('platform.gateway.ssl.enabled')
+      || currentConfig.get('platform.gateway.ssl.provider') !== 'letsencrypt') {
+      await onConfigurationChanged(currentConfig);
+
+      return;
+    }
+
+    const externalIp = currentConfig.get('externalIp');
+    const legoDir = homeDir.joinPath(configName, 'platform', 'gateway', 'lego');
     const certPath = path.join(legoDir, 'certificates', `${externalIp}.crt`);
+    const keyPath = path.join(legoDir, 'certificates', `${externalIp}.key`);
+    const gatewayDir = homeDir.joinPath(configName, 'platform', 'gateway', 'ssl');
+    const gatewayCertPath = path.join(gatewayDir, 'bundle.crt');
+    const gatewayKeyPath = path.join(gatewayDir, 'private.key');
 
     let certificate;
     try {
@@ -41,20 +76,29 @@ export default function scheduleRenewLetsEncryptCertificateFactory(
 
       const retryJob = new CronJob(retryAt, async () => {
         retryJob.stop();
-        process.nextTick(() => scheduleRenewLetsEncryptCertificate(config));
+        process.nextTick(
+          () => scheduleRenewLetsEncryptCertificate(config, onConfigurationChanged),
+        );
       });
 
       retryJob.start();
       return;
     }
 
+    const isInstalled = isCertificatePairInstalled(
+      certPath,
+      keyPath,
+      gatewayCertPath,
+      gatewayKeyPath,
+    );
     let renewAt;
-    if (certificate.isExpiredInDays(LegoCertificate.EXPIRATION_LIMIT_DAYS)) {
+    if (!isInstalled
+      || certificate.isExpiredInDays(LegoCertificate.EXPIRATION_LIMIT_DAYS)) {
       // Obtain new certificate right away
       renewAt = new Date(Date.now() + 3000);
 
       // eslint-disable-next-line no-console
-      console.log(`Let's Encrypt certificate will expire in less than ${LegoCertificate.EXPIRATION_LIMIT_DAYS} days at ${certificate.expires}. Schedule to obtain it NOW.`);
+      console.log(`Let's Encrypt certificate is not installed or will expire in less than ${LegoCertificate.EXPIRATION_LIMIT_DAYS} days at ${certificate.expires}. Schedule to obtain it NOW.`);
     } else {
       // Schedule a new check close to expiration period
       renewAt = new Date(certificate.expires);
@@ -64,53 +108,22 @@ export default function scheduleRenewLetsEncryptCertificateFactory(
       console.log(`Let's Encrypt certificate will expire at ${certificate.expires}. Schedule to obtain at ${renewAt}.`);
     }
 
-    let renewalSucceeded = false;
-
-    const job = new CronJob(renewAt, async () => {
-      try {
-        const tasks = obtainLetsEncryptCertificateTask(config);
-
-        await tasks.run({
-          expirationDays: LegoCertificate.EXPIRATION_LIMIT_DAYS,
-          noRetry: true,
-        });
-
-        // Write config files
-        configFileRepository.write(configFile);
-        writeConfigTemplates(config);
-
-        // Restart Gateway to catch up new SSL certificates
-        await dockerCompose.execCommand(config, 'gateway', 'kill -SIGHUP 1');
-
-        // eslint-disable-next-line no-console
-        console.log("Let's Encrypt certificate renewed successfully");
-
-        renewalSucceeded = true;
-      } catch (e) {
-        // eslint-disable-next-line no-console
-        console.error(`Failed to renew Let's Encrypt certificate: ${e.message}`);
-
-        renewalSucceeded = false;
-      }
-
-      job.stop();
-    }, async () => {
-      // Schedule new cron task after completion
-      if (renewalSucceeded) {
-        // Success: reschedule immediately to read new cert expiry
-        process.nextTick(() => scheduleRenewLetsEncryptCertificate(config));
-      } else {
-        // Failure: wait 1 hour before retrying to avoid tight loop
-        // eslint-disable-next-line no-console
-        console.log("Scheduling Let's Encrypt renewal retry in 1 hour");
-
-        setTimeout(() => {
-          scheduleRenewLetsEncryptCertificate(config);
-        }, 60 * 60 * 1000);
-      }
+    scheduleRenewalJob({
+      renewAt,
+      currentConfig,
+      provider: 'letsencrypt',
+      providerName: "Let's Encrypt",
+      expirationDays: LegoCertificate.EXPIRATION_LIMIT_DAYS,
+      obtainCertificateTask: obtainLetsEncryptCertificateTask,
+      configFileRepository,
+      writeConfigTemplates,
+      dockerCompose,
+      onConfigurationChanged,
+      reschedule: (nextConfig) => scheduleRenewLetsEncryptCertificate(
+        nextConfig,
+        onConfigurationChanged,
+      ),
     });
-
-    job.start();
   }
 
   return scheduleRenewLetsEncryptCertificate;
diff --git a/packages/dashmate/src/helper/scheduleRenewZeroSslCertificateFactory.js b/packages/dashmate/src/helper/scheduleRenewZeroSslCertificateFactory.js
index 0526bcc1f97..1e2c35595f4 100644
--- a/packages/dashmate/src/helper/scheduleRenewZeroSslCertificateFactory.js
+++ b/packages/dashmate/src/helper/scheduleRenewZeroSslCertificateFactory.js
@@ -1,5 +1,6 @@
-import { CronJob } from 'cron';
+import ConfigIsNotPresentError from '../config/errors/ConfigIsNotPresentError.js';
 import Certificate from '../ssl/zerossl/Certificate.js';
+import scheduleRenewalJob from './scheduleRenewalJob.js';
 
 /**
  *
@@ -7,7 +8,6 @@ import Certificate from '../ssl/zerossl/Certificate.js';
  * @param {obtainZeroSSLCertificateTask} obtainZeroSSLCertificateTask
  * @param {DockerCompose} dockerCompose
  * @param {ConfigFileJsonRepository} configFileRepository
- * @param {ConfigFile} configFile
  * @param {writeConfigTemplates} writeConfigTemplates
  * @return {scheduleRenewZeroSslCertificate}
  */
@@ -16,49 +16,76 @@ export default function scheduleRenewZeroSslCertificateFactory(
   obtainZeroSSLCertificateTask,
   dockerCompose,
   configFileRepository,
-  configFile,
   writeConfigTemplates,
 ) {
   /**
    * @typedef scheduleRenewZeroSslCertificate
    * @param {Config} config
+   * @param {function(Config|null): Promise<boolean|void>} onConfigurationChanged
    * @return {Promise<void>}
    */
-  async function scheduleRenewZeroSslCertificate(config) {
+  async function scheduleRenewZeroSslCertificate(config, onConfigurationChanged) {
+    const configName = config.getName();
+    let currentConfig;
+
+    try {
+      currentConfig = configFileRepository.read().getConfig(configName);
+    } catch (e) {
+      if (e instanceof ConfigIsNotPresentError) {
+        await onConfigurationChanged(null);
+        return;
+      }
+
+      // A transient read failure must not terminate the helper's only renewal chain.
+      // eslint-disable-next-line no-console
+      console.error(`Failed to read configuration for ZeroSSL renewal, retrying in 1 hour: ${e.message}`);
+
+      setTimeout(() => {
+        scheduleRenewZeroSslCertificate(config, onConfigurationChanged);
+      }, 60 * 60 * 1000);
+
+      return;
+    }
+
+    if (!currentConfig.get('platform.gateway.ssl.enabled')
+      || currentConfig.get('platform.gateway.ssl.provider') !== 'zerossl') {
+      await onConfigurationChanged(currentConfig);
+
+      return;
+    }
+
     let certificate;
     try {
       certificate = await getCertificate(
-        config.get('platform.gateway.ssl.providerConfigs.zerossl.apiKey', false),
-        config.get('platform.gateway.ssl.providerConfigs.zerossl.id', false),
+        currentConfig.get('platform.gateway.ssl.providerConfigs.zerossl.apiKey', false),
+        currentConfig.get('platform.gateway.ssl.providerConfigs.zerossl.id', false),
       );
 
       if (!certificate) {
         throw new Error('Invalid ZeroSSL certificate ID: certificate not found');
       }
     } catch (e) {
-      // Reading the current certificate hits the ZeroSSL API. If that API is down
-      // — the exact failure behind the December mass-expiration — this previously
-      // rejected, and because the scheduler re-invokes itself fire-and-forget from
-      // the cron completion callback, the rejection went unhandled and crashed the
-      // helper instead of backing off. Mirror the Let's Encrypt scheduler, which
-      // already wraps its certificate read: log and retry in 1 hour.
+      // API failures must back off instead of terminating the helper's renewal chain.
       // eslint-disable-next-line no-console
       console.error(`Failed to read ZeroSSL certificate, retrying in 1 hour: ${e.message}`);
 
       setTimeout(() => {
-        scheduleRenewZeroSslCertificate(config);
+        scheduleRenewZeroSslCertificate(config, onConfigurationChanged);
       }, 60 * 60 * 1000);
 
       return;
     }
 
     let expiresAt;
-    if (certificate.isExpiredInDays(Certificate.EXPIRATION_LIMIT_DAYS)) {
+    // A failed validation checkpoints the remote certificate ID. Resume pending
+    // certificates immediately; their expiry is not a meaningful retry time.
+    if (certificate.status !== 'issued'
+      || certificate.isExpiredInDays(Certificate.EXPIRATION_LIMIT_DAYS)) {
       // Obtain new certificate right away
       expiresAt = new Date(Date.now() + 3000);
 
       // eslint-disable-next-line no-console
-      console.log(`SSL certificate ${certificate.id} will expire in less than ${Certificate.EXPIRATION_LIMIT_DAYS} days at ${certificate.expires}. Schedule to obtain it NOW.`);
+      console.log(`SSL certificate ${certificate.id} is not issued or will expire in less than ${Certificate.EXPIRATION_LIMIT_DAYS} days at ${certificate.expires}. Schedule to obtain it NOW.`);
     } else {
       // Schedule a new check close to expiration period
       expiresAt = new Date(certificate.expires);
@@ -68,56 +95,22 @@ export default function scheduleRenewZeroSslCertificateFactory(
       console.log(`SSL certificate ${certificate.id} will expire at ${certificate.expires}. Schedule to obtain at ${expiresAt}.`);
     }
 
-    let renewalSucceeded = false;
-
-    const job = new CronJob(expiresAt, async () => {
-      try {
-        const tasks = obtainZeroSSLCertificateTask(config);
-
-        await tasks.run({
-          expirationDays: Certificate.EXPIRATION_LIMIT_DAYS,
-          noRetry: true,
-        });
-
-        // Write config files
-        configFileRepository.write(configFile);
-        writeConfigTemplates(config);
-
-        // TODO: We can use https://www.envoyproxy.io/docs/envoy/v1.30.1/start/quick-start/configuration-dynamic-filesystem.html#start-quick-start-dynamic-fs-dynamic-lds
-        //  to dynamically update envoy configuration without restarting it
-
-        // Restart Gateway to catch up new SSL certificates
-        await dockerCompose.execCommand(config, 'gateway', 'kill -SIGHUP 1');
-
-        // eslint-disable-next-line no-console
-        console.log('ZeroSSL certificate renewed successfully');
-
-        renewalSucceeded = true;
-      } catch (e) {
-        // eslint-disable-next-line no-console
-        console.error(`Failed to renew ZeroSSL certificate: ${e.message}`);
-
-        renewalSucceeded = false;
-      }
-
-      job.stop();
-    }, async () => {
-      // Schedule new cron task after completion
-      if (renewalSucceeded) {
-        // Success: reschedule immediately to read new cert expiry
-        process.nextTick(() => scheduleRenewZeroSslCertificate(config));
-      } else {
-        // Failure: wait 1 hour before retrying to avoid tight failure loops
-        // eslint-disable-next-line no-console
-        console.log('Scheduling ZeroSSL renewal retry in 1 hour');
-
-        setTimeout(() => {
-          scheduleRenewZeroSslCertificate(config);
-        }, 60 * 60 * 1000);
-      }
+    scheduleRenewalJob({
+      renewAt: expiresAt,
+      currentConfig,
+      provider: 'zerossl',
+      providerName: 'ZeroSSL',
+      expirationDays: Certificate.EXPIRATION_LIMIT_DAYS,
+      obtainCertificateTask: obtainZeroSSLCertificateTask,
+      configFileRepository,
+      writeConfigTemplates,
+      dockerCompose,
+      onConfigurationChanged,
+      reschedule: (nextConfig) => scheduleRenewZeroSslCertificate(
+        nextConfig,
+        onConfigurationChanged,
+      ),
     });
-
-    job.start();
   }
 
   return scheduleRenewZeroSslCertificate;
diff --git a/packages/dashmate/src/helper/scheduleRenewalJob.js b/packages/dashmate/src/helper/scheduleRenewalJob.js
new file mode 100644
index 00000000000..faffaf53924
--- /dev/null
+++ b/packages/dashmate/src/helper/scheduleRenewalJob.js
@@ -0,0 +1,113 @@
+import { CronJob } from 'cron';
+import renewCertificate from './renewCertificate.js';
+import watchCertificateConfig from './watchCertificateConfig.js';
+
+const RETRY_INTERVAL_MS = 60 * 60 * 1000;
+
+/**
+ * Run a scheduled renewal while allowing a configuration change to supersede it.
+ *
+ * @param {Object} options
+ * @param {Date} options.renewAt
+ * @param {Config} options.currentConfig
+ * @param {string} options.provider
+ * @param {string} options.providerName
+ * @param {number} options.expirationDays
+ * @param {function(Config): Listr} options.obtainCertificateTask
+ * @param {ConfigFileJsonRepository} options.configFileRepository
+ * @param {writeConfigTemplates} options.writeConfigTemplates
+ * @param {DockerCompose} options.dockerCompose
+ * @param {function(Config): Promise<boolean>} options.onConfigurationChanged
+ * @param {function(Config): Promise<void>} options.reschedule
+ */
+export default function scheduleRenewalJob({
+  renewAt,
+  currentConfig,
+  provider,
+  providerName,
+  expirationDays,
+  obtainCertificateTask,
+  configFileRepository,
+  writeConfigTemplates,
+  dockerCompose,
+  onConfigurationChanged,
+  reschedule,
+}) {
+  const configName = currentConfig.getName();
+  let completion = 'retry';
+  let nextConfig = currentConfig;
+  let stopWatchingConfig = () => {};
+
+  const job = new CronJob(renewAt, async () => {
+    stopWatchingConfig();
+
+    try {
+      const renewal = await renewCertificate({
+        configName,
+        provider,
+        expirationDays,
+        obtainCertificateTask,
+        configFileRepository,
+        writeConfigTemplates,
+      });
+
+      nextConfig = renewal.config;
+
+      if (!renewal.renewed) {
+        await onConfigurationChanged(renewal.config);
+
+        completion = 'stop';
+      } else {
+        await dockerCompose.execCommand(renewal.config, 'gateway', 'kill -SIGHUP 1');
+
+        // eslint-disable-next-line no-console
+        console.log(`${providerName} certificate renewed successfully`);
+
+        completion = 'success';
+      }
+    } catch (e) {
+      // eslint-disable-next-line no-console
+      console.error(`Failed to renew ${providerName} certificate: ${e.message}`);
+
+      completion = 'retry';
+    }
+
+    job.stop();
+  }, () => {
+    if (completion === 'stop') {
+      return;
+    }
+
+    if (completion === 'success') {
+      process.nextTick(() => reschedule(nextConfig));
+      return;
+    }
+
+    // eslint-disable-next-line no-console
+    console.log(`Scheduling ${providerName} renewal retry in 1 hour`);
+
+    setTimeout(() => reschedule(nextConfig), RETRY_INTERVAL_MS);
+  });
+
+  stopWatchingConfig = watchCertificateConfig(
+    currentConfig,
+    provider,
+    configFileRepository,
+    async (changedConfig) => {
+      completion = 'stop';
+      job.stop();
+
+      if (changedConfig) {
+        return onConfigurationChanged(changedConfig);
+      }
+
+      return false;
+    },
+    (e) => {
+      // eslint-disable-next-line no-console
+      console.error(`Failed to check configuration for ${providerName} renewal: ${e.message}`);
+    },
+  );
+
+  job.start();
+}
diff --git a/packages/dashmate/src/helper/watchCertificateConfig.js b/packages/dashmate/src/helper/watchCertificateConfig.js
new file mode 100644
index 00000000000..29b06516075
--- /dev/null
+++ b/packages/dashmate/src/helper/watchCertificateConfig.js
@@ -0,0 +1,107 @@
+import ConfigIsNotPresentError from '../config/errors/ConfigIsNotPresentError.js';
+
+export const CONFIG_REFRESH_INTERVAL_MS = 60 * 1000;
+
+/**
+ * @param {Config} config
+ * @param {string|null} provider
+ * @return {string}
+ */
+function getRenewalConfigurationFingerprint(config, provider) {
+  const values = [
+    config.get('externalIp'),
+    config.get('platform.gateway.ssl.enabled'),
+    config.get('platform.gateway.ssl.provider'),
+  ];
+
+  if (provider === 'zerossl') {
+    values.push(
+      config.get('platform.gateway.ssl.providerConfigs.zerossl.apiKey'),
+      config.get('platform.gateway.ssl.providerConfigs.zerossl.id'),
+    );
+  } else if (provider === 'letsencrypt') {
+    values.push(config.get('platform.gateway.ssl.providerConfigs.letsencrypt.email'));
+  }
+
+  return JSON.stringify(values);
+}
+
+/**
+ * Watch the local config for changes that make a scheduled renewal obsolete.
+ * Without this poll, a provider switch made after a distant renewal was scheduled
+ * would not be handed to the new provider until the old job eventually fired.
+ *
+ * @param {Config} scheduledConfig
+ * @param {string|null} provider
+ * @param {ConfigFileJsonRepository} configFileRepository
+ * @param {function(Config|null): Promise<boolean|void>} onChanged
+ * @param {function(Error): void} onError
+ * @return {function(): void} stop watching
+ */
+export default function watchCertificateConfig(
+  scheduledConfig,
+  provider,
+  configFileRepository,
+  onChanged,
+  onError,
+) {
+  const configName = scheduledConfig.getName();
+  const scheduledFingerprint = getRenewalConfigurationFingerprint(
+    scheduledConfig,
+    provider,
+  );
+  let waitingForActiveConfig = provider === null;
+  let isChecking = false;
+
+  const notifyChanged = async (timer, currentConfig) => {
+    try {
+      const rescheduled = await onChanged(currentConfig);
+
+      if (rescheduled === false) {
+        waitingForActiveConfig = true;
+      } else {
+        clearInterval(timer);
+      }
+    } catch (e) {
+      onError(e);
+    }
+  };
+
+  const interval = setInterval(async () => {
+    if (isChecking) {
+      return;
+    }
+
+    isChecking = true;
+    let currentConfig;
+
+    try {
+      currentConfig = configFileRepository.read().getConfig(configName);
+    } catch (e) {
+      if (e instanceof ConfigIsNotPresentError) {
+        await notifyChanged(interval, null);
+      } else {
+        onError(e);
+      }
+
+      isChecking = false;
+      return;
+    }
+
+    const isEnabled = currentConfig.get('platform.gateway.ssl.enabled');
+
+    if ((!waitingForActiveConfig
+      && isEnabled
+      && currentConfig.get('platform.gateway.ssl.provider') === provider
+      && getRenewalConfigurationFingerprint(currentConfig, provider) === scheduledFingerprint)
+      || (waitingForActiveConfig && !isEnabled)) {
+      isChecking = false;
+      return;
+    }
+
+    await notifyChanged(interval, currentConfig);
+    isChecking = false;
+  }, CONFIG_REFRESH_INTERVAL_MS);
+
+  return () => clearInterval(interval);
+}
diff --git a/packages/dashmate/src/listr/tasks/setup/regular/configureSSLCertificateTaskFactory.js b/packages/dashmate/src/listr/tasks/setup/regular/configureSSLCertificateTaskFactory.js
index b0d11b91d71..90858703a44 100644
--- a/packages/dashmate/src/listr/tasks/setup/regular/configureSSLCertificateTaskFactory.js
+++ b/packages/dashmate/src/listr/tasks/setup/regular/configureSSLCertificateTaskFactory.js
@@ -17,6 +17,8 @@ import listCertificates from '../../../../ssl/zerossl/listCertificates.js';
  * @param {obtainZeroSSLCertificateTask} obtainZeroSSLCertificateTask
  * @param {obtainSelfSignedCertificateTask} obtainSelfSignedCertificateTask
  * @param {obtainLetsEncryptCertificateTask} obtainLetsEncryptCertificateTask
+ * @param {ConfigFile} configFile
+ * @param {ConfigFileJsonRepository} configFileRepository
  * @returns {configureSSLCertificateTask}
  */
 export default function configureSSLCertificateTaskFactory(
@@ -24,6 +26,8 @@ export default function configureSSLCertificateTaskFactory(
   obtainZeroSSLCertificateTask,
   obtainSelfSignedCertificateTask,
   obtainLetsEncryptCertificateTask,
+  configFile,
+  configFileRepository,
 ) {
   /**
    * @typedef configureSSLCertificateTask
@@ -108,7 +112,12 @@ export default function configureSSLCertificateTaskFactory(
 
           ctx.config.set('platform.gateway.ssl.providerConfigs.zerossl.apiKey', apiKey);
 
-          return obtainZeroSSLCertificateTask(ctx.config);
+          return obtainZeroSSLCertificateTask(ctx.config, {
+            onCertificateCreated: () => {
+              configFile.setConfig(ctx.config);
+              configFileRepository.write(configFile);
+            },
+          });
         },
       },
       [SSL_PROVIDERS.SELF_SIGNED]: {
diff --git a/packages/dashmate/src/listr/tasks/ssl/letsencrypt/obtainLetsEncryptCertificateTaskFactory.js b/packages/dashmate/src/listr/tasks/ssl/letsencrypt/obtainLetsEncryptCertificateTaskFactory.js
index 0e33318edd7..8da44dd8724 100644
--- a/packages/dashmate/src/listr/tasks/ssl/letsencrypt/obtainLetsEncryptCertificateTaskFactory.js
+++ b/packages/dashmate/src/listr/tasks/ssl/letsencrypt/obtainLetsEncryptCertificateTaskFactory.js
@@ -8,6 +8,8 @@ import LegoCertificate from '../../../../ssl/letsencrypt/LegoCertificate.js';
 
 const LEGO_IMAGE = 'goacme/lego:v4.31.0';
 
+const LEGO_CA_CERTIFICATE_MOUNT_PATH = '/acme-ca.pem';
+
 /**
  * @param {Docker} docker
  * @param {dockerPull} dockerPull
@@ -15,8 +17,11 @@ const LEGO_IMAGE = 'goacme/lego:v4.31.0';
  * @param {HomeDir} homeDir
  * @param {validateLetsEncryptCertificate} validateLetsEncryptCertificate
  * @param {saveCertificateTask} saveCertificateTask
- * @param {ConfigFileJsonRepository} configFileRepository
- * @param {ConfigFile} configFile
+ * @param {string|null} legoCaCertificatePath - CA that signed the ACME
+ *   directory's own certificate, for a directory that is not publicly trusted
+ * @param {Object} legoContainerOptions - Docker create-container overrides for
+ *   the lego container, so it can be reached over a network of the caller's
+ *   choosing rather than the host's port 80
  * @return {obtainLetsEncryptCertificateTask}
  */
 export default function obtainLetsEncryptCertificateTaskFactory(
@@ -26,8 +31,8 @@ export default function obtainLetsEncryptCertificateTaskFactory(
   homeDir,
   validateLetsEncryptCertificate,
   saveCertificateTask,
-  configFileRepository,
-  configFile,
+  legoCaCertificatePath,
+  legoContainerOptions,
 ) {
   /**
    * @typedef {obtainLetsEncryptCertificateTask}
@@ -41,9 +46,12 @@ export default function obtainLetsEncryptCertificateTaskFactory(
         task: async (ctx) => {
           // Always load config values (needed even when --force is used)
           ctx.email = config.get('platform.gateway.ssl.providerConfigs.letsencrypt.email');
+          ctx.acmeDirectoryUrl = config.get('platform.gateway.ssl.providerConfigs.letsencrypt.acmeDirectoryUrl');
           ctx.externalIp = config.get('externalIp');
           ctx.legoDir = homeDir.joinPath(config.getName(), 'platform', 'gateway', 'lego');
           ctx.sslConfigDir = homeDir.joinPath(config.getName(), 'platform', 'gateway', 'ssl');
+          ctx.configurationUpdateRequired = !config.get('platform.gateway.ssl.enabled')
+            || config.get('platform.gateway.ssl.provider') !== 'letsencrypt';
 
           if (!ctx.email) {
             throw new Error("Let's Encrypt email is not set. Please set it in the config file");
@@ -138,6 +146,17 @@ export default function obtainLetsEncryptCertificateTaskFactory(
         task: async (ctx, task) => {
           const { uid, gid } = os.userInfo();
 
+          let acmeDirectoryUrl;
+          try {
+            acmeDirectoryUrl = new URL(ctx.acmeDirectoryUrl);
+          } catch {
+            throw new Error('ACME directory URL must use HTTPS');
+          }
+
+          if (acmeDirectoryUrl.protocol !== 'https:') {
+            throw new Error('ACME directory URL must use HTTPS');
+          }
+
           // Determine if this is initial run or renewal
           const command = ctx.isRenewal ? 'renew' : 'run';
 
@@ -145,7 +164,7 @@ export default function obtainLetsEncryptCertificateTaskFactory(
           // --disable-cn is needed for IP address certificates
           // --key-type rsa2048 is needed because node-forge doesn't support ECDSA
           const legoArgs = [
-            '--server=https://acme-v02.api.letsencrypt.org/directory',
+            `--server=${acmeDirectoryUrl.toString()}`,
             '--email', ctx.email,
             '--accept-tos',
             '--http',
@@ -186,16 +205,30 @@ export default function obtainLetsEncryptCertificateTaskFactory(
             }
           }
 
+          const binds = [`${ctx.legoDir}:/data`];
+          const env = [];
+
+          // An ACME directory that is not publicly trusted - a staging or local
+          // server - presents a certificate lego rejects unless told which CA
+          // signed it.
+          if (legoCaCertificatePath) {
+            binds.push(`${legoCaCertificatePath}:${LEGO_CA_CERTIFICATE_MOUNT_PATH}:ro`);
+            env.push(`LEGO_CA_CERTIFICATES=${LEGO_CA_CERTIFICATE_MOUNT_PATH}`);
+          }
+
           const container = await docker.createContainer({
             name: containerName,
             Image: LEGO_IMAGE,
             Cmd: legoArgs,
+            Env: env,
             User: `${uid}:${gid}`,
             ExposedPorts: { '80/tcp': {} },
+            ...legoContainerOptions,
             HostConfig: {
               AutoRemove: true,
-              Binds: [`${ctx.legoDir}:/data`],
+              Binds: binds,
               PortBindings: { '80/tcp': [{ HostPort: '80' }] },
+              ...legoContainerOptions.HostConfig,
             },
           });
 
@@ -236,29 +269,33 @@ export default function obtainLetsEncryptCertificateTaskFactory(
             throw new Error('Private key file was not created by lego');
           }
 
+          ctx.configurationUpdateRequired = true;
+
           // eslint-disable-next-line no-param-reassign
           task.output = 'Certificate obtained successfully';
         },
       },
       {
         title: 'Save certificate',
-        skip: (ctx) => ctx.certificateValid,
+        skip: (ctx) => ctx.certificateValid && ctx.isCertificatePairInstalled,
         task: async (ctx) => {
           // Read certificate and key from lego output
           ctx.certificateFile = fs.readFileSync(ctx.legoCertPath, 'utf8');
           ctx.privateKeyFile = fs.readFileSync(ctx.legoKeyPath, 'utf8');
-
-          // Update config
-          config.set('platform.gateway.ssl.enabled', true);
-          config.set('platform.gateway.ssl.provider', 'letsencrypt');
-
-          // Save config file
-          configFileRepository.write(configFile);
+          ctx.configurationUpdateRequired = true;
 
           // Save to gateway SSL directory
           return saveCertificateTask(config);
         },
       },
+      {
+        title: 'Update configuration',
+        enabled: (ctx) => ctx.configurationUpdateRequired,
+        task: async () => {
+          config.set('platform.gateway.ssl.enabled', true);
+          config.set('platform.gateway.ssl.provider', 'letsencrypt');
+        },
+      },
     ], {
       rendererOptions: {
         showErrorMessage: true,
diff --git a/packages/dashmate/src/listr/tasks/ssl/saveCertificateTask.js b/packages/dashmate/src/listr/tasks/ssl/saveCertificateTask.js
index bbcfac1ea04..9d6b2cbbfd5 100644
--- a/packages/dashmate/src/listr/tasks/ssl/saveCertificateTask.js
+++ b/packages/dashmate/src/listr/tasks/ssl/saveCertificateTask.js
@@ -1,6 +1,7 @@
 import { Listr } from 'listr2';
 import path from 'path';
 import fs from 'fs';
+import graceful from 'node-graceful';
 
 /**
  * @param {HomeDir} homeDir
@@ -27,11 +28,70 @@ export default function saveCertificateTaskFactory(homeDir) {
           fs.mkdirSync(certificatesDir, { recursive: true });
 
           const crtFile = path.join(certificatesDir, 'bundle.crt');
+          const keyFile = path.join(certificatesDir, 'private.key');
 
-          fs.writeFileSync(crtFile, ctx.certificateFile, 'utf8');
+          fs.readdirSync(certificatesDir)
+            .filter((fileName) => (
+              fileName.startsWith('bundle.crt.tmp-')
+              || fileName.startsWith('private.key.tmp-')
+            ))
+            .forEach((fileName) => {
+              fs.rmSync(path.join(certificatesDir, fileName), { force: true });
+            });
 
-          const keyFile = path.join(certificatesDir, 'private.key');
-          fs.writeFileSync(keyFile, ctx.privateKeyFile, 'utf8');
+          const crtTempFile = `${crtFile}.tmp-${process.pid}`;
+          const keyTempFile = `${keyFile}.tmp-${process.pid}`;
+          const previousCertificate = fs.existsSync(crtFile)
+            ? fs.readFileSync(crtFile)
+            : null;
+          const certificateMode = fs.existsSync(crtFile)
+            // eslint-disable-next-line no-bitwise
+            ? fs.statSync(crtFile).mode & 0o777
+            : 0o644;
+          // Dashmate used to create this file at the process umask, so an
+          // upgraded node carries a group- and world-readable private key.
+          // Dropping those bits repairs it on the next renewal, while an owner
+          // that hardened it further - 0400 - keeps what it chose.
+          const keyMode = fs.existsSync(keyFile)
+            // eslint-disable-next-line no-bitwise
+            ? fs.statSync(keyFile).mode & 0o700
+            : 0o600;
+          let certificateReplaced = false;
+          const cleanupTempFiles = () => {
+            fs.rmSync(crtTempFile, { force: true });
+            fs.rmSync(keyTempFile, { force: true });
+          };
+          const unsubscribe = graceful.on('exit', cleanupTempFiles);
+
+          try {
+            fs.writeFileSync(crtTempFile, ctx.certificateFile, {
+              encoding: 'utf8',
+              mode: certificateMode,
+            });
+            fs.chmodSync(crtTempFile, certificateMode);
+            fs.writeFileSync(keyTempFile, ctx.privateKeyFile, {
+              encoding: 'utf8',
+              mode: keyMode,
+            });
+            fs.chmodSync(keyTempFile, keyMode);
+            fs.renameSync(crtTempFile, crtFile);
+            certificateReplaced = true;
+            fs.renameSync(keyTempFile, keyFile);
+          } catch (e) {
+            if (certificateReplaced) {
+              if (previousCertificate === null) {
+                fs.rmSync(crtFile, { force: true });
+              } else {
+                fs.writeFileSync(crtFile, previousCertificate, { mode: certificateMode });
+                fs.chmodSync(crtFile, certificateMode);
+              }
+            }
+
+            throw e;
+          } finally {
+            cleanupTempFiles();
+            unsubscribe();
+          }
 
           config.set('platform.gateway.ssl.enabled', true);
         },
diff --git a/packages/dashmate/src/listr/tasks/ssl/zerossl/obtainZeroSSLCertificateTaskFactory.js b/packages/dashmate/src/listr/tasks/ssl/zerossl/obtainZeroSSLCertificateTaskFactory.js
index a08e7ab7d02..504f8c4a67d 100644
--- a/packages/dashmate/src/listr/tasks/ssl/zerossl/obtainZeroSSLCertificateTaskFactory.js
+++ b/packages/dashmate/src/listr/tasks/ssl/zerossl/obtainZeroSSLCertificateTaskFactory.js
@@ -18,8 +18,6 @@ import { ERRORS } from '../../../../ssl/zerossl/validateZeroSslCertificateFactor
  * @param {VerificationServer} verificationServer
  * @param {HomeDir} homeDir
  * @param {validateZeroSslCertificate} validateZeroSslCertificate
- * @param {ConfigFileJsonRepository} configFileRepository
- * @param {ConfigFile} configFile
  * @return {obtainZeroSSLCertificateTask}
  */
 export default function obtainZeroSSLCertificateTaskFactory(
@@ -34,15 +32,24 @@ export default function obtainZeroSSLCertificateTaskFactory(
   verificationServer,
   homeDir,
   validateZeroSslCertificate,
-  configFileRepository,
-  configFile,
 ) {
   /**
    * @typedef {obtainZeroSSLCertificateTask}
    * @param {Config} config
+   * @param {Object} options
+   * @param {function(): void} options.onCertificateCreated
    * @return {Listr}
    */
-  function obtainZeroSSLCertificateTask(config) {
+  function obtainZeroSSLCertificateTask(config, options = {}) {
+    const { onCertificateCreated } = options;
+
+    if (typeof onCertificateCreated !== 'function') {
+      throw new TypeError('onCertificateCreated callback is required');
+    }
+
+    const configurationUpdateRequired = !config.get('platform.gateway.ssl.enabled')
+      || config.get('platform.gateway.ssl.provider') !== 'zerossl';
+
     const tasks = new Listr([
       {
         title: 'Check if certificate already exists and not expiring soon',
@@ -141,13 +148,10 @@ export default function obtainZeroSSLCertificateTaskFactory(
             ctx.externalIp,
             ctx.apiKey,
           );
-
-          config.set('platform.gateway.ssl.enabled', true);
-          config.set('platform.gateway.ssl.provider', 'zerossl');
+          ctx.createdCertificate = true;
           config.set('platform.gateway.ssl.providerConfigs.zerossl.id', ctx.certificate.id);
 
-          // Save config file
-          configFileRepository.write(configFile);
+          onCertificateCreated();
         },
       },
       {
@@ -270,9 +274,26 @@ and all Dash service ports listed above.`);
       },
       {
         title: 'Save certificate private key file',
-        enabled: (ctx) => !ctx.isPrivateKeyFilePresent,
         task: async (ctx, task) => {
-          fs.writeFileSync(ctx.privateKeyFilePath, ctx.privateKeyFile, 'utf8');
+          if (ctx.isPrivateKeyFilePresent) {
+            // A key written before Dashmate set a mode is group- and
+            // world-readable, and reusing it skips the write that would fix
+            // that - so tighten what is already there. An owner that chose
+            // something stricter keeps it. Presence was decided by an earlier
+            // validation step, so confirm it rather than assume it still holds.
+            if (fs.existsSync(ctx.privateKeyFilePath)) {
+              // eslint-disable-next-line no-bitwise
+              const mode = fs.statSync(ctx.privateKeyFilePath).mode & 0o700;
+
+              fs.chmodSync(ctx.privateKeyFilePath, mode);
+            }
+          } else {
+            fs.writeFileSync(ctx.privateKeyFilePath, ctx.privateKeyFile, {
+              encoding: 'utf8',
+              mode: 0o600,
+            });
+            fs.chmodSync(ctx.privateKeyFilePath, 0o600);
+          }
 
           // eslint-disable-next-line no-param-reassign
           task.output = ctx.privateKeyFilePath;
@@ -306,6 +327,14 @@ and all Dash service ports listed above.`);
           await verificationServer.destroy();
         },
       },
+      {
+        title: 'Update configuration',
+        enabled: (ctx) => ctx.createdCertificate || configurationUpdateRequired,
+        task: async () => {
+          config.set('platform.gateway.ssl.enabled', true);
+          config.set('platform.gateway.ssl.provider', 'zerossl');
+        },
+      },
     ], {
       rendererOptions: {
         showErrorMessage: true,
diff --git a/packages/dashmate/src/listr/tasks/startGroupNodesTaskFactory.js b/packages/dashmate/src/listr/tasks/startGroupNodesTaskFactory.js
index b35b3e252dc..43bce26bb6a 100644
--- a/packages/dashmate/src/listr/tasks/startGroupNodesTaskFactory.js
+++ b/packages/dashmate/src/listr/tasks/startGroupNodesTaskFactory.js
@@ -17,6 +17,8 @@ const WAIT_FOR_NODES_TIMEOUT = 60 * 5 * 1000;
  * @param {waitForNodeToBeReadyTask} waitForNodeToBeReadyTask
  * @param {buildServicesTask} buildServicesTask
  * @param {getConnectionHost} getConnectionHost
+ * @param {ConfigFileJsonRepository} configFileRepository
+ * @param {writeConfigTemplates} writeConfigTemplates
  * @return {startGroupNodesTask}
  */
 export default function startGroupNodesTaskFactory(
@@ -29,6 +31,8 @@ export default function startGroupNodesTaskFactory(
   waitForNodeToBeReadyTask,
   buildServicesTask,
   getConnectionHost,
+  configFileRepository,
+  writeConfigTemplates,
 ) {
   /**
    * @typedef {startGroupNodesTask}
@@ -103,9 +107,25 @@ export default function startGroupNodesTaskFactory(
           let minerAddress = minerConfig.get('core.miner.address');
 
           if (minerAddress === null) {
-            const privateKey = new PrivateKey();
-            minerAddress = privateKey.toAddress('regtest').toString();
+            configFileRepository.update((configFile) => {
+              const freshMinerConfig = configFile.getConfig(minerConfig.getName());
 
+              minerAddress = freshMinerConfig.get('core.miner.address');
+
+              if (minerAddress === null) {
+                const privateKey = new PrivateKey();
+                minerAddress = privateKey.toAddress('regtest').toString();
+
+                freshMinerConfig.set('core.miner.address', minerAddress);
+              }
+            }, {
+              onSaved: (configFile) => writeConfigTemplates(
+                configFile.getConfig(minerConfig.getName()),
+              ),
+            });
+
+            // The running task keeps the object loaded at command startup, so
+            // copy the value selected from fresh state back into it.
             minerConfig.set('core.miner.address', minerAddress);
           }
 
diff --git a/packages/dashmate/src/oclif/command/BaseCommand.js b/packages/dashmate/src/oclif/command/BaseCommand.js
index 3fa7d2c0313..9af8566d897 100644
--- a/packages/dashmate/src/oclif/command/BaseCommand.js
+++ b/packages/dashmate/src/oclif/command/BaseCommand.js
@@ -21,6 +21,14 @@ export default class BaseCommand extends Command {
     }),
   };
 
+  /**
+   * @param {Object} options
+   * @return {Promise<AwilixContainer>}
+   */
+  async createContainer(options) {
+    return createDIContainer(options);
+  }
+
   async init() {
     // Read environment variables from .env file
     dotenv.config();
@@ -30,7 +38,7 @@ export default class BaseCommand extends Command {
     this.parsedArgs = args;
     this.parsedFlags = flags;
 
-    this.container = await createDIContainer(process.env);
+    this.container = await this.createContainer(process.env);
 
     // Load configs
     /**
@@ -38,13 +46,34 @@ export default class BaseCommand extends Command {
      */
     const configFileRepository = this.container.resolve('configFileRepository');
 
+    // A command that reconfigures a node changes config repeatedly while doing
+    // long work, so it takes the lock before reading: its state is then current
+    // for the whole run and no other writer can get in between. Everything else
+    // changes config through configFileRepository.update() and needs nothing
+    // here.
+    if (this.constructor.mutatesConfig) {
+      configFileRepository.acquire();
+    }
+
     let configFile;
     try {
-      // Load config collection from config file
-      // Skip per-config validation when --force flag is passed (e.g., for reset command)
-      configFile = configFileRepository.read({
-        skipValidation: Boolean(this.parsedFlags.force),
-      });
+      // Load config collection from config file, saving it again if loading
+      // migrated it - under one lock, so the migrated shape cannot revert a
+      // change saved in between.
+      const skipValidation = this.constructor.shouldSkipConfigValidation?.(
+        this.parsedFlags,
+      ) ?? false;
+
+      ({ configFile } = configFileRepository.readAndMigrate(
+        {
+          skipValidation,
+        },
+        (migratedConfigs) => {
+          const writeConfigTemplates = this.container.resolve('writeConfigTemplates');
+
+          migratedConfigs.forEach(writeConfigTemplates);
+        },
+      ));
     } catch (e) {
       // Create default config collection if config file is not present
       // on the first start for example
@@ -97,45 +126,98 @@ export default class BaseCommand extends Command {
   }
 
   async finally(err) {
+    try {
+      await this.saveConfigAndStopContainers(err);
+    } finally {
+      // Whether the command succeeded, failed, or failed before it started, the
+      // lock must not outlive it.
+      if (this.container && this.constructor.mutatesConfig) {
+        this.container.resolve('configFileRepository').release();
+      }
+    }
+
+    return super.finally(err);
+  }
+
+  /**
+   * @param {Error|undefined} err
+   */
+  async saveConfigAndStopContainers(err) {
     // Save configs collection
     if (this.container) {
+      let saveError;
+
       /**
        * @var {ConfigFileJsonRepository} configFileRepository
        */
       const configFileRepository = this.container.resolve('configFileRepository');
 
-      if (this.container.has('configFile') && err === undefined) {
-        /**
-         * @var {ConfigFile} configFile
-         */
-        const configFile = this.container.resolve('configFile');
-
-        if (configFile.isChanged()) {
-          configFileRepository.write(configFile);
-
+      try {
+        // Only a command that held the lock for its whole run may save the config
+        // file it loaded - it read inside the lock, so its state is current. Any
+        // other command changes configuration through update(), and saving its
+        // startup copy here would write a snapshot from before the command ran.
+        if (this.constructor.mutatesConfig
+          && this.container.has('configFile') && err === undefined) {
           /**
-           * @var {writeConfigTemplates} writeConfigTemplates
+           * @var {ConfigFile} configFile
            */
-          const writeConfigTemplates = this.container.resolve('writeConfigTemplates');
-
-          configFile.getAllConfigs()
-            .filter((config) => config.isChanged())
-            .forEach(writeConfigTemplates);
+          const configFile = this.container.resolve('configFile');
+
+          if (configFile.isChanged()) {
+            // Rendering must not start once the lock is gone: another process
+            // may already have saved and rendered newer state, and these files
+            // would overwrite it from a snapshot taken before it existed.
+            if (!configFileRepository.isExclusive()) {
+              // Saving refuses too, but on the way it writes what this command
+              // produced to a rescue file - which for setup or a reindex is the
+              // only copy of work that already happened out in the world. Going
+              // through it rather than throwing here keeps that, and it still
+              // stops before anything is rendered.
+              configFileRepository.write(configFile);
+            }
+
+            const changedConfigs = configFile.getAllConfigs()
+              .filter((config) => config.isChanged());
+
+            /**
+             * @var {writeConfigTemplates} writeConfigTemplates
+             */
+            const writeConfigTemplates = this.container.resolve('writeConfigTemplates');
+
+            // JSON is authoritative. If rendering fails or the process is killed
+            // next, an explicit config render repairs the stale service files.
+            configFileRepository.write(configFile);
+
+            changedConfigs.forEach(writeConfigTemplates);
+          }
         }
+      } catch (e) {
+        saveError = e;
       }
 
       // Stop all running containers
       const stopAllContainers = this.container.resolve('stopAllContainers');
       const startedContainers = this.container.resolve('startedContainers');
 
-      await stopAllContainers(
-        startedContainers.getContainers(),
-        {
-          remove: !settings.debug,
-        },
-      );
-    }
+      try {
+        await stopAllContainers(
+          startedContainers.getContainers(),
+          {
+            remove: !settings.debug,
+          },
+        );
+      } catch (cleanupError) {
+        if (!saveError) {
+          throw cleanupError;
+        }
 
-    return super.finally(err);
+        saveError.cleanupError = cleanupError;
+      }
+
+      if (saveError) {
+        throw saveError;
+      }
+    }
   }
 }
diff --git a/packages/dashmate/src/ssl/letsencrypt/isCertificatePairInstalled.js b/packages/dashmate/src/ssl/letsencrypt/isCertificatePairInstalled.js
new file mode 100644
index 00000000000..68deb56014d
--- /dev/null
+++ b/packages/dashmate/src/ssl/letsencrypt/isCertificatePairInstalled.js
@@ -0,0 +1,26 @@
+import fs from 'fs';
+
+/**
+ * Check whether the gateway certificate pair is the exact pair produced by lego.
+ * File existence alone cannot distinguish a completed install from a partial
+ * replacement, which would otherwise be treated as valid until certificate expiry.
+ *
+ * @param {string} legoCertificatePath
+ * @param {string} legoKeyPath
+ * @param {string} gatewayCertificatePath
+ * @param {string} gatewayKeyPath
+ * @return {boolean}
+ */
+export default function isCertificatePairInstalled(
+  legoCertificatePath,
+  legoKeyPath,
+  gatewayCertificatePath,
+  gatewayKeyPath,
+) {
+  try {
+    return fs.readFileSync(legoCertificatePath).equals(fs.readFileSync(gatewayCertificatePath))
+      && fs.readFileSync(legoKeyPath).equals(fs.readFileSync(gatewayKeyPath));
+  } catch {
+    return false;
+  }
+}
diff --git a/packages/dashmate/src/ssl/letsencrypt/validateLetsEncryptCertificateFactory.js b/packages/dashmate/src/ssl/letsencrypt/validateLetsEncryptCertificateFactory.js
index 02edc2710d4..7a9effe67fb 100644
--- a/packages/dashmate/src/ssl/letsencrypt/validateLetsEncryptCertificateFactory.js
+++ b/packages/dashmate/src/ssl/letsencrypt/validateLetsEncryptCertificateFactory.js
@@ -2,6 +2,7 @@ import fs from 'fs';
 import path from 'path';
 
 import LegoCertificate from './LegoCertificate.js';
+import isCertificatePairInstalled from './isCertificatePairInstalled.js';
 
 export const ERRORS = {
   EMAIL_IS_NOT_SET: 'EMAIL_IS_NOT_SET',
@@ -67,6 +68,12 @@ export default function validateLetsEncryptCertificateFactory(homeDir) {
     // Check if gateway SSL files exist
     data.isPrivateKeyFilePresent = fs.existsSync(data.privateKeyFilePath);
     data.isBundleFilePresent = fs.existsSync(data.bundleFilePath);
+    data.isCertificatePairInstalled = isCertificatePairInstalled(
+      data.legoCertPath,
+      data.legoKeyPath,
+      data.bundleFilePath,
+      data.privateKeyFilePath,
+    );
 
     if (!data.isLegoCertPresent) {
       return {
diff --git a/packages/dashmate/test/integration/ssl/letsencryptPebble.spec.js b/packages/dashmate/test/integration/ssl/letsencryptPebble.spec.js
new file mode 100644
index 00000000000..46c39e4e034
--- /dev/null
+++ b/packages/dashmate/test/integration/ssl/letsencryptPebble.spec.js
@@ -0,0 +1,377 @@
+import fs from 'fs';
+import path from 'path';
+import crypto from 'crypto';
+import Docker from 'dockerode';
+import { asValue } from 'awilix';
+import createDIContainer from '../../../src/createDIContainer.js';
+import HomeDir from '../../../src/config/HomeDir.js';
+import getBaseConfigFactory from '../../../configs/defaults/getBaseConfigFactory.js';
+
+/**
+ * Obtain a certificate from a real ACME server.
+ *
+ * Everything below the ACME directory URL is production code: the lego image,
+ * its arguments, the HTTP-01 challenge it answers, and the files it produces.
+ * Only the certificate authority is swapped, for Pebble - the server Let's
+ * Encrypt tests its own implementation against.
+ *
+ * Pebble rather than a stub because Dashmate identifies a node by its external
+ * IP, and an IP certificate is what has to work. Pebble implements the IP
+ * identifier extension and ships the same `shortlived` profile name Let's
+ * Encrypt requires for them, so the production arguments run unchanged.
+ */
+const PEBBLE_IMAGE = 'ghcr.io/letsencrypt/pebble:latest';
+
+// Pebble presents a certificate for `pebble`, `localhost` and 127.0.0.1 only,
+// so it has to be reached by a name it was issued for.
+const PEBBLE_HOSTNAME = 'pebble';
+const PEBBLE_ACME_PORT = 14000;
+
+// lego asks for a certificate covering a fixed address and Pebble connects back
+// to it, so both need addresses known before they start. Docker only honours a
+// requested address on a network whose subnet was configured explicitly, so the
+// pool cannot simply be left to it - instead a candidate is tried and the next
+// one used if the machine is already occupying it.
+const CANDIDATE_SUBNETS = [
+  '172.29.0.0/24',
+  '172.30.0.0/24',
+  '172.31.0.0/24',
+  '10.229.0.0/24',
+  '10.230.0.0/24',
+];
+
+const DOCKER_SUBNET_OVERLAP_MESSAGE = 'Pool overlaps with other one on this address space';
+
+/**
+ * @param {Error & {reason?: string, json?: {message?: string}}} error
+ * @return {boolean}
+ */
+function isDockerSubnetOverlapError(error) {
+  return [error.message, error.reason, error.json && error.json.message]
+    .some((message) => typeof message === 'string'
+      && message.includes(DOCKER_SUBNET_OVERLAP_MESSAGE));
+}
+
+/**
+ * Create the test network from the first candidate Docker accepts.
+ *
+ * @param {Docker} docker
+ * @param {string} networkName
+ * @param {string[]} candidateSubnets
+ * @return {Promise<{network: Object, subnet: string}>}
+ */
+async function createNetworkFromCandidateSubnets(docker, networkName, candidateSubnets) {
+  let lastError;
+
+  for (const subnet of candidateSubnets) {
+    try {
+      const network = await docker.createNetwork({
+        Name: networkName,
+        IPAM: { Config: [{ Subnet: subnet }] },
+      });
+
+      return { network, subnet };
+    } catch (e) {
+      if (!isDockerSubnetOverlapError(e)) {
+        throw e;
+      }
+
+      lastError = e;
+    }
+  }
+
+  throw new Error('No candidate subnet was free for the ACME test network:'
+    + ` ${lastError && lastError.message}`);
+}
+
+describe('Pebble candidate network selection', () => {
+  const overlapErrors = [
+    ['message', () => new Error(DOCKER_SUBNET_OVERLAP_MESSAGE)],
+    ['reason', () => Object.assign(new Error('network creation failed'), {
+      reason: DOCKER_SUBNET_OVERLAP_MESSAGE,
+    })],
+    ['json.message', () => Object.assign(new Error('network creation failed'), {
+      json: { message: DOCKER_SUBNET_OVERLAP_MESSAGE },
+    })],
+  ];
+
+  overlapErrors.forEach(([field, createOverlapError]) => {
+    it(`should try the next candidate when Docker reports overlap in ${field}`, async function it() {
+      const network = {};
+      const docker = {
+        createNetwork: this.sinon.stub(),
+      };
+      docker.createNetwork.onFirstCall().rejects(createOverlapError());
+      docker.createNetwork.onSecondCall().resolves(network);
+
+      const result = await createNetworkFromCandidateSubnets(
+        docker,
+        'acme-test',
+        ['172.29.0.0/24', '172.30.0.0/24'],
+      );
+
+      expect(result).to.deep.equal({ network, subnet: '172.30.0.0/24' });
+    });
+  });
+
+  it('should not hide an unrelated Docker failure', async function it() {
+    const permissionError = new Error('permission denied');
+    const docker = {
+      createNetwork: this.sinon.stub(),
+    };
+    docker.createNetwork.onFirstCall().rejects(permissionError);
+    docker.createNetwork.onSecondCall().resolves({});
+
+    await expect(createNetworkFromCandidateSubnets(
+      docker,
+      'acme-test',
+      ['172.29.0.0/24', '172.30.0.0/24'],
+    )).to.be.rejectedWith(permissionError);
+
+    expect(docker.createNetwork).to.have.been.calledOnce();
+  });
+
+  it('should report exhaustion after every candidate overlaps', async function it() {
+    const docker = {
+      createNetwork: this.sinon.stub().rejects(new Error(DOCKER_SUBNET_OVERLAP_MESSAGE)),
+    };
+
+    await expect(createNetworkFromCandidateSubnets(
+      docker,
+      'acme-test',
+      ['172.29.0.0/24', '172.30.0.0/24'],
+    )).to.be.rejectedWith('No candidate subnet was free for the ACME test network');
+
+    expect(docker.createNetwork).to.have.been.calledTwice();
+  });
+});
+
+describe('Let\'s Encrypt certificate against a local ACME server', function main() {
+  this.timeout(5 * 60 * 1000);
+
+  const docker = new Docker();
+  const networkName = `dashmate-acme-test-${crypto.randomBytes(4).toString('hex')}`;
+
+  let network;
+  let pebbleIp;
+  let legoIp;
+  let pebbleContainer;
+  let pebbleDir;
+  let homeDir;
+  let container;
+  let config;
+  let sslDir;
+
+  /**
+   * Pebble is distroless, so its CA and default config are read out of the
+   * image rather than from a shell inside it.
+   *
+   * @param {string} destination
+   */
+  async function extractPebbleFixtures(destination) {
+    const created = await docker.createContainer({ Image: PEBBLE_IMAGE });
+
+    try {
+      const archive = await created.getArchive({ path: '/test' });
+
+      await new Promise((resolve, reject) => {
+        const write = fs.createWriteStream(path.join(destination, 'test.tar'));
+        archive.pipe(write);
+        archive.on('error', reject);
+        write.on('finish', resolve);
+        write.on('error', reject);
+      });
+    } finally {
+      await created.remove({ force: true });
+    }
+
+    const { execFileSync } = await import('child_process');
+    execFileSync('tar', ['-xf', path.join(destination, 'test.tar'), '-C', destination]);
+  }
+
+  before(async () => {
+    await new Promise((resolve, reject) => {
+      docker.pull(PEBBLE_IMAGE, (err, stream) => {
+        if (err) {
+          reject(err);
+          return;
+        }
+        docker.modem.followProgress(stream, (e) => (e ? reject(e) : resolve()));
+      });
+    });
+
+    pebbleDir = fs.mkdtempSync(path.join(HomeDir.createTemp().getPath(), 'pebble-'));
+
+    await extractPebbleFixtures(pebbleDir);
+
+    // Validate against the port the production lego arguments serve on, so
+    // `--http.port :80` is exercised rather than replaced.
+    const pebbleConfigPath = path.join(pebbleDir, 'pebble-config.json');
+    const pebbleConfig = JSON.parse(
+      fs.readFileSync(path.join(pebbleDir, 'test', 'config', 'pebble-config.json'), 'utf8'),
+    );
+    pebbleConfig.pebble.httpPort = 80;
+    fs.writeFileSync(pebbleConfigPath, JSON.stringify(pebbleConfig), 'utf8');
+
+    const selected = await createNetworkFromCandidateSubnets(
+      docker,
+      networkName,
+      CANDIDATE_SUBNETS,
+    );
+    network = selected.network;
+
+    const [prefix] = selected.subnet.split('/');
+    const octets = prefix.split('.');
+
+    // .1 is the gateway Docker assigns itself.
+    pebbleIp = [...octets.slice(0, 3), '2'].join('.');
+    legoIp = [...octets.slice(0, 3), '3'].join('.');
+
+    pebbleContainer = await docker.createContainer({
+      Image: PEBBLE_IMAGE,
+      Cmd: ['-config', '/test/config/pebble-config.json'],
+      // Without this Pebble sleeps before validating, for no benefit here.
+      Env: ['PEBBLE_VA_NOSLEEP=1'],
+      HostConfig: {
+        AutoRemove: true,
+        NetworkMode: networkName,
+        Binds: [`${pebbleConfigPath}:/test/config/pebble-config.json:ro`],
+      },
+      NetworkingConfig: {
+        EndpointsConfig: {
+          [networkName]: {
+            IPAMConfig: { IPv4Address: pebbleIp },
+            Aliases: [PEBBLE_HOSTNAME],
+          },
+        },
+      },
+    });
+
+    await pebbleContainer.start();
+
+    homeDir = HomeDir.createTemp();
+
+    container = await createDIContainer({});
+    container.resolve('homeDir').change(homeDir);
+    container.register({
+      legoCaCertificatePath: asValue(
+        path.join(pebbleDir, 'test', 'certs', 'pebble.minica.pem'),
+      ),
+      legoContainerOptions: asValue({
+        HostConfig: {
+          NetworkMode: networkName,
+          // The challenge is served over the test network, so nothing needs to
+          // reach the host - and binding its port 80 would need root.
+          PortBindings: {},
+        },
+        NetworkingConfig: {
+          EndpointsConfig: {
+            [networkName]: { IPAMConfig: { IPv4Address: legoIp } },
+          },
+        },
+      }),
+    });
+
+    config = getBaseConfigFactory(homeDir)();
+    // lego asks for a certificate covering this address, and Pebble connects
+    // back to it to validate - so it has to be the address lego answers on.
+    config.set('externalIp', legoIp);
+    config.set('platform.gateway.ssl.providerConfigs.letsencrypt.email', 'test@dash.org');
+    config.set(
+      'platform.gateway.ssl.providerConfigs.letsencrypt.acmeDirectoryUrl',
+      `https://${PEBBLE_HOSTNAME}:${PEBBLE_ACME_PORT}/dir`,
+    );
+
+    sslDir = homeDir.joinPath(config.getName(), 'platform', 'gateway', 'ssl');
+  });
+
+  after(async () => {
+    if (pebbleContainer) {
+      await pebbleContainer.stop().catch(() => {});
+    }
+
+    if (network) {
+      await network.remove().catch(() => {});
+    }
+
+    if (homeDir) {
+      homeDir.remove();
+    }
+  });
+
+  /**
+   * @param {string} certificatePath
+   * @param {string} keyPath
+   * @return {boolean}
+   */
+  function isMatchingPair(certificatePath, keyPath) {
+    const certificate = new crypto.X509Certificate(fs.readFileSync(certificatePath));
+
+    return certificate.checkPrivateKey(
+      crypto.createPrivateKey(fs.readFileSync(keyPath)),
+    );
+  }
+
+  it('should obtain a certificate for the external IP and install it for the gateway', async () => {
+    const obtainLetsEncryptCertificateTask = container.resolve('obtainLetsEncryptCertificateTask');
+
+    await obtainLetsEncryptCertificateTask(config).run({ force: true });
+
+    const certificatePath = path.join(sslDir, 'bundle.crt');
+    const keyPath = path.join(sslDir, 'private.key');
+
+    expect(fs.existsSync(certificatePath)).to.be.true();
+    expect(fs.existsSync(keyPath)).to.be.true();
+
+    // A certificate and key that do not belong together is the failure the
+    // gateway cannot recover from, and it is invisible in file listings.
+    expect(isMatchingPair(certificatePath, keyPath)).to.be.true();
+
+    // The certificate has to cover the address the node is reached on. Dashmate
+    // passes --disable-cn, so the IP is only ever in the SAN.
+    const certificate = new crypto.X509Certificate(fs.readFileSync(certificatePath));
+    expect(certificate.subjectAltName).to.equal(`IP Address:${legoIp}`);
+
+    // A private key readable by anyone on the host is the regression this
+    // guards - it is not visible in any command output.
+    /* eslint-disable no-bitwise */
+    expect(fs.statSync(keyPath).mode & 0o777).to.equal(0o600);
+    expect(fs.statSync(certificatePath).mode & 0o777).to.equal(0o644);
+    /* eslint-enable no-bitwise */
+
+    // The provider is recorded only once usable files are in place, so a node
+    // never claims SSL it cannot serve.
+    expect(config.get('platform.gateway.ssl.enabled')).to.be.true();
+    expect(config.get('platform.gateway.ssl.provider')).to.equal('letsencrypt');
+
+    // Nothing may be left in the directory the gateway reads.
+    expect(fs.readdirSync(sslDir).filter((f) => f.includes('.tmp-'))).to.have.lengthOf(0);
+  });
+
+  it('should leave an installed certificate and the configuration untouched', async () => {
+    const obtainLetsEncryptCertificateTask = container.resolve('obtainLetsEncryptCertificateTask');
+
+    const certificatePath = path.join(sslDir, 'bundle.crt');
+    const keyPath = path.join(sslDir, 'private.key');
+    const before = {
+      certificate: fs.readFileSync(certificatePath),
+      key: fs.readFileSync(keyPath),
+    };
+
+    // An operator hardening the key further must not have it undone by a
+    // renewal check that had nothing to do.
+    fs.chmodSync(keyPath, 0o400);
+    config.markAsSaved();
+
+    await obtainLetsEncryptCertificateTask(config).run({});
+
+    expect(fs.readFileSync(certificatePath)).to.deep.equal(before.certificate);
+    expect(fs.readFileSync(keyPath)).to.deep.equal(before.key);
+    // eslint-disable-next-line no-bitwise
+    expect(fs.statSync(keyPath).mode & 0o777).to.equal(0o400);
+
+    // Rewriting an unchanged configuration is what made read-only commands
+    // clobber concurrent edits, and a renewal check runs unattended.
+    expect(config.isChanged()).to.be.false();
+  });
+});
diff --git a/packages/dashmate/test/unit/commands/config/mutatingCommands.spec.js b/packages/dashmate/test/unit/commands/config/mutatingCommands.spec.js
new file mode 100644
index 00000000000..58456356826
--- /dev/null
+++ b/packages/dashmate/test/unit/commands/config/mutatingCommands.spec.js
@@ -0,0 +1,361 @@
+import fs from 'fs';
+import path from 'path';
+import writeFileAtomic from 'write-file-atomic';
+import HomeDir from '../../../../src/config/HomeDir.js';
+import ConfigFile from '../../../../src/config/configFile/ConfigFile.js';
+import ConfigFileJsonRepository from '../../../../src/config/configFile/ConfigFileJsonRepository.js';
+import getBaseConfigFactory from '../../../../configs/defaults/getBaseConfigFactory.js';
+import ConfigCreateCommand from '../../../../src/commands/config/create.js';
+import ConfigDefaultCommand from '../../../../src/commands/config/default.js';
+import ConfigRemoveCommand from '../../../../src/commands/config/remove.js';
+
+/**
+ * These commands change the config file as one locked step rather than mutating
+ * the config file they were handed at startup. Two properties matter and are
+ * asserted for each: the change reaches disk, and the object loaded at startup
+ * is left alone - if a command mutated that instead, `BaseCommand.finally()`
+ * would save it afterwards and write a snapshot from before the command ran.
+ */
+describe('Config mutating commands', () => {
+  const flags = {};
+  const noTemplates = () => {};
+
+  let homeDir;
+  let loadedConfigFile;
+  let configFileRepository;
+
+  function reread() {
+    return new ConfigFileJsonRepository((data) => data, homeDir, () => null).read();
+  }
+
+  beforeEach(() => {
+    homeDir = HomeDir.createTemp();
+
+    const configFile = new ConfigFile(
+      [getBaseConfigFactory(homeDir)()],
+      '4.1.0',
+      'abcdef12',
+      'base',
+      null,
+    );
+
+    fs.writeFileSync(
+      homeDir.joinPath('config.json'),
+      `${JSON.stringify(configFile.toObject(), undefined, 2)}\n`,
+      'utf8',
+    );
+
+    configFileRepository = new ConfigFileJsonRepository((data) => data, homeDir, () => null);
+    loadedConfigFile = configFileRepository.read();
+  });
+
+  afterEach(() => {
+    homeDir.remove();
+  });
+
+  describe('config create', () => {
+    it('should save the new config without touching the config file loaded at startup', async () => {
+      const writeConfigTemplates = (config) => {
+        expect(reread().isConfigExists(config.getName())).to.be.true();
+      };
+
+      await new ConfigCreateCommand().runWithDependencies(
+        { config: 'node1', from: 'base' },
+        flags,
+        loadedConfigFile,
+        configFileRepository,
+        writeConfigTemplates,
+        homeDir,
+      );
+
+      expect(reread().isConfigExists('node1')).to.be.true();
+      expect(loadedConfigFile.isConfigExists('node1')).to.be.false();
+      expect(loadedConfigFile.isChanged()).to.be.false();
+    });
+
+    it('should reject absent reserved names without deleting the config file', async () => {
+      const before = fs.readFileSync(homeDir.joinPath('config.json'), 'utf8');
+
+      await Promise.all(['config.json', 'CONFIG.JSON', 'config.json.'].map(async (name) => {
+        await expect(new ConfigRemoveCommand().runWithDependencies(
+          { config: name },
+          flags,
+          loadedConfigFile,
+          { has: () => false },
+          homeDir,
+          configFileRepository,
+        )).to.be.rejectedWith(`Config with name '${name}' is not present`);
+      }));
+
+      expect(fs.existsSync(homeDir.joinPath('config.json'))).to.be.true();
+      expect(fs.readFileSync(homeDir.joinPath('config.json'), 'utf8')).to.equal(before);
+    });
+
+    it('should reject a service directory that is not owned by config.json', async () => {
+      const keyPath = homeDir.joinPath('node1', 'platform', 'gateway', 'ssl', 'private.key');
+
+      fs.mkdirSync(path.dirname(keyPath), { recursive: true });
+      fs.writeFileSync(keyPath, 'interrupted-create-private-key');
+
+      await expect(new ConfigCreateCommand().runWithDependencies(
+        { config: 'node1', from: 'base' },
+        flags,
+        loadedConfigFile,
+        configFileRepository,
+        noTemplates,
+        homeDir,
+      )).to.be.rejectedWith(`Inspect '${homeDir.joinPath('node1')}' and move or delete it manually`);
+
+      expect(reread().isConfigExists('node1')).to.be.false();
+      expect(fs.readFileSync(keyPath, 'utf8')).to.equal('interrupted-create-private-key');
+
+      fs.rmSync(homeDir.joinPath('node1'), { recursive: true });
+
+      expect(fs.existsSync(homeDir.joinPath('node1'))).to.be.false();
+
+      await new ConfigCreateCommand().runWithDependencies(
+        { config: 'node1', from: 'base' },
+        flags,
+        loadedConfigFile,
+        configFileRepository,
+        noTemplates,
+        homeDir,
+      );
+
+      expect(reread().isConfigExists('node1')).to.be.true();
+    });
+
+    it('should reject a portable-name alias after a saved create fails to render', async () => {
+      await expect(new ConfigCreateCommand().runWithDependencies(
+        { config: 'node1', from: 'base' },
+        flags,
+        loadedConfigFile,
+        configFileRepository,
+        () => {
+          throw new Error('template write failed');
+        },
+        homeDir,
+      )).to.be.rejectedWith('template write failed');
+
+      expect(reread().isConfigExists('node1')).to.be.true();
+      expect(fs.existsSync(homeDir.joinPath('node1'))).to.be.false();
+
+      await expect(new ConfigCreateCommand().runWithDependencies(
+        { config: 'NODE1', from: 'base' },
+        flags,
+        loadedConfigFile,
+        configFileRepository,
+        noTemplates,
+        homeDir,
+      )).to.be.rejectedWith("Config with name 'NODE1' already present");
+
+      expect(reread().isConfigExists('NODE1')).to.be.false();
+    });
+  });
+
+  describe('config default', () => {
+    // Pointed at a config that is NOT already the default, so deleting the save
+    // would fail this rather than passing on the starting state.
+    it('should save the new default without touching the config file loaded at startup', async () => {
+      await new ConfigCreateCommand().runWithDependencies(
+        { config: 'node1', from: 'base' },
+        flags,
+        loadedConfigFile,
+        configFileRepository,
+        noTemplates,
+        homeDir,
+      );
+
+      expect(reread().getDefaultConfigName()).to.equal('base');
+
+      await new ConfigDefaultCommand().runWithDependencies(
+        { config: 'node1' },
+        flags,
+        loadedConfigFile,
+        configFileRepository,
+      );
+
+      expect(reread().getDefaultConfigName()).to.equal('node1');
+      expect(loadedConfigFile.getDefaultConfigName()).to.equal('base');
+      expect(loadedConfigFile.isChanged()).to.be.false();
+    });
+  });
+
+  describe('config remove', () => {
+    beforeEach(async () => {
+      await new ConfigCreateCommand().runWithDependencies(
+        { config: 'node1', from: 'base' },
+        flags,
+        loadedConfigFile,
+        configFileRepository,
+        noTemplates,
+        homeDir,
+      );
+
+      fs.mkdirSync(homeDir.joinPath('node1'), { recursive: true });
+    });
+
+    it('should save the removal and then delete the service directory', async () => {
+      await new ConfigRemoveCommand().runWithDependencies(
+        { config: 'node1' },
+        flags,
+        loadedConfigFile,
+        { has: () => false },
+        homeDir,
+        configFileRepository,
+      );
+
+      expect(reread().isConfigExists('node1')).to.be.false();
+      expect(fs.existsSync(homeDir.joinPath('node1'))).to.be.false();
+    });
+
+    it('should keep private files live until the removal is durable', async function it() {
+      const keyPath = homeDir.joinPath('node1', 'platform', 'gateway', 'ssl', 'private.key');
+
+      fs.mkdirSync(path.dirname(keyPath), { recursive: true });
+      fs.writeFileSync(keyPath, 'previous-node-private-key');
+
+      this.sinon.stub(writeFileAtomic, 'sync').callsFake(() => {
+        expect(fs.readFileSync(keyPath, 'utf8')).to.equal('previous-node-private-key');
+
+        throw new Error('write failed');
+      });
+
+      await expect(new ConfigRemoveCommand().runWithDependencies(
+        { config: 'node1' },
+        flags,
+        loadedConfigFile,
+        { has: () => false },
+        homeDir,
+        configFileRepository,
+      )).to.be.rejectedWith('write failed');
+
+      expect(reread().isConfigExists('node1')).to.be.true();
+      expect(fs.readFileSync(keyPath, 'utf8')).to.equal('previous-node-private-key');
+    });
+
+    it('should preserve an orphan after removal until the operator clears it', async function it() {
+      const keyPath = homeDir.joinPath('node1', 'platform', 'gateway', 'ssl', 'private.key');
+
+      fs.mkdirSync(path.dirname(keyPath), { recursive: true });
+      fs.writeFileSync(keyPath, 'previous-node-private-key');
+
+      const rmSync = this.sinon.stub(fs, 'rmSync');
+      rmSync.onFirstCall().throws(new Error('directory is busy'));
+      rmSync.callThrough();
+
+      await expect(new ConfigRemoveCommand().runWithDependencies(
+        { config: 'node1' },
+        flags,
+        loadedConfigFile,
+        { has: () => false },
+        homeDir,
+        configFileRepository,
+      )).to.be.rejectedWith('directory is busy');
+
+      expect(reread().isConfigExists('node1')).to.be.false();
+      expect(fs.existsSync(homeDir.joinPath('node1'))).to.be.true();
+
+      await expect(new ConfigRemoveCommand().runWithDependencies(
+        { config: 'node1' },
+        flags,
+        loadedConfigFile,
+        { has: () => false },
+        homeDir,
+        configFileRepository,
+      )).to.be.rejectedWith("Config with name 'node1' is not present");
+
+      expect(reread().isConfigExists('node1')).to.be.false();
+      expect(fs.readFileSync(keyPath, 'utf8')).to.equal('previous-node-private-key');
+    });
+
+    it('should not remove a differently-cased listed config or its private files', async () => {
+      const keyPath = homeDir.joinPath('node1', 'platform', 'gateway', 'ssl', 'private.key');
+
+      fs.mkdirSync(path.dirname(keyPath), { recursive: true });
+      fs.writeFileSync(keyPath, 'listed-node-private-key');
+
+      await expect(new ConfigRemoveCommand().runWithDependencies(
+        { config: 'NODE1' },
+        flags,
+        loadedConfigFile,
+        { has: () => false },
+        homeDir,
+        configFileRepository,
+      )).to.be.rejectedWith("Config with name 'NODE1' is not present");
+
+      expect(reread().isConfigExists('node1')).to.be.true();
+      expect(fs.readFileSync(keyPath, 'utf8')).to.equal('listed-node-private-key');
+    });
+
+    it('should preserve service files used by a surviving portable-name alias', async () => {
+      const configFilePath = homeDir.joinPath('config.json');
+      const data = JSON.parse(fs.readFileSync(configFilePath, 'utf8'));
+      const keyPath = homeDir.joinPath('node1', 'platform', 'gateway', 'ssl', 'private.key');
+
+      data.configs.NODE1 = data.configs.node1;
+      fs.writeFileSync(configFilePath, `${JSON.stringify(data, undefined, 2)}\n`, 'utf8');
+      fs.mkdirSync(path.dirname(keyPath), { recursive: true });
+      fs.writeFileSync(keyPath, 'shared-node-private-key');
+
+      await new ConfigRemoveCommand().runWithDependencies(
+        { config: 'node1' },
+        flags,
+        loadedConfigFile,
+        { has: () => false },
+        homeDir,
+        configFileRepository,
+      );
+
+      expect(reread().isConfigExists('node1')).to.be.false();
+      expect(reread().isConfigExists('NODE1')).to.be.true();
+      expect(fs.readFileSync(keyPath, 'utf8')).to.equal('shared-node-private-key');
+    });
+
+    it('should not delete config.json when it appears immediately before the locked read', async function it() {
+      const configFilePath = homeDir.joinPath('config.json');
+      const configFileJson = fs.readFileSync(configFilePath, 'utf8');
+      const update = configFileRepository.update.bind(configFileRepository);
+
+      fs.rmSync(configFilePath);
+      this.sinon.stub(configFileRepository, 'update').callsFake((...args) => {
+        fs.writeFileSync(configFilePath, configFileJson, 'utf8');
+
+        return update(...args);
+      });
+
+      await expect(new ConfigRemoveCommand().runWithDependencies(
+        { config: 'config.json' },
+        flags,
+        loadedConfigFile,
+        { has: () => false },
+        homeDir,
+        configFileRepository,
+      )).to.be.rejectedWith("Config with name 'config.json' is not present");
+
+      expect(fs.existsSync(configFilePath)).to.be.true();
+      expect(reread().isConfigExists('node1')).to.be.true();
+    });
+
+    it('should remove a listed legacy reserved name without deleting repository files', async () => {
+      const configFilePath = homeDir.joinPath('config.json');
+      const data = JSON.parse(fs.readFileSync(configFilePath, 'utf8'));
+
+      data.configs['config.json'] = data.configs.node1;
+      fs.writeFileSync(configFilePath, `${JSON.stringify(data, undefined, 2)}\n`, 'utf8');
+
+      await new ConfigRemoveCommand().runWithDependencies(
+        { config: 'config.json' },
+        flags,
+        loadedConfigFile,
+        { has: () => false },
+        homeDir,
+        configFileRepository,
+      );
+
+      expect(fs.existsSync(configFilePath)).to.be.true();
+      expect(reread().isConfigExists('config.json')).to.be.false();
+      expect(reread().isConfigExists('node1')).to.be.true();
+    });
+  });
+});
diff --git a/packages/dashmate/test/unit/commands/config/render.spec.js b/packages/dashmate/test/unit/commands/config/render.spec.js
index 00bd91e6fc0..32efe77d7bc 100644
--- a/packages/dashmate/test/unit/commands/config/render.spec.js
+++ b/packages/dashmate/test/unit/commands/config/render.spec.js
@@ -1,14 +1,20 @@
+import fs from 'fs';
 import HomeDir from '../../../../src/config/HomeDir.js';
+import ConfigFile from '../../../../src/config/configFile/ConfigFile.js';
+import ConfigFileJsonRepository from '../../../../src/config/configFile/ConfigFileJsonRepository.js';
 import getBaseConfigFactory from '../../../../configs/defaults/getBaseConfigFactory.js';
 import ConfigRenderCommand from '../../../../src/commands/config/render.js';
+import writeServiceConfigsFactory from '../../../../src/templates/writeServiceConfigsFactory.js';
 
 describe('Config render command', () => {
   let config;
+  let homeDir;
   let mockRenderServiceTemplates;
   let mockWriteServiceConfigs;
 
   beforeEach(async function it() {
-    const getBaseConfig = getBaseConfigFactory(HomeDir.createTemp());
+    homeDir = HomeDir.createTemp();
+    const getBaseConfig = getBaseConfigFactory(homeDir);
 
     mockWriteServiceConfigs = this.sinon.stub();
     mockRenderServiceTemplates = this.sinon.stub();
@@ -16,6 +22,10 @@ describe('Config render command', () => {
     config = getBaseConfig();
   });
 
+  afterEach(() => {
+    homeDir.remove();
+  });
+
   it('should call render and write', async () => {
     const command = new ConfigRenderCommand();
 
@@ -30,4 +40,55 @@ describe('Config render command', () => {
     expect(mockRenderServiceTemplates).to.have.been.calledOnceWithExactly(config);
     expect(mockWriteServiceConfigs).to.have.been.calledOnceWith(config.getName());
   });
+
+  it('should repair stale service files from the saved config', async () => {
+    const configFile = new ConfigFile(
+      [config],
+      '4.1.0',
+      'abcdef12',
+      'base',
+      null,
+    );
+    const configFilePath = homeDir.joinPath('config.json');
+    const renderedPath = homeDir.joinPath('base', 'rendered.txt');
+
+    fs.writeFileSync(
+      configFilePath,
+      `${JSON.stringify(configFile.toObject(), undefined, 2)}\n`,
+      'utf8',
+    );
+    fs.mkdirSync(homeDir.joinPath('base'), { recursive: true });
+    fs.writeFileSync(renderedPath, 'stale value', 'utf8');
+
+    const repository = new ConfigFileJsonRepository(
+      (data) => data,
+      homeDir,
+      () => configFile,
+    );
+
+    expect(() => repository.update((freshConfigFile) => {
+      freshConfigFile.getConfig('base').set('description', 'saved value');
+    }, {
+      onSaved: () => {
+        throw new Error('template write failed');
+      },
+    })).to.throw('template write failed');
+
+    expect(fs.readFileSync(renderedPath, 'utf8')).to.equal('stale value');
+
+    const savedConfig = repository.read().getConfig('base');
+    const renderServiceTemplates = (renderedConfig) => ({
+      'rendered.txt': renderedConfig.get('description'),
+    });
+
+    await new ConfigRenderCommand().runWithDependencies(
+      {},
+      {},
+      savedConfig,
+      renderServiceTemplates,
+      writeServiceConfigsFactory(homeDir),
+    );
+
+    expect(fs.readFileSync(renderedPath, 'utf8')).to.equal('saved value');
+  });
 });
diff --git a/packages/dashmate/test/unit/commands/config/set.spec.js b/packages/dashmate/test/unit/commands/config/set.spec.js
index 67b8bef75a3..1ccef1ee4c4 100644
--- a/packages/dashmate/test/unit/commands/config/set.spec.js
+++ b/packages/dashmate/test/unit/commands/config/set.spec.js
@@ -1,104 +1,127 @@
+import fs from 'fs';
 import HomeDir from '../../../../src/config/HomeDir.js';
 import ConfigSetCommand from '../../../../src/commands/config/set.js';
+import ConfigFile from '../../../../src/config/configFile/ConfigFile.js';
+import ConfigFileJsonRepository from '../../../../src/config/configFile/ConfigFileJsonRepository.js';
 import getBaseConfigFactory from '../../../../configs/defaults/getBaseConfigFactory.js';
 
 describe('Config set command', () => {
   const flags = {};
 
+  let homeDir;
   let config;
+  let configFileRepository;
+  let writeConfigTemplates;
+  let command;
+
+  /**
+   * The command now reads, changes and saves in one locked step rather than
+   * mutating the object it was handed, so these assert what actually reached
+   * disk. Reading it back is the only thing that proves the value was saved.
+   *
+   * @param {string} path
+   * @return {*}
+   */
+  function persisted(path) {
+    return new ConfigFileJsonRepository((data) => data, homeDir, () => null)
+      .read()
+      .getConfig('base')
+      .get(path);
+  }
+
+  beforeEach(() => {
+    homeDir = HomeDir.createTemp();
+
+    config = getBaseConfigFactory(homeDir)();
+
+    const configFile = new ConfigFile([config], '4.1.0', 'abcdef12', 'base', null);
+
+    fs.writeFileSync(
+      homeDir.joinPath('config.json'),
+      `${JSON.stringify(configFile.toObject(), undefined, 2)}\n`,
+      'utf8',
+    );
+
+    configFileRepository = new ConfigFileJsonRepository((data) => data, homeDir, () => null);
+    writeConfigTemplates = () => {};
+    command = new ConfigSetCommand();
+  });
 
-  beforeEach(async () => {
-    const getBaseConfig = getBaseConfigFactory(HomeDir.createTemp());
-
-    config = getBaseConfig();
+  afterEach(() => {
+    homeDir.remove();
   });
 
+  /**
+   * @param {string} option
+   * @param {*} value
+   */
+  function run(option, value) {
+    return command.runWithDependencies(
+      { option, value },
+      flags,
+      config,
+      configFileRepository,
+      writeConfigTemplates,
+    );
+  }
+
   describe('#platform', () => {
     it('should allow setting strings', async () => {
-      const command = new ConfigSetCommand();
+      writeConfigTemplates = (renderedConfig) => {
+        expect(persisted('core.docker.image'))
+          .to.equal(renderedConfig.get('core.docker.image'));
+      };
+
+      await run('core.docker.image', 'fake_image');
 
-      await command.runWithDependencies({
-        option: 'core.docker.image', value: 'fake_image',
-      }, flags, config);
+      expect(persisted('core.docker.image')).to.equal('fake_image');
     });
 
     it('should allow setting null', async () => {
-      const command = new ConfigSetCommand();
+      await run('description', null);
 
-      await command.runWithDependencies({
-        option: 'description', value: null,
-      }, flags, config);
+      expect(persisted('description')).to.equal(null);
 
-      expect(config.get('description')).to.equal(null);
+      await run('description', 'null');
 
-      await command.runWithDependencies({
-        option: 'description', value: 'null',
-      }, flags, config);
-
-      expect(config.get('description')).to.equal(null);
+      expect(persisted('description')).to.equal(null);
     });
 
     it('should allow setting numbers', async () => {
-      const command = new ConfigSetCommand();
-
-      await command.runWithDependencies({
-        option: 'platform.drive.abci.validatorSet.quorum.llmqType',
-        value: 107,
-      }, flags, config);
+      await run('platform.drive.abci.validatorSet.quorum.llmqType', 107);
 
-      expect(config.get('platform.drive.abci.validatorSet.quorum.llmqType')).to.equal(107);
+      expect(persisted('platform.drive.abci.validatorSet.quorum.llmqType')).to.equal(107);
 
-      await command.runWithDependencies({
-        option: 'platform.drive.abci.validatorSet.quorum.llmqType',
-        value: '107',
-      }, flags, config);
+      await run('platform.drive.abci.validatorSet.quorum.llmqType', '107');
 
-      expect(config.get('platform.drive.abci.validatorSet.quorum.llmqType')).to.equal(107);
+      expect(persisted('platform.drive.abci.validatorSet.quorum.llmqType')).to.equal(107);
     });
 
     it('should allow setting booleans', async () => {
-      const command = new ConfigSetCommand();
+      await run('dashmate.helper.api.enable', 'true');
 
-      await command.runWithDependencies({
-        option: 'dashmate.helper.api.enable', value: 'true',
-      }, flags, config);
+      expect(persisted('dashmate.helper.api.enable')).to.equal(true);
 
-      expect(config.get('dashmate.helper.api.enable')).to.equal(true);
+      await run('dashmate.helper.api.enable', true);
 
-      await command.runWithDependencies({
-        option: 'dashmate.helper.api.enable', value: true,
-      }, flags, config);
-
-      expect(config.get('dashmate.helper.api.enable')).to.equal(true);
+      expect(persisted('dashmate.helper.api.enable')).to.equal(true);
     });
 
     it('should allow setting array of values', async () => {
-      const command = new ConfigSetCommand();
-
-      await command.runWithDependencies({
-        option: 'core.rpc.allowIps', value: '["1337", "36484"]',
-      }, flags, config);
+      await run('core.rpc.allowIps', '["1337", "36484"]');
 
-      expect(config.get('core.rpc.allowIps')).to.deep.equal(['1337', '36484']);
+      expect(persisted('core.rpc.allowIps')).to.deep.equal(['1337', '36484']);
     });
 
     it('should allow replacing part of the json', async () => {
-      const command = new ConfigSetCommand();
+      await run('docker.network', '{"subnet":"127.0.0.1/24"}');
 
-      await command.runWithDependencies({
-        option: 'docker.network',
-        value: '{"subnet":"127.0.0.1/24"}',
-      }, flags, config);
+      expect(persisted('docker.network.subnet')).to.equal('127.0.0.1/24');
     });
 
     it('should throw on unknown path', async () => {
-      const command = new ConfigSetCommand();
-
-      // invalid path
       try {
-        await command.runWithDependencies({
-          option: 'fakePath', value: 'fake',
-        }, flags, config);
+        await run('fakePath', 'fake');
 
         expect.fail('should throw error');
       } catch (e) {
@@ -107,13 +130,8 @@ describe('Config set command', () => {
     });
 
     it('should throw if invalid json is passed', async () => {
-      const command = new ConfigSetCommand();
-
-      // invalid json
       try {
-        await command.runWithDependencies({
-          option: 'core.rpc.allowIps', value: 'fake_image',
-        }, flags, config);
+        await run('core.rpc.allowIps', 'fake_image');
 
         expect.fail('should throw error');
       } catch (e) {
@@ -122,18 +140,22 @@ describe('Config set command', () => {
     });
 
     it('should throw on type mismatch', async () => {
-      const command = new ConfigSetCommand();
-
-      // invalid json
       try {
-        await command.runWithDependencies({
-          option: 'dashmate.helper.api.enable', value: 120,
-        }, flags, config);
+        await run('dashmate.helper.api.enable', 120);
 
         expect.fail('should throw error');
       } catch (e) {
         expect(e.name).to.equal('InvalidOptionError');
       }
     });
+
+    // A rejected set must leave the file exactly as it was, not half-applied.
+    it('should not change the file when the value is rejected', async () => {
+      const before = fs.readFileSync(homeDir.joinPath('config.json'), 'utf8');
+
+      await run('dashmate.helper.api.enable', 120).catch(() => {});
+
+      expect(fs.readFileSync(homeDir.joinPath('config.json'), 'utf8')).to.equal(before);
+    });
   });
 });
diff --git a/packages/dashmate/test/unit/commands/configurationLockCoverage.spec.js b/packages/dashmate/test/unit/commands/configurationLockCoverage.spec.js
new file mode 100644
index 00000000000..4d9d207d094
--- /dev/null
+++ b/packages/dashmate/test/unit/commands/configurationLockCoverage.spec.js
@@ -0,0 +1,23 @@
+import SetupCommand from '../../../src/commands/setup.js';
+import ResetCommand from '../../../src/commands/reset.js';
+import GroupResetCommand from '../../../src/commands/group/reset.js';
+import ObtainCommand from '../../../src/commands/ssl/obtain.js';
+import ConfigRenderCommand from '../../../src/commands/config/render.js';
+import ReindexCommand from '../../../src/commands/core/reindex.js';
+import GroupReindexCommand from '../../../src/commands/group/core/reindex.js';
+
+describe('Commands that write rendered configuration', () => {
+  [
+    ['setup', SetupCommand],
+    ['reset', ResetCommand],
+    ['group reset', GroupResetCommand],
+    ['ssl obtain', ObtainCommand],
+    ['config render', ConfigRenderCommand],
+    ['core reindex', ReindexCommand],
+    ['group core reindex', GroupReindexCommand],
+  ].forEach(([name, Command]) => {
+    it(`should hold the configuration lock for ${name}`, () => {
+      expect(Command.mutatesConfig).to.be.true();
+    });
+  });
+});
diff --git a/packages/dashmate/test/unit/commands/ssl/obtain.spec.js b/packages/dashmate/test/unit/commands/ssl/obtain.spec.js
new file mode 100644
index 00000000000..c1a64b0edf1
--- /dev/null
+++ b/packages/dashmate/test/unit/commands/ssl/obtain.spec.js
@@ -0,0 +1,42 @@
+import { Listr } from 'listr2';
+import ObtainCommand from '../../../../src/commands/ssl/obtain.js';
+
+describe('SSL obtain command', () => {
+  it('should checkpoint a newly created ZeroSSL certificate before a later failure', async function it() {
+    const config = {
+      get: this.sinon.stub().returns('zerossl'),
+    };
+    const configFile = {};
+    const configFileRepository = {
+      write: this.sinon.stub(),
+    };
+    const obtainZeroSSLCertificateTask = this.sinon.stub()
+      .callsFake((taskConfig, { onCertificateCreated }) => new Listr([
+        {
+          task: async () => {
+            onCertificateCreated();
+            throw new Error('verification failed');
+          },
+        },
+      ]));
+
+    await expect(new ObtainCommand().runWithDependencies(
+      {},
+      {
+        verbose: false,
+        'no-retry': true,
+        'expiration-days': undefined,
+        force: false,
+        provider: 'zerossl',
+      },
+      config,
+      obtainZeroSSLCertificateTask,
+      this.sinon.stub(),
+      configFileRepository,
+      configFile,
+    )).to.be.rejected();
+
+    expect(obtainZeroSSLCertificateTask).to.have.been.calledOnce();
+    expect(configFileRepository.write).to.have.been.calledOnceWith(configFile);
+  });
+});
diff --git a/packages/dashmate/test/unit/config/Config.spec.js b/packages/dashmate/test/unit/config/Config.spec.js
index b5d652dd678..13705cf2286 100644
--- a/packages/dashmate/test/unit/config/Config.spec.js
+++ b/packages/dashmate/test/unit/config/Config.spec.js
@@ -13,6 +13,43 @@ describe('Config', () => {
     });
   });
 
+  describe('change tracking', () => {
+    let storedOptions;
+
+    beforeEach(() => {
+      storedOptions = getBaseConfigFactory(HomeDir.createTemp())().getStoredOptions();
+    });
+
+    // Loading a config off disk is not an edit to it. When hydration marks a
+    // config dirty, every command - including pure readers like `config get` -
+    // persists the whole config file on exit, and a slow reader can write its
+    // stale snapshot over a concurrent `config set`.
+    it('should not consider a freshly hydrated config changed', () => {
+      const config = new Config('testnet', storedOptions);
+
+      expect(config.isChanged()).to.be.false();
+    });
+
+    it('should consider a config changed after set()', () => {
+      const config = new Config('testnet', storedOptions);
+
+      config.set('description', 'changed');
+
+      expect(config.isChanged()).to.be.true();
+    });
+
+    // setOptions() is a genuine mutation when called on an existing config
+    // (resetNodeTaskFactory restores defaults through it), so only the
+    // constructor's initial hydration is exempt.
+    it('should consider a config changed after setOptions() post-construction', () => {
+      const config = new Config('testnet', storedOptions);
+
+      config.setOptions(storedOptions);
+
+      expect(config.isChanged()).to.be.true();
+    });
+  });
+
   describe('.isSchemaPathAllowed', () => {
     // The bug that triggered this method: `dashmate config set
     // platform.drive.abci.docker.build.buildArgs.SDK_TEST_DATA true`
diff --git a/packages/dashmate/test/unit/config/configFile/ConfigFileJsonRepository.spec.js b/packages/dashmate/test/unit/config/configFile/ConfigFileJsonRepository.spec.js
new file mode 100644
index 00000000000..1e3f84fdf50
--- /dev/null
+++ b/packages/dashmate/test/unit/config/configFile/ConfigFileJsonRepository.spec.js
@@ -0,0 +1,803 @@
+import fs from 'fs';
+import { spawn } from 'child_process';
+import { expect } from 'chai';
+import HomeDir from '../../../../src/config/HomeDir.js';
+import getBaseConfigFactory from '../../../../configs/defaults/getBaseConfigFactory.js';
+import ConfigFile from '../../../../src/config/configFile/ConfigFile.js';
+import ConfigFileJsonRepository from '../../../../src/config/configFile/ConfigFileJsonRepository.js';
+
+const CURRENT_FORMAT_VERSION = '4.1.0';
+
+describe('ConfigFileJsonRepository', () => {
+  let homeDir;
+  let configFilePath;
+  let identityMigration;
+  let createDefaults;
+  // Tracked so a failed assertion cannot leave a spawned lock holder behind
+  // still owning the lock directory after the test that created it is gone.
+  let lockHolder;
+
+  /**
+   * Seed a valid config file on disk, the way a configured node would have one.
+   *
+   * @return {string} the JSON written
+   */
+  function seedConfigFile() {
+    const baseConfig = getBaseConfigFactory(homeDir)();
+
+    const configFile = new ConfigFile(
+      [baseConfig],
+      CURRENT_FORMAT_VERSION,
+      'abcdef12',
+      'base',
+      null,
+    );
+
+    const json = `${JSON.stringify(configFile.toObject(), undefined, 2)}\n`;
+
+    fs.writeFileSync(configFilePath, json, 'utf8');
+
+    return json;
+  }
+
+  beforeEach(() => {
+    homeDir = HomeDir.createTemp();
+    configFilePath = homeDir.joinPath('config.json');
+    identityMigration = (data) => data;
+    createDefaults = () => {
+      const configFile = new ConfigFile(
+        [getBaseConfigFactory(homeDir)()],
+        CURRENT_FORMAT_VERSION,
+        'abcdef12',
+        'base',
+        null,
+      );
+
+      configFile.markAsChanged();
+
+      return configFile;
+    };
+  });
+
+  afterEach(() => {
+    if (lockHolder && lockHolder.exitCode === null && lockHolder.signalCode === null) {
+      lockHolder.kill();
+    }
+
+    lockHolder = undefined;
+
+    homeDir.remove();
+  });
+
+  describe('#read', () => {
+    // A load is not an edit. If hydration leaves the file dirty, BaseCommand
+    // persists it on exit even for `config get`, which is what lets a slow
+    // reader overwrite a concurrent `config set`.
+    it('should return a clean config file when nothing was migrated', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+
+      const configFile = repository.read();
+
+      expect(configFile.isChanged()).to.be.false();
+      expect(configFile.getAllConfigs().filter((config) => config.isChanged())).to.be.empty();
+    });
+
+    it('should return a changed config file when it was migrated', () => {
+      seedConfigFile();
+
+      const migration = (data) => ({ ...data, configFormatVersion: '9.9.9' });
+
+      const repository = new ConfigFileJsonRepository(migration, homeDir, createDefaults);
+
+      const configFile = repository.read();
+
+      expect(configFile.isChanged()).to.be.true();
+      expect(configFile.getAllConfigs().every((config) => config.isChanged())).to.be.true();
+    });
+
+    it('should not require a write after an unchanged read', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+      const { mtimeMs, ino } = fs.statSync(configFilePath);
+
+      const configFile = repository.read();
+
+      if (configFile.isChanged()) {
+        repository.write(configFile);
+      }
+
+      const after = fs.statSync(configFilePath);
+
+      expect(after.mtimeMs).to.equal(mtimeMs);
+      expect(after.ino).to.equal(ino);
+    });
+
+    // A name Dashmate would refuse to create today may already be in a config
+    // file written before the rule existed. Refusing to load the collection
+    // would leave no way to run the command that removes the entry.
+    it('should still load a persisted config whose name would be refused today', () => {
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+
+      for (const name of ['config.json.lock', 'CONFIG.JSON', 'config.json.']) {
+        seedConfigFile();
+
+        const data = JSON.parse(fs.readFileSync(configFilePath, 'utf8'));
+        data.configs[name] = data.configs.base;
+        fs.writeFileSync(configFilePath, `${JSON.stringify(data, undefined, 2)}\n`, 'utf8');
+
+        expect(() => repository.read(), name).to.not.throw();
+        expect(repository.read().isConfigExists(name), name).to.be.true();
+      }
+    });
+
+    it('should scope a validation bypass to the configs selected by its predicate', () => {
+      seedConfigFile();
+
+      const data = JSON.parse(fs.readFileSync(configFilePath, 'utf8'));
+      const validNetwork = data.configs.base.network;
+      data.configs.base.network = 'invalid';
+      data.configs.node1 = { ...data.configs.base, network: validNetwork };
+      fs.writeFileSync(configFilePath, `${JSON.stringify(data, undefined, 2)}\n`, 'utf8');
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+      const skipBaseValidation = ({ name }) => name === 'base';
+      const configFile = repository.read({ skipValidation: skipBaseValidation });
+
+      expect(configFile.getConfig('base').getStored('network')).to.equal('invalid');
+
+      data.configs.node1.network = 'invalid';
+      fs.writeFileSync(configFilePath, `${JSON.stringify(data, undefined, 2)}\n`, 'utf8');
+
+      expect(() => repository.read({ skipValidation: skipBaseValidation }))
+        .to.throw('network must be equal to one of the allowed values');
+    });
+  });
+
+  describe('#write', () => {
+    it('should persist changes while keeping configs dirty until templates are rendered', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+      const configFile = repository.read();
+
+      configFile.getConfig('base').set('description', 'changed');
+
+      repository.write(configFile);
+
+      expect(configFile.changed).to.be.false();
+      expect(configFile.getConfig('base').isChanged()).to.be.true();
+
+      const reread = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults).read();
+
+      expect(reread.getConfig('base').get('description')).to.equal('changed');
+    });
+
+    it('should preserve the file mode, valid JSON and trailing newline, and leave no temp files', () => {
+      seedConfigFile();
+      fs.chmodSync(configFilePath, 0o600);
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+      const configFile = repository.read();
+
+      configFile.getConfig('base').set('description', 'changed');
+
+      repository.write(configFile);
+
+      const raw = fs.readFileSync(configFilePath, 'utf8');
+
+      // eslint-disable-next-line no-bitwise
+      expect(fs.statSync(configFilePath).mode & 0o777).to.equal(0o600);
+      expect(raw.endsWith('}\n')).to.be.true();
+      expect(() => JSON.parse(raw)).to.not.throw();
+      expect(fs.readdirSync(homeDir.getPath()).filter((n) => n !== 'config.json')).to.be.empty();
+    });
+
+    // A caller holding the command-length lock may save multiple checkpoints
+    // through the same repository instance.
+    it('should allow repeated writes from one long-lived instance', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+      const configFile = repository.read();
+
+      configFile.getConfig('base').set('description', 'first');
+      repository.write(configFile);
+
+      configFile.getConfig('base').set('description', 'second');
+
+      expect(() => repository.write(configFile)).to.not.throw();
+
+      const reread = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults).read();
+
+      expect(reread.getConfig('base').get('description')).to.equal('second');
+    });
+  });
+
+  describe('#update', () => {
+    it('should render and save a migration while holding the lock', () => {
+      seedConfigFile();
+
+      const migration = (data) => ({ ...data, configFormatVersion: '9.9.9' });
+      const repository = new ConfigFileJsonRepository(migration, homeDir, createDefaults);
+      let renderedWhileLocked = false;
+
+      let migrated;
+      const result = repository.readAndMigrate({}, (migratedConfigs) => {
+        migrated = migratedConfigs;
+        renderedWhileLocked = fs.existsSync(homeDir.joinPath('.config.json.lock'));
+        expect(JSON.parse(fs.readFileSync(configFilePath, 'utf8')).configFormatVersion)
+          .to.equal(CURRENT_FORMAT_VERSION);
+      });
+      const { configFile } = result;
+
+      expect(configFile.getConfigFormatVersion()).to.equal('9.9.9');
+      expect(migrated).to.have.length(1);
+      expect(result).to.not.have.property('migrated');
+      expect(renderedWhileLocked).to.be.true();
+      expect(JSON.parse(fs.readFileSync(configFilePath, 'utf8')).configFormatVersion)
+        .to.equal('9.9.9');
+    });
+
+    // Migrations are not all pure - one moves TLS files and deletes the
+    // originals - so deciding whether one is due must not run them. Running
+    // them to find out would do that work outside the lock, where another
+    // command reconfiguring the node is free to be doing the same.
+    it('should decide a migration is due without running any migration', () => {
+      seedConfigFile();
+
+      let migrationRuns = 0;
+      const countingMigration = (data) => {
+        migrationRuns += 1;
+
+        return data;
+      };
+
+      const repository = new ConfigFileJsonRepository(
+        countingMigration,
+        homeDir,
+        createDefaults,
+        CURRENT_FORMAT_VERSION,
+      );
+
+      repository.readAndMigrate();
+
+      // One read, inside no lock, because the recorded version is current.
+      expect(migrationRuns).to.equal(1);
+      expect(fs.existsSync(homeDir.joinPath('.config.json.lock'))).to.be.false();
+    });
+
+    it('should retry migration rendering when the first render fails', () => {
+      seedConfigFile();
+
+      const migration = (data) => ({ ...data, configFormatVersion: '9.9.9' });
+      const repository = new ConfigFileJsonRepository(migration, homeDir, createDefaults);
+
+      expect(() => repository.readAndMigrate({}, () => {
+        throw new Error('template write failed');
+      })).to.throw('template write failed');
+
+      expect(JSON.parse(fs.readFileSync(configFilePath, 'utf8')).configFormatVersion)
+        .to.equal(CURRENT_FORMAT_VERSION);
+
+      let retried = false;
+      repository.readAndMigrate({}, () => {
+        retried = true;
+      });
+
+      expect(retried).to.be.true();
+      expect(JSON.parse(fs.readFileSync(configFilePath, 'utf8')).configFormatVersion)
+        .to.equal('9.9.9');
+    });
+
+    it('should not wait for a lock when reading does not migrate', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults, CURRENT_FORMAT_VERSION, {
+        acquireTimeout: 50,
+      });
+      const lockPath = homeDir.joinPath('.config.json.lock');
+
+      fs.mkdirSync(lockPath);
+
+      try {
+        expect(() => repository.readAndMigrate()).to.not.throw();
+      } finally {
+        fs.rmdirSync(lockPath);
+      }
+    });
+
+    it('should reuse a command-held lock when reading and saving a migration', () => {
+      seedConfigFile();
+
+      const migration = (data) => ({ ...data, configFormatVersion: '9.9.9' });
+      const repository = new ConfigFileJsonRepository(migration, homeDir, createDefaults);
+      let renderedWhileLocked = false;
+
+      repository.acquire();
+
+      try {
+        repository.readAndMigrate({}, () => {
+          renderedWhileLocked = fs.existsSync(homeDir.joinPath('.config.json.lock'));
+        });
+      } finally {
+        repository.release();
+      }
+
+      expect(renderedWhileLocked).to.be.true();
+    });
+
+    // JSON is the authoritative state. If rendering fails after it is saved,
+    // service files remain stale until the operator explicitly renders them.
+    it('should keep the saved config when rendering service files fails', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+
+      expect(() => repository.update((configFile) => {
+        configFile.getConfig('base').set('description', 'saved-before-render');
+      }, {
+        onSaved: () => {
+          throw new Error('template write failed');
+        },
+      })).to.throw('template write failed');
+
+      expect(repository.read().getConfig('base').get('description')).to.equal('saved-before-render');
+    });
+
+    it('should render service files after the change reaches disk', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+
+      let onDiskWhenRendering;
+
+      repository.update((configFile) => {
+        configFile.getConfig('base').set('description', 'saved-first');
+      }, {
+        onSaved: () => {
+          onDiskWhenRendering = JSON.parse(fs.readFileSync(configFilePath, 'utf8'))
+            .configs.base.description;
+        },
+      });
+
+      expect(onDiskWhenRendering).to.equal('saved-first');
+      expect(repository.read().getConfig('base').get('description')).to.equal('saved-first');
+    });
+
+    it('should keep repository locks outside the config-name namespace', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+
+      repository.update((configFile) => {
+        configFile.getConfig('base').set('description', 'changed');
+      }, {
+        onSaved: () => {
+          expect(fs.existsSync(homeDir.joinPath('.config.json.lock'))).to.be.true();
+          expect(fs.existsSync(homeDir.joinPath('config.json.lock'))).to.be.false();
+        },
+      });
+    });
+
+    it('should run onSaved after saving and while still holding the lock', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+
+      let sawOnDisk;
+      let heldLock;
+
+      repository.update((configFile) => {
+        configFile.getConfig('base').set('description', 'saved-then-observed');
+      }, {
+        onSaved: () => {
+          sawOnDisk = JSON.parse(fs.readFileSync(configFilePath, 'utf8'))
+            .configs.base.description;
+          heldLock = fs.existsSync(homeDir.joinPath('.config.json.lock'));
+        },
+      });
+
+      expect(sawOnDisk).to.equal('saved-then-observed');
+      expect(heldLock, 'lock should still be held while onSaved runs').to.be.true();
+    });
+
+    it('should release the lock but keep the saved JSON when onSaved throws', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+
+      expect(() => repository.update((configFile) => {
+        configFile.getConfig('base').set('description', 'committed-before-hook');
+      }, {
+        onSaved: () => {
+          throw new Error('template write failed');
+        },
+      })).to.throw('template write failed');
+
+      expect(fs.existsSync(homeDir.joinPath('.config.json.lock'))).to.be.false();
+      expect(repository.read().getConfig('base').get('description'))
+        .to.equal('committed-before-hook');
+    });
+
+    // On a machine with no config file yet, the change still has to land -
+    // reading first and failing would break `config create` on first run.
+    it('should create the config file when there is none yet', () => {
+      expect(fs.existsSync(configFilePath)).to.be.false();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+
+      repository.update((configFile) => {
+        configFile.getConfig('base').set('description', 'created-on-first-run');
+      });
+
+      expect(fs.existsSync(configFilePath)).to.be.true();
+
+      const reread = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults).read();
+
+      expect(reread.getConfig('base').get('description')).to.equal('created-on-first-run');
+    });
+
+    // The reported bug, stated as the outcome operators want rather than as a
+    // failure they have to recover from: one process loads the config, another
+    // changes and saves a different option, and both edits survive. Mutating a
+    // snapshot loaded earlier and saving it at exit loses one of them.
+    it('should keep concurrent edits to different options', () => {
+      seedConfigFile();
+
+      const slowCommand = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+      const otherCommand = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+
+      // Both load the same starting state, as two overlapping commands would
+      slowCommand.read();
+      otherCommand.read();
+
+      otherCommand.update((configFile) => {
+        configFile.getConfig('base').set('description', 'set-by-other-command');
+      });
+
+      slowCommand.update((configFile) => {
+        configFile.getConfig('base').set('core.rpc.port', 30000);
+      });
+
+      const reread = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults).read();
+
+      expect(reread.getConfig('base').get('description')).to.equal('set-by-other-command');
+      expect(reread.getConfig('base').get('core.rpc.port')).to.equal(30000);
+    });
+
+    // The mutator must never be handed the state this instance happened to read
+    // earlier - that is the whole point of reading inside the lock.
+    it('should hand the mutator state written since this instance last read', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+
+      repository.read();
+
+      new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults)
+        .update((configFile) => {
+          configFile.getConfig('base').set('description', 'written-by-someone-else');
+        });
+
+      let seen;
+      repository.update((configFile) => {
+        seen = configFile.getConfig('base').get('description');
+      });
+
+      expect(seen).to.equal('written-by-someone-else');
+    });
+
+    it('should save the state with template work still marked pending', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+      let savedConfigFile;
+
+      const result = repository.update((freshConfigFile) => {
+        freshConfigFile.getConfig('base').set('description', 'returned');
+        savedConfigFile = freshConfigFile;
+      });
+
+      expect(result).to.be.undefined();
+      expect(savedConfigFile.getConfig('base').get('description')).to.equal('returned');
+      expect(savedConfigFile.changed).to.be.false();
+      expect(savedConfigFile.getConfig('base').isChanged()).to.be.true();
+    });
+
+    it('should not write when the mutator throws', () => {
+      const before = seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+
+      expect(() => repository.update(() => {
+        throw new Error('mutator failed');
+      })).to.throw('mutator failed');
+
+      expect(fs.readFileSync(configFilePath, 'utf8')).to.equal(before);
+      expect(fs.existsSync(homeDir.joinPath('.config.json.lock'))).to.be.false();
+    });
+
+    // A command that reconfigures a node holds the lock for its whole run and
+    // still saves through the ordinary paths. Taking the lock again for each of
+    // those saves would leave it waiting on itself until the acquire timeout.
+    it('should let a held lock be used by update() and write() without deadlocking', function it1() {
+      this.timeout(10000);
+
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+
+      repository.acquire();
+
+      try {
+        repository.update((configFile) => {
+          configFile.getConfig('base').set('description', 'via-update');
+        });
+
+        const configFile = repository.read();
+        configFile.getConfig('base').set('description', 'via-write');
+        repository.write(configFile);
+      } finally {
+        repository.release();
+      }
+
+      const reread = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults).read();
+
+      expect(reread.getConfig('base').get('description')).to.equal('via-write');
+    });
+
+    it('should let onSaved re-enter a repository lock taken by update', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(
+        identityMigration,
+        homeDir,
+        createDefaults,
+        { acquireTimeout: 50 },
+      );
+
+      expect(() => repository.update((configFile) => {
+        configFile.getConfig('base').set('description', 'outer-save');
+      }, {
+        onSaved: (configFile) => {
+          configFile.getConfig('base').set('description', 'nested-save');
+          repository.write(configFile);
+        },
+      })).to.not.throw();
+
+      expect(repository.read().getConfig('base').get('description')).to.equal('nested-save');
+    });
+
+    it('should preserve an explicit lease acquired inside a locked callback', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+      const lockPath = homeDir.joinPath('.config.json.lock');
+
+      repository.update(() => {}, {
+        onSaved: () => repository.acquire(),
+      });
+
+      expect(fs.existsSync(lockPath)).to.be.true();
+
+      repository.release();
+
+      expect(fs.existsSync(lockPath)).to.be.false();
+    });
+
+    it('should hold the lock between acquire and release, and free it after', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+      const lockPath = homeDir.joinPath('.config.json.lock');
+
+      repository.acquire();
+
+      expect(fs.existsSync(lockPath)).to.be.true();
+
+      repository.release();
+
+      expect(fs.existsSync(lockPath)).to.be.false();
+    });
+
+    it('should keep an outer lease held until every acquire is released', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+      const lockPath = homeDir.joinPath('.config.json.lock');
+
+      repository.acquire();
+      repository.acquire();
+      repository.release();
+
+      expect(fs.existsSync(lockPath)).to.be.true();
+
+      repository.release();
+
+      expect(fs.existsSync(lockPath)).to.be.false();
+    });
+
+    // Release runs from several exit paths - normal finish, command failure and
+    // graceful shutdown - so calling it when nothing is held has to be harmless.
+    it('should tolerate release without acquire, and repeated release', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+
+      expect(() => repository.release()).to.not.throw();
+
+      repository.acquire();
+      repository.release();
+
+      expect(() => repository.release()).to.not.throw();
+    });
+
+    // Exclusivity is the whole guarantee for a command that holds the lock across
+    // its run, so losing it has to stop the save rather than pass unnoticed.
+    // Reproduced by removing the lock directory out from under a live holder and
+    // letting its refresh discover that, which is what a stolen lock looks like.
+    it('should refuse to save after losing a lock it believed it held', async function it2() {
+      this.timeout(10000);
+
+      seedConfigFile();
+
+      // proper-lockfile floors `stale` at 2s and the refresh that detects loss at
+      // 1s, so this is as fast as the path can be made to happen.
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults, CURRENT_FORMAT_VERSION, {
+        stale: 2000,
+      });
+
+      repository.acquire();
+
+      try {
+        fs.rmdirSync(homeDir.joinPath('.config.json.lock'));
+
+        await new Promise((resolve) => { setTimeout(resolve, 1500); });
+
+        let renders = 0;
+        let error;
+        try {
+          repository.update((configFile) => {
+            configFile.getConfig('base').set('description', 'must-not-be-saved');
+          }, {
+            onSaved: () => {
+              renders += 1;
+            },
+          });
+        } catch (e) {
+          error = e;
+        }
+
+        expect(error).to.be.instanceOf(Error);
+        expect(error.message).to.include('Lost the lock');
+        expect(error.message).to.include('.config.json.rescue-');
+        expect(renders, 'a lost owner must not render stale service files').to.equal(0);
+
+        repository.migrateConfigFile = (data) => ({
+          ...data,
+          configFormatVersion: '9.9.9',
+        });
+        repository.configFormatVersion = '9.9.9';
+
+        let migrationRenders = 0;
+        expect(() => repository.readAndMigrate({}, () => {
+          migrationRenders += 1;
+        })).to.throw('Lost the configuration lock');
+        expect(migrationRenders, 'a lost owner must not render a migration').to.equal(0);
+      } finally {
+        repository.release();
+      }
+
+      const reread = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults).read();
+
+      expect(reread.getConfig('base').get('description')).to.not.equal('must-not-be-saved');
+
+      const [rescueName] = fs.readdirSync(homeDir.getPath())
+        .filter((n) => n.startsWith('.config.json.rescue-'));
+      const rescuePath = homeDir.joinPath(rescueName);
+      expect(JSON.parse(fs.readFileSync(rescuePath, 'utf8'))
+        .configs.base.description).to.equal('must-not-be-saved');
+      // eslint-disable-next-line no-bitwise
+      expect(fs.statSync(rescuePath).mode & 0o777).to.equal(0o600);
+
+      repository.update((configFile) => {
+        configFile.getConfig('base').set('description', 'saved-after-new-lock');
+      });
+
+      expect(repository.read().getConfig('base').get('description'))
+        .to.equal('saved-after-new-lock');
+    });
+
+    // A waiter should be told what is happening in dashmate's terms, and only
+    // after actually waiting - not handed the locking library's wording.
+    it('should give up waiting for another holder with an actionable error', () => {
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults, CURRENT_FORMAT_VERSION, {
+        acquireTimeout: 700,
+      });
+
+      // Someone else holds it, exactly as proper-lockfile represents it
+      fs.mkdirSync(homeDir.joinPath('.config.json.lock'));
+
+      const startedAt = Date.now();
+
+      let error;
+      try {
+        repository.update((configFile) => {
+          configFile.getConfig('base').set('description', 'never-applied');
+        });
+      } catch (e) {
+        error = e;
+      }
+
+      expect(error).to.be.instanceOf(Error);
+      expect(error.message).to.include(homeDir.joinPath('.config.json.lock'));
+      expect(error.message).to.include('dashmate helper');
+      expect(error.message).to.include('reindex');
+      expect(error.message).to.include('about a minute');
+
+      expect(Date.now() - startedAt).to.be.at.least(600);
+
+      fs.rmdirSync(homeDir.joinPath('.config.json.lock'));
+    });
+
+    // Reading fresh inside the lock is only sound if the lock is actually
+    // honoured across processes. proper-lockfile represents a held lock as a
+    // directory, so another process needs nothing but `fs` to hold it.
+    it('should wait for a lock held by another process', function it0(done) {
+      this.timeout(20000);
+
+      seedConfigFile();
+
+      const repository = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults);
+      const lockPath = homeDir.joinPath('.config.json.lock');
+      const holdMs = 700;
+      const childScript = `
+        const fs = require('fs');
+        const lockPath = ${JSON.stringify(lockPath)};
+        const configFilePath = ${JSON.stringify(configFilePath)};
+        fs.mkdirSync(lockPath);
+        setTimeout(() => {
+          const data = JSON.parse(fs.readFileSync(configFilePath, 'utf8'));
+          data.configs.base.description = 'written-by-lock-holder';
+          fs.writeFileSync(configFilePath, JSON.stringify(data, undefined, 2) + '\\n');
+          fs.rmdirSync(lockPath);
+        }, ${holdMs});
+      `;
+
+      lockHolder = spawn(
+        process.execPath,
+        ['-e', childScript],
+        { stdio: 'ignore' },
+      );
+
+      lockHolder.on('error', done);
+
+      const deadline = Date.now() + 10000;
+      while (!fs.existsSync(lockPath) && Date.now() < deadline) {
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+      }
+
+      expect(fs.existsSync(lockPath), 'other process should hold the lock').to.be.true();
+
+      const startedAt = Date.now();
+
+      repository.update((configFile) => {
+        configFile.getConfig('base').set('core.rpc.port', 30000);
+      });
+
+      expect(Date.now() - startedAt).to.be.at.least(holdMs / 2);
+
+      const reread = new ConfigFileJsonRepository(identityMigration, homeDir, createDefaults).read();
+
+      expect(reread.getConfig('base').get('description')).to.equal('written-by-lock-holder');
+      expect(reread.getConfig('base').get('core.rpc.port')).to.equal(30000);
+
+      lockHolder.on('exit', () => done());
+    });
+  });
+});
diff --git a/packages/dashmate/test/unit/config/configFile/migrateConfigFileFactory.spec.js b/packages/dashmate/test/unit/config/configFile/migrateConfigFileFactory.spec.js
index a1065b8b10e..1d849f314d0 100644
--- a/packages/dashmate/test/unit/config/configFile/migrateConfigFileFactory.spec.js
+++ b/packages/dashmate/test/unit/config/configFile/migrateConfigFileFactory.spec.js
@@ -260,4 +260,39 @@ describe('migrateConfigFileFactory', () => {
       );
     }
   });
+
+  // Upgrading Dashmate has to leave a mark on the config file even when nothing
+  // needed migrating, because that recorded version is the only thing that tells
+  // the next command every config is stale. `ConfigFileJsonRepository.read()`
+  // marks all configs changed when the version moved, and that is what re-renders
+  // service templates after an upgrade. Stamping the version only when a
+  // migration happened to apply would leave nodes running templates rendered by
+  // an older Dashmate, with nothing to signal it.
+  it('should record the new version after an upgrade even when no migration applies', () => {
+    const configFileData = getConfigFileDataV0250();
+
+    // Both versions sit above every migration key, so nothing can match and the
+    // recorded version is the only thing the upgrade can change.
+    const installedVersion = '98.0.0';
+    const upgradedVersion = '99.0.0';
+
+    configFileData.configFormatVersion = installedVersion;
+
+    const migrated = migrateConfigFile(
+      configFileData,
+      configFileData.configFormatVersion,
+      upgradedVersion,
+    );
+
+    expect(migrated.configFormatVersion).to.equal(upgradedVersion);
+
+    // And migrating again from there is a no-op, so the mark does not repeat.
+    const again = migrateConfigFile(
+      migrated,
+      migrated.configFormatVersion,
+      upgradedVersion,
+    );
+
+    expect(again.configFormatVersion).to.equal(upgradedVersion);
+  });
 });
diff --git a/packages/dashmate/test/unit/config/resolve-config-directory.spec.js b/packages/dashmate/test/unit/config/resolve-config-directory.spec.js
index 7d4fb059379..a0ed2cf7ac1 100644
--- a/packages/dashmate/test/unit/config/resolve-config-directory.spec.js
+++ b/packages/dashmate/test/unit/config/resolve-config-directory.spec.js
@@ -2,6 +2,7 @@ import { expect } from 'chai';
 import HomeDir from '../../../src/config/HomeDir.js';
 import resolveConfigDirectory, {
   assertSafeConfigName,
+  assertConfigNameAvailable,
 } from '../../../src/config/resolve-config-directory.js';
 
 describe('resolveConfigDirectory', () => {
@@ -17,4 +18,28 @@ describe('resolveConfigDirectory', () => {
       expect(() => assertSafeConfigName(name), name).to.throw('path-safe segment');
     }
   });
+
+  it('rejects names reserved for repository state', () => {
+    for (const name of [
+      'config.json',
+      'CONFIG.JSON',
+      'config.json.',
+      'Config.Json...',
+    ]) {
+      expect(() => assertConfigNameAvailable(name), name).to.throw('reserved by Dashmate');
+    }
+  });
+
+  // Everything else the repository writes beside the config file is
+  // dot-prefixed, and a config name cannot begin with a period - so these
+  // collide with nothing and refusing them would only break existing nodes.
+  it('accepts names that merely resemble repository state', () => {
+    for (const name of [
+      'config.json.lock',
+      'config.json.rescue',
+      'config.json.render-pending',
+    ]) {
+      expect(() => assertConfigNameAvailable(name), name).to.not.throw();
+    }
+  });
 });
diff --git a/packages/dashmate/test/unit/helper/renewCertificate.spec.js b/packages/dashmate/test/unit/helper/renewCertificate.spec.js
new file mode 100644
index 00000000000..0a1074d21f7
--- /dev/null
+++ b/packages/dashmate/test/unit/helper/renewCertificate.spec.js
@@ -0,0 +1,234 @@
+import fs from 'fs';
+import ConfigFile from '../../../src/config/configFile/ConfigFile.js';
+import ConfigFileJsonRepository from '../../../src/config/configFile/ConfigFileJsonRepository.js';
+import HomeDir from '../../../src/config/HomeDir.js';
+import renewCertificate from '../../../src/helper/renewCertificate.js';
+import getBaseConfigFactory from '../../../configs/defaults/getBaseConfigFactory.js';
+
+describe('renewCertificate', () => {
+  let homeDir;
+  let repository;
+  let configName;
+
+  beforeEach(() => {
+    homeDir = HomeDir.createTemp();
+
+    const config = getBaseConfigFactory(homeDir)();
+    configName = config.getName();
+    config.set('platform.gateway.ssl.enabled', true);
+    config.set('platform.gateway.ssl.provider', 'zerossl');
+    config.set(
+      'platform.gateway.ssl.providerConfigs.zerossl.apiKey',
+      'api-key-000000000000000000000000',
+    );
+    config.set(
+      'platform.gateway.ssl.providerConfigs.zerossl.id',
+      'old-certificate-id-00000000000000',
+    );
+
+    const configFile = new ConfigFile(
+      [config],
+      '4.1.0',
+      'abcdef12',
+      configName,
+      null,
+    );
+
+    repository = new ConfigFileJsonRepository(
+      (data) => data,
+      homeDir,
+      () => null,
+    );
+    repository.write(configFile);
+  });
+
+  afterEach(() => {
+    homeDir.remove();
+  });
+
+  it('should preserve an unrelated update made after helper startup', async function it() {
+    repository.update((configFile) => {
+      configFile.getConfig(configName).set('description', 'updated after helper startup');
+    });
+
+    let renewedConfig;
+    const obtainCertificateTask = this.sinon.stub().callsFake((config) => {
+      renewedConfig = config;
+
+      return {
+        run: this.sinon.stub().callsFake(async () => {
+          expect(fs.existsSync(homeDir.joinPath('.config.json.lock'))).to.be.true();
+          config.set(
+            'platform.gateway.ssl.providerConfigs.zerossl.id',
+            'renewed-certificate-id-0000000000',
+          );
+        }),
+      };
+    });
+    const writeConfigTemplates = this.sinon.stub().callsFake((config) => {
+      expect(fs.existsSync(homeDir.joinPath('.config.json.lock'))).to.be.true();
+      config.markAsSaved();
+    });
+
+    const result = await renewCertificate({
+      configName,
+      provider: 'zerossl',
+      expirationDays: 30,
+      obtainCertificateTask,
+      configFileRepository: repository,
+      writeConfigTemplates,
+    });
+
+    const persisted = repository.read().getConfig(configName);
+
+    expect(result).to.deep.equal({
+      config: renewedConfig,
+      renewed: true,
+    });
+    expect(persisted.get('description')).to.equal('updated after helper startup');
+    expect(persisted.get('platform.gateway.ssl.providerConfigs.zerossl.id'))
+      .to.equal('renewed-certificate-id-0000000000');
+    expect(obtainCertificateTask).to.have.been.calledOnce();
+    expect(writeConfigTemplates).to.have.been.calledOnceWith(renewedConfig);
+    expect(fs.existsSync(homeDir.joinPath('.config.json.lock'))).to.be.false();
+  });
+
+  it('should keep renewed state saved when service-file rendering fails', async function it() {
+    const obtainCertificateTask = this.sinon.stub().callsFake((config) => ({
+      run: this.sinon.stub().callsFake(async () => {
+        config.set(
+          'platform.gateway.ssl.providerConfigs.zerossl.id',
+          'renewed-certificate-id-0000000000',
+        );
+      }),
+    }));
+    const writeConfigTemplates = this.sinon.stub().throws(new Error('template write failed'));
+
+    await expect(renewCertificate({
+      configName,
+      provider: 'zerossl',
+      expirationDays: 30,
+      obtainCertificateTask,
+      configFileRepository: repository,
+      writeConfigTemplates,
+    })).to.be.rejectedWith('template write failed');
+
+    expect(repository.read().getConfig(configName)
+      .get('platform.gateway.ssl.providerConfigs.zerossl.id'))
+      .to.equal('renewed-certificate-id-0000000000');
+    expect(fs.existsSync(homeDir.joinPath('.config.json.lock'))).to.be.false();
+  });
+
+  it('should not renew when the provider changed after helper startup', async function it() {
+    repository.update((configFile) => {
+      configFile.getConfig(configName).set('platform.gateway.ssl.provider', 'self-signed');
+    });
+
+    const obtainCertificateTask = this.sinon.stub();
+    const writeConfigTemplates = this.sinon.stub();
+
+    const result = await renewCertificate({
+      configName,
+      provider: 'zerossl',
+      expirationDays: 30,
+      obtainCertificateTask,
+      configFileRepository: repository,
+      writeConfigTemplates,
+    });
+
+    expect(result.renewed).to.be.false();
+    expect(result.config.getName()).to.equal(configName);
+    expect(obtainCertificateTask).to.not.have.been.called();
+    expect(writeConfigTemplates).to.not.have.been.called();
+    expect(repository.read().getConfig(configName)
+      .get('platform.gateway.ssl.provider')).to.equal('self-signed');
+    expect(fs.existsSync(homeDir.joinPath('.config.json.lock'))).to.be.false();
+  });
+
+  it('should not write or render when the obtain task changes nothing', async function it() {
+    const write = this.sinon.spy(repository, 'write');
+    const obtainCertificateTask = this.sinon.stub().returns({
+      run: this.sinon.stub().resolves(),
+    });
+    const writeConfigTemplates = this.sinon.stub();
+
+    await renewCertificate({
+      configName,
+      provider: 'zerossl',
+      expirationDays: 30,
+      obtainCertificateTask,
+      configFileRepository: repository,
+      writeConfigTemplates,
+    });
+
+    expect(write).to.not.have.been.called();
+    expect(writeConfigTemplates).to.not.have.been.called();
+  });
+
+  // Issuance runs for minutes, long enough for the lease to be stolen and
+  // another command to save and render newer state. Rendering from this
+  // configuration would overwrite it, and the save's own check is too late.
+  it('should not render service files when the lease was lost during issuance', async function it() {
+    const obtainCertificateTask = this.sinon.stub().callsFake((config) => ({
+      run: this.sinon.stub().callsFake(async () => {
+        config.set(
+          'platform.gateway.ssl.providerConfigs.zerossl.id',
+          'issued-certificate-id-000000000000',
+        );
+
+        // The lock went stale while the certificate was being issued.
+        repository.isExclusive = () => false;
+      }),
+    }));
+    const writeConfigTemplates = this.sinon.stub();
+
+    await expect(renewCertificate({
+      configName,
+      provider: 'zerossl',
+      expirationDays: 30,
+      obtainCertificateTask,
+      configFileRepository: repository,
+      writeConfigTemplates,
+    })).to.be.rejectedWith('Lost the configuration lock');
+
+    expect(writeConfigTemplates).to.not.have.been.called();
+  });
+
+  it('should checkpoint produced certificate state when obtain fails', async function it() {
+    const obtainCertificateTask = this.sinon.stub().callsFake((config, {
+      onCertificateCreated,
+    }) => ({
+      run: this.sinon.stub().callsFake(async () => {
+        config.set(
+          'platform.gateway.ssl.providerConfigs.zerossl.id',
+          'pending-certificate-id-00000000000',
+        );
+        onCertificateCreated();
+
+        expect(repository.read().getConfig(configName)
+          .get('platform.gateway.ssl.providerConfigs.zerossl.id'))
+          .to.equal('pending-certificate-id-00000000000');
+
+        throw new Error('verification failed');
+      }),
+    }));
+    const writeConfigTemplates = this.sinon.stub();
+
+    await expect(renewCertificate({
+      configName,
+      provider: 'zerossl',
+      expirationDays: 30,
+      obtainCertificateTask,
+      configFileRepository: repository,
+      writeConfigTemplates,
+    })).to.be.rejectedWith('verification failed');
+
+    const persisted = repository.read().getConfig(configName);
+
+    expect(persisted.get('platform.gateway.ssl.providerConfigs.zerossl.id'))
+      .to.equal('pending-certificate-id-00000000000');
+    expect(persisted.get('platform.gateway.ssl.enabled')).to.be.true();
+    expect(writeConfigTemplates).to.not.have.been.called();
+    expect(fs.existsSync(homeDir.joinPath('.config.json.lock'))).to.be.false();
+  });
+});
diff --git a/packages/dashmate/test/unit/helper/scheduleRenewCertificate.spec.js b/packages/dashmate/test/unit/helper/scheduleRenewCertificate.spec.js
new file mode 100644
index 00000000000..7d1303df485
--- /dev/null
+++ b/packages/dashmate/test/unit/helper/scheduleRenewCertificate.spec.js
@@ -0,0 +1,129 @@
+import scheduleRenewCertificate from '../../../src/helper/scheduleRenewCertificate.js';
+
+describe('scheduleRenewCertificate', () => {
+  it('should hand provider changes to the newly configured scheduler', async function it() {
+    const zeroSslConfig = {
+      get: this.sinon.stub(),
+    };
+    zeroSslConfig.get.withArgs('platform.gateway.ssl.enabled').returns(true);
+    zeroSslConfig.get.withArgs('platform.gateway.ssl.provider').returns('zerossl');
+
+    const letsEncryptConfig = {
+      get: this.sinon.stub(),
+    };
+    letsEncryptConfig.get.withArgs('platform.gateway.ssl.enabled').returns(true);
+    letsEncryptConfig.get.withArgs('platform.gateway.ssl.provider').returns('letsencrypt');
+
+    let configurationChanged;
+    const scheduleRenewZeroSslCertificate = this.sinon.stub()
+      .callsFake(async (config, onConfigurationChanged) => {
+        configurationChanged = onConfigurationChanged;
+      });
+    const scheduleRenewLetsEncryptCertificate = this.sinon.stub().resolves();
+    const watchInactiveConfig = this.sinon.stub();
+
+    await scheduleRenewCertificate(
+      zeroSslConfig,
+      scheduleRenewZeroSslCertificate,
+      scheduleRenewLetsEncryptCertificate,
+      watchInactiveConfig,
+    );
+    await configurationChanged(letsEncryptConfig);
+
+    expect(scheduleRenewZeroSslCertificate).to.have.been.calledOnceWith(
+      zeroSslConfig,
+      this.sinon.match.func,
+    );
+    expect(scheduleRenewLetsEncryptCertificate).to.have.been.calledOnceWith(
+      letsEncryptConfig,
+      this.sinon.match.func,
+    );
+  });
+
+  it('should watch a disabled provider', async function it() {
+    const config = {
+      get: this.sinon.stub(),
+    };
+    config.get.withArgs('platform.gateway.ssl.enabled').returns(false);
+    const scheduleRenewZeroSslCertificate = this.sinon.stub();
+    const scheduleRenewLetsEncryptCertificate = this.sinon.stub();
+    const watchInactiveConfig = this.sinon.stub();
+
+    const result = await scheduleRenewCertificate(
+      config,
+      scheduleRenewZeroSslCertificate,
+      scheduleRenewLetsEncryptCertificate,
+      watchInactiveConfig,
+    );
+
+    expect(result).to.be.undefined();
+    expect(scheduleRenewZeroSslCertificate).to.not.have.been.called();
+    expect(scheduleRenewLetsEncryptCertificate).to.not.have.been.called();
+    expect(watchInactiveConfig).to.have.been.calledOnceWith(config, this.sinon.match.func);
+  });
+
+  it('should watch an initially disabled config and schedule it when enabled', async function it() {
+    const disabledConfig = {
+      get: this.sinon.stub(),
+      getName: this.sinon.stub().returns('base'),
+    };
+    disabledConfig.get.withArgs('platform.gateway.ssl.enabled').returns(false);
+
+    const enabledConfig = {
+      get: this.sinon.stub(),
+      getName: this.sinon.stub().returns('base'),
+    };
+    enabledConfig.get.withArgs('platform.gateway.ssl.enabled').returns(true);
+    enabledConfig.get.withArgs('platform.gateway.ssl.provider').returns('zerossl');
+
+    let onActivated;
+    const watchInactiveConfig = this.sinon.stub()
+      .callsFake((config, callback) => {
+        onActivated = callback;
+      });
+    const scheduleRenewZeroSslCertificate = this.sinon.stub().resolves();
+    const scheduleRenewLetsEncryptCertificate = this.sinon.stub();
+
+    const result = await scheduleRenewCertificate(
+      disabledConfig,
+      scheduleRenewZeroSslCertificate,
+      scheduleRenewLetsEncryptCertificate,
+      watchInactiveConfig,
+    );
+    await onActivated(enabledConfig);
+
+    expect(result).to.be.undefined();
+    expect(watchInactiveConfig).to.have.been.calledOnceWith(
+      disabledConfig,
+      this.sinon.match.func,
+    );
+    expect(scheduleRenewZeroSslCertificate).to.have.been.calledOnceWith(
+      enabledConfig,
+      this.sinon.match.func,
+    );
+  });
+
+  it('should watch for recreation when a config disappears during provider handoff', async function it() {
+    const config = {
+      get: this.sinon.stub(),
+      getName: this.sinon.stub().returns('base'),
+    };
+    config.get.withArgs('platform.gateway.ssl.enabled').returns(true);
+    config.get.withArgs('platform.gateway.ssl.provider').returns('zerossl');
+    const scheduleRenewZeroSslCertificate = this.sinon.stub()
+      .callsFake(async (scheduledConfig, onConfigurationChanged) => {
+        await onConfigurationChanged(null);
+      });
+    const scheduleRenewLetsEncryptCertificate = this.sinon.stub();
+    const watchInactiveConfig = this.sinon.stub();
+
+    await scheduleRenewCertificate(
+      config,
+      scheduleRenewZeroSslCertificate,
+      scheduleRenewLetsEncryptCertificate,
+      watchInactiveConfig,
+    );
+
+    expect(watchInactiveConfig).to.have.been.calledOnceWith(config, this.sinon.match.func);
+  });
+});
diff --git a/packages/dashmate/test/unit/helper/scheduleRenewLetsEncryptCertificateFactory.spec.js b/packages/dashmate/test/unit/helper/scheduleRenewLetsEncryptCertificateFactory.spec.js
new file mode 100644
index 00000000000..bd0511253e7
--- /dev/null
+++ b/packages/dashmate/test/unit/helper/scheduleRenewLetsEncryptCertificateFactory.spec.js
@@ -0,0 +1,143 @@
+import fs from 'fs';
+import path from 'path';
+import LegoCertificate from '../../../src/ssl/letsencrypt/LegoCertificate.js';
+import scheduleRenewLetsEncryptCertificateFactory from '../../../src/helper/scheduleRenewLetsEncryptCertificateFactory.js';
+import HomeDir from '../../../src/config/HomeDir.js';
+import ConfigIsNotPresentError from '../../../src/config/errors/ConfigIsNotPresentError.js';
+
+describe('scheduleRenewLetsEncryptCertificateFactory', () => {
+  let config;
+  let obtainLetsEncryptCertificateTask;
+  let dockerCompose;
+  let configFileRepository;
+  let writeConfigTemplates;
+  let scheduleRenewLetsEncryptCertificate;
+
+  beforeEach(function beforeEach() {
+    config = {
+      get: this.sinon.stub(),
+      getName: this.sinon.stub().returns('base'),
+    };
+    config.get.withArgs('platform.gateway.ssl.enabled').returns(true);
+    config.get.withArgs('platform.gateway.ssl.provider').returns('letsencrypt');
+    config.get.withArgs('externalIp').returns('127.0.0.1');
+    config.isChanged = this.sinon.stub().returns(false);
+
+    obtainLetsEncryptCertificateTask = this.sinon.stub();
+    dockerCompose = { execCommand: this.sinon.stub() };
+    configFileRepository = {
+      read: this.sinon.stub().returns({
+        getConfig: this.sinon.stub().returns(config),
+      }),
+      acquire: this.sinon.stub(),
+      isExclusive: () => true,
+      readAndMigrate: this.sinon.stub().returns({
+        configFile: {
+          getConfig: this.sinon.stub().returns(config),
+        },
+      }),
+      write: this.sinon.stub(),
+      release: this.sinon.stub(),
+    };
+    writeConfigTemplates = this.sinon.stub();
+
+    scheduleRenewLetsEncryptCertificate = scheduleRenewLetsEncryptCertificateFactory(
+      obtainLetsEncryptCertificateTask,
+      dockerCompose,
+      configFileRepository,
+      writeConfigTemplates,
+      {
+        joinPath: this.sinon.stub().returns('/tmp/lego'),
+      },
+    );
+  });
+
+  it('should run renewal through the fresh locked configuration path', async function it() {
+    const clock = this.sinon.useFakeTimers({
+      now: new Date('2026-07-31T00:00:00.000Z'),
+    });
+    const run = this.sinon.stub().resolves();
+    obtainLetsEncryptCertificateTask.returns({ run });
+    config.isChanged.returns(true);
+    this.sinon.stub(LegoCertificate, 'fromFile').returns({
+      expires: new Date('2026-08-01T00:00:00.000Z'),
+      isExpiredInDays: this.sinon.stub().returns(true),
+    });
+
+    await scheduleRenewLetsEncryptCertificate(config);
+    await clock.tickAsync(3001);
+
+    expect(configFileRepository.acquire).to.have.been.calledOnce();
+    expect(configFileRepository.readAndMigrate).to.have.been.calledOnce();
+    expect(obtainLetsEncryptCertificateTask).to.have.been.calledOnceWith(config);
+    expect(run).to.have.been.calledOnceWith({
+      expirationDays: LegoCertificate.EXPIRATION_LIMIT_DAYS,
+      noRetry: true,
+    });
+    expect(configFileRepository.write).to.have.been.calledOnce();
+    expect(writeConfigTemplates).to.have.been.calledOnceWith(config);
+    expect(configFileRepository.release).to.have.been.calledOnce();
+    expect(dockerCompose.execCommand)
+      .to.have.been.calledOnceWith(config, 'gateway', 'kill -SIGHUP 1');
+  });
+
+  it('should hand off when the config was removed before scheduling completed', async function it() {
+    const onConfigurationChanged = this.sinon.stub().resolves();
+    configFileRepository.read.returns({
+      getConfig: this.sinon.stub().throws(new ConfigIsNotPresentError('base')),
+    });
+
+    await scheduleRenewLetsEncryptCertificate(config, onConfigurationChanged);
+
+    expect(onConfigurationChanged).to.have.been.calledOnceWith(null);
+    expect(obtainLetsEncryptCertificateTask).to.not.have.been.called();
+  });
+
+  it('should retry an incomplete gateway installation instead of waiting for expiry', async function it() {
+    const homeDir = HomeDir.createTemp();
+    const clock = this.sinon.useFakeTimers({
+      now: new Date('2026-07-31T00:00:00.000Z'),
+    });
+
+    try {
+      const legoDir = homeDir.joinPath('base', 'platform', 'gateway', 'lego');
+      const legoCertificatesDir = path.join(legoDir, 'certificates');
+      const gatewayDir = homeDir.joinPath('base', 'platform', 'gateway', 'ssl');
+      fs.mkdirSync(legoCertificatesDir, { recursive: true });
+      fs.mkdirSync(gatewayDir, { recursive: true });
+      fs.writeFileSync(path.join(legoCertificatesDir, '127.0.0.1.crt'), 'new-certificate');
+      fs.writeFileSync(path.join(legoCertificatesDir, '127.0.0.1.key'), 'new-key');
+      fs.writeFileSync(path.join(gatewayDir, 'bundle.crt'), 'old-certificate');
+      fs.writeFileSync(path.join(gatewayDir, 'private.key'), 'old-key');
+
+      const certificate = {
+        expires: new Date('2026-10-01T00:00:00.000Z'),
+        isExpiredInDays: this.sinon.stub(),
+      };
+      certificate.isExpiredInDays.onFirstCall().returns(true);
+      certificate.isExpiredInDays.onSecondCall().returns(false);
+      this.sinon.stub(LegoCertificate, 'fromFile').returns(certificate);
+
+      const run = this.sinon.stub();
+      run.onFirstCall().rejects(new Error('save failed'));
+      run.onSecondCall().resolves();
+      obtainLetsEncryptCertificateTask.returns({ run });
+
+      scheduleRenewLetsEncryptCertificate = scheduleRenewLetsEncryptCertificateFactory(
+        obtainLetsEncryptCertificateTask,
+        dockerCompose,
+        configFileRepository,
+        writeConfigTemplates,
+        homeDir,
+      );
+
+      await scheduleRenewLetsEncryptCertificate(config);
+      await clock.tickAsync(3001);
+      await clock.tickAsync((60 * 60 * 1000) + 3001);
+
+      expect(run).to.have.been.calledTwice();
+    } finally {
+      homeDir.remove();
+    }
+  });
+});
diff --git a/packages/dashmate/test/unit/helper/scheduleRenewZeroSslCertificateFactory.spec.js b/packages/dashmate/test/unit/helper/scheduleRenewZeroSslCertificateFactory.spec.js
index 46eebf74f9c..b893c8c7423 100644
--- a/packages/dashmate/test/unit/helper/scheduleRenewZeroSslCertificateFactory.spec.js
+++ b/packages/dashmate/test/unit/helper/scheduleRenewZeroSslCertificateFactory.spec.js
@@ -1,4 +1,7 @@
 import scheduleRenewZeroSslCertificateFactory from '../../../src/helper/scheduleRenewZeroSslCertificateFactory.js';
+import ConfigIsNotPresentError from '../../../src/config/errors/ConfigIsNotPresentError.js';
+import Certificate from '../../../src/ssl/zerossl/Certificate.js';
+import { CONFIG_REFRESH_INTERVAL_MS } from '../../../src/helper/watchCertificateConfig.js';
 
 describe('scheduleRenewZeroSslCertificateFactory', () => {
   let config;
@@ -6,28 +9,47 @@ describe('scheduleRenewZeroSslCertificateFactory', () => {
   let obtainZeroSSLCertificateTask;
   let dockerCompose;
   let configFileRepository;
-  let configFile;
   let writeConfigTemplates;
   let scheduleRenewZeroSslCertificate;
 
   beforeEach(function beforeEach() {
     config = {
       get: this.sinon.stub(),
+      getName: this.sinon.stub().returns('base'),
+      isChanged: this.sinon.stub().returns(false),
     };
 
     getCertificate = this.sinon.stub();
     obtainZeroSSLCertificateTask = this.sinon.stub();
     dockerCompose = { execCommand: this.sinon.stub() };
-    configFileRepository = { write: this.sinon.stub() };
-    configFile = {};
+    configFileRepository = {
+      read: this.sinon.stub().returns({
+        getConfig: this.sinon.stub().returns(config),
+      }),
+      acquire: this.sinon.stub(),
+      isExclusive: () => true,
+      readAndMigrate: this.sinon.stub().returns({
+        configFile: {
+          getConfig: this.sinon.stub().returns(config),
+        },
+      }),
+      write: this.sinon.stub(),
+      release: this.sinon.stub(),
+    };
     writeConfigTemplates = this.sinon.stub();
+    config.get.withArgs('platform.gateway.ssl.enabled').returns(true);
+    config.get.withArgs('platform.gateway.ssl.provider').returns('zerossl');
+    config.get.withArgs('externalIp').returns('127.0.0.1');
+    config.get.withArgs('platform.gateway.ssl.providerConfigs.zerossl.apiKey')
+      .returns('api-key');
+    config.get.withArgs('platform.gateway.ssl.providerConfigs.zerossl.id')
+      .returns('certificate-id');
 
     scheduleRenewZeroSslCertificate = scheduleRenewZeroSslCertificateFactory(
       getCertificate,
       obtainZeroSSLCertificateTask,
       dockerCompose,
       configFileRepository,
-      configFile,
       writeConfigTemplates,
     );
   });
@@ -64,5 +86,248 @@ describe('scheduleRenewZeroSslCertificateFactory', () => {
       expect(setTimeoutStub).to.have.been.calledOnce();
       expect(setTimeoutStub.firstCall.args[1]).to.equal(60 * 60 * 1000);
     });
+
+    it('should preserve provider handoff across a retry', async function it() {
+      const setTimeoutStub = this.sinon.stub(global, 'setTimeout');
+      const onConfigurationChanged = this.sinon.stub().resolves(true);
+      this.sinon.stub(console, 'error');
+      getCertificate.rejects(new Error('ZeroSSL API unavailable'));
+
+      await scheduleRenewZeroSslCertificate(config, onConfigurationChanged);
+
+      getCertificate.resetBehavior();
+      config.get.withArgs('platform.gateway.ssl.provider').returns('letsencrypt');
+      await setTimeoutStub.firstCall.args[0]();
+
+      expect(onConfigurationChanged).to.have.been.calledOnceWith(config);
+    });
+  });
+
+  describe('configuration refresh', () => {
+    it('should hand off when the config was removed before scheduling completed', async function it() {
+      const setTimeoutStub = this.sinon.stub(global, 'setTimeout');
+      const onConfigurationChanged = this.sinon.stub().resolves();
+      configFileRepository.read.returns({
+        getConfig: this.sinon.stub().throws(new ConfigIsNotPresentError('base')),
+      });
+
+      await expect(scheduleRenewZeroSslCertificate(config, onConfigurationChanged))
+        .to.not.be.rejected();
+
+      expect(getCertificate).to.not.have.been.called();
+      expect(setTimeoutStub).to.not.have.been.called();
+      expect(onConfigurationChanged).to.have.been.calledOnceWith(null);
+    });
+
+    it('should retry when the current config cannot be read', async function it() {
+      const setTimeoutStub = this.sinon.stub(global, 'setTimeout');
+      this.sinon.stub(console, 'error');
+      configFileRepository.read.throws(new Error('read failed'));
+
+      await expect(scheduleRenewZeroSslCertificate(config)).to.not.be.rejected();
+
+      expect(setTimeoutStub).to.have.been.calledOnce();
+      expect(setTimeoutStub.firstCall.args[1]).to.equal(60 * 60 * 1000);
+    });
+
+    it('should hand off scheduling when the configured provider changed', async function it() {
+      const onConfigurationChanged = this.sinon.stub().resolves(true);
+      config.get.withArgs('platform.gateway.ssl.provider').returns('letsencrypt');
+
+      await scheduleRenewZeroSslCertificate(config, onConfigurationChanged);
+
+      expect(onConfigurationChanged).to.have.been.calledOnceWith(config);
+      expect(getCertificate).to.not.have.been.called();
+    });
+
+    it('should detect a provider change before the old certificate renewal date', async function it() {
+      const clock = this.sinon.useFakeTimers({
+        now: new Date('2026-07-31T00:00:00.000Z'),
+      });
+      const onConfigurationChanged = this.sinon.stub().resolves(true);
+      getCertificate.resolves({
+        id: 'certificate-id',
+        status: 'issued',
+        expires: new Date('2026-10-01T00:00:00.000Z'),
+        isExpiredInDays: this.sinon.stub().returns(false),
+      });
+
+      await scheduleRenewZeroSslCertificate(config, onConfigurationChanged);
+
+      config.get.withArgs('platform.gateway.ssl.provider').returns('letsencrypt');
+      await clock.tickAsync(CONFIG_REFRESH_INTERVAL_MS);
+
+      expect(onConfigurationChanged).to.have.been.calledOnceWith(config);
+      expect(obtainZeroSSLCertificateTask).to.not.have.been.called();
+
+      await clock.tickAsync(64 * 24 * 60 * 60 * 1000);
+
+      expect(onConfigurationChanged).to.have.been.calledOnce();
+      expect(obtainZeroSSLCertificateTask).to.not.have.been.called();
+    });
+
+    it('should resume scheduling after SSL is disabled and re-enabled', async function it() {
+      const clock = this.sinon.useFakeTimers({
+        now: new Date('2026-07-31T00:00:00.000Z'),
+      });
+      const onConfigurationChanged = this.sinon.stub();
+      onConfigurationChanged.onFirstCall().resolves(false);
+      onConfigurationChanged.onSecondCall().resolves(true);
+      getCertificate.resolves({
+        id: 'certificate-id',
+        status: 'issued',
+        expires: new Date('2026-10-01T00:00:00.000Z'),
+        isExpiredInDays: this.sinon.stub().returns(false),
+      });
+
+      await scheduleRenewZeroSslCertificate(config, onConfigurationChanged);
+
+      config.get.withArgs('platform.gateway.ssl.enabled').returns(false);
+      await clock.tickAsync(CONFIG_REFRESH_INTERVAL_MS);
+      config.get.withArgs('platform.gateway.ssl.enabled').returns(true);
+      await clock.tickAsync(CONFIG_REFRESH_INTERVAL_MS);
+
+      expect(onConfigurationChanged).to.have.been.calledTwice();
+      expect(onConfigurationChanged.firstCall).to.have.been.calledWith(config);
+      expect(onConfigurationChanged.secondCall).to.have.been.calledWith(config);
+    });
+
+    it('should keep watching after removal and schedule a recreated config', async function it() {
+      const clock = this.sinon.useFakeTimers({
+        now: new Date('2026-07-31T00:00:00.000Z'),
+      });
+      const onConfigurationChanged = this.sinon.stub().resolves(true);
+      const removedConfigFile = {
+        getConfig: this.sinon.stub().throws(new ConfigIsNotPresentError('base')),
+      };
+      const recreatedConfig = {
+        getName: this.sinon.stub().returns('base'),
+        get: this.sinon.stub(),
+      };
+      recreatedConfig.get.withArgs('platform.gateway.ssl.enabled').returns(true);
+      recreatedConfig.get.withArgs('platform.gateway.ssl.provider').returns('zerossl');
+      recreatedConfig.get.withArgs('externalIp').returns('127.0.0.1');
+      recreatedConfig.get.withArgs('platform.gateway.ssl.providerConfigs.zerossl.apiKey')
+        .returns('api-key');
+      recreatedConfig.get.withArgs('platform.gateway.ssl.providerConfigs.zerossl.id')
+        .returns('recreated-certificate-id');
+      configFileRepository.read.onCall(1).returns(removedConfigFile);
+      configFileRepository.read.onCall(2).returns({
+        getConfig: this.sinon.stub().returns(recreatedConfig),
+      });
+      getCertificate.resolves({
+        id: 'certificate-id',
+        status: 'issued',
+        expires: new Date('2026-10-01T00:00:00.000Z'),
+        isExpiredInDays: this.sinon.stub().returns(false),
+      });
+
+      await scheduleRenewZeroSslCertificate(config, onConfigurationChanged);
+      await clock.tickAsync(CONFIG_REFRESH_INTERVAL_MS);
+
+      expect(onConfigurationChanged).to.not.have.been.called();
+
+      await clock.tickAsync(CONFIG_REFRESH_INTERVAL_MS);
+
+      expect(onConfigurationChanged).to.have.been.calledOnceWith(recreatedConfig);
+    });
+
+    [
+      ['external IP', 'externalIp', '127.0.0.2'],
+      [
+        'API key',
+        'platform.gateway.ssl.providerConfigs.zerossl.apiKey',
+        'new-api-key',
+      ],
+      [
+        'certificate ID',
+        'platform.gateway.ssl.providerConfigs.zerossl.id',
+        'new-certificate-id',
+      ],
+    ].forEach(([name, path, value]) => {
+      it(`should reschedule when the ZeroSSL ${name} changes`, async function it() {
+        const clock = this.sinon.useFakeTimers({
+          now: new Date('2026-07-31T00:00:00.000Z'),
+        });
+        const onConfigurationChanged = this.sinon.stub().resolves(true);
+        const changedConfig = {
+          getName: this.sinon.stub().returns('base'),
+          get: this.sinon.stub(),
+        };
+        changedConfig.get.withArgs('platform.gateway.ssl.enabled').returns(true);
+        changedConfig.get.withArgs('platform.gateway.ssl.provider').returns('zerossl');
+        changedConfig.get.withArgs('externalIp').returns('127.0.0.1');
+        changedConfig.get.withArgs('platform.gateway.ssl.providerConfigs.zerossl.apiKey')
+          .returns('api-key');
+        changedConfig.get.withArgs('platform.gateway.ssl.providerConfigs.zerossl.id')
+          .returns('certificate-id');
+        changedConfig.get.withArgs(path).returns(value);
+        getCertificate.resolves({
+          id: 'certificate-id',
+          status: 'issued',
+          expires: new Date('2026-10-01T00:00:00.000Z'),
+          isExpiredInDays: this.sinon.stub().returns(false),
+        });
+
+        await scheduleRenewZeroSslCertificate(config, onConfigurationChanged);
+        configFileRepository.read.returns({
+          getConfig: this.sinon.stub().returns(changedConfig),
+        });
+        await clock.tickAsync(CONFIG_REFRESH_INTERVAL_MS);
+
+        expect(onConfigurationChanged).to.have.been.calledOnceWith(changedConfig);
+      });
+    });
+  });
+
+  it('should run renewal through the fresh locked configuration path', async function it() {
+    const clock = this.sinon.useFakeTimers({
+      now: new Date('2026-07-31T00:00:00.000Z'),
+    });
+    const run = this.sinon.stub().resolves();
+    obtainZeroSSLCertificateTask.returns({ run });
+    config.isChanged.returns(true);
+    getCertificate.resolves({
+      id: 'certificate-id',
+      status: 'issued',
+      expires: new Date('2026-08-01T00:00:00.000Z'),
+      isExpiredInDays: this.sinon.stub().returns(true),
+    });
+
+    await scheduleRenewZeroSslCertificate(config);
+    await clock.tickAsync(3001);
+
+    expect(configFileRepository.acquire).to.have.been.calledOnce();
+    expect(configFileRepository.readAndMigrate).to.have.been.calledOnce();
+    expect(obtainZeroSSLCertificateTask).to.have.been.calledOnceWith(config);
+    expect(run).to.have.been.calledOnceWith({
+      expirationDays: Certificate.EXPIRATION_LIMIT_DAYS,
+      noRetry: true,
+    });
+    expect(configFileRepository.write).to.have.been.calledOnce();
+    expect(writeConfigTemplates).to.have.been.calledOnceWith(config);
+    expect(configFileRepository.release).to.have.been.calledOnce();
+    expect(dockerCompose.execCommand)
+      .to.have.been.calledOnceWith(config, 'gateway', 'kill -SIGHUP 1');
+    expect(getCertificate).to.have.been.calledTwice();
+  });
+
+  it('should resume a pending certificate without waiting for its expiry', async function it() {
+    const clock = this.sinon.useFakeTimers({
+      now: new Date('2026-07-31T00:00:00.000Z'),
+    });
+    const run = this.sinon.stub().resolves();
+    obtainZeroSSLCertificateTask.returns({ run });
+    getCertificate.resolves({
+      id: 'pending-certificate-id',
+      status: 'pending_validation',
+      expires: new Date('2026-10-01T00:00:00.000Z'),
+      isExpiredInDays: this.sinon.stub().returns(false),
+    });
+
+    await scheduleRenewZeroSslCertificate(config);
+    await clock.tickAsync(3001);
+
+    expect(run).to.have.been.calledOnce();
   });
 });
diff --git a/packages/dashmate/test/unit/oclif/command/BaseCommand.spec.js b/packages/dashmate/test/unit/oclif/command/BaseCommand.spec.js
new file mode 100644
index 00000000000..460ad6c84fb
--- /dev/null
+++ b/packages/dashmate/test/unit/oclif/command/BaseCommand.spec.js
@@ -0,0 +1,302 @@
+import fs from 'fs';
+import graceful from 'node-graceful';
+import HomeDir from '../../../../src/config/HomeDir.js';
+import BaseCommand from '../../../../src/oclif/command/BaseCommand.js';
+import ResetCommand from '../../../../src/commands/reset.js';
+import GroupResetCommand from '../../../../src/commands/group/reset.js';
+
+class MutatingCommand extends BaseCommand {
+  static mutatesConfig = true;
+}
+
+describe('BaseCommand', () => {
+  describe('#init', () => {
+    function createCommandWithContainer(sinon, Command = MutatingCommand) {
+      const configFile = {
+        isChanged: sinon.stub().returns(false),
+      };
+      const configFileRepository = {
+        acquire: sinon.stub(),
+        readAndMigrate: sinon.stub().returns({ configFile }),
+        release: sinon.stub(),
+        write: sinon.stub(),
+        isExclusive: () => true,
+      };
+      const dependencies = {
+        configFile,
+        configFileRepository,
+        startedContainers: {
+          getContainers: sinon.stub().returns([]),
+        },
+        stopAllContainers: sinon.stub().resolves(),
+        writeConfigTemplates: sinon.stub(),
+      };
+      const container = {
+        has: sinon.stub().callsFake((name) => name === 'configFile'),
+        register: sinon.stub(),
+        resolve: sinon.stub().callsFake((name) => dependencies[name]),
+      };
+      const command = new Command();
+      command.parse = sinon.stub().resolves({ args: {}, flags: {} });
+      command.createContainer = sinon.stub().resolves(container);
+
+      return {
+        command,
+        configFileRepository,
+        container,
+      };
+    }
+
+    beforeEach(function beforeEach() {
+      this.sinon.stub(graceful, 'on');
+    });
+
+    it('should acquire before reading and release after a successful command', async function it() {
+      const { command, configFileRepository } = createCommandWithContainer(this.sinon);
+
+      await command.init();
+
+      expect(configFileRepository.acquire).to.have.been.calledOnce();
+      expect(configFileRepository.readAndMigrate).to.have.been.calledOnce();
+      this.sinon.assert.callOrder(
+        configFileRepository.acquire,
+        configFileRepository.readAndMigrate,
+      );
+
+      await command.finally();
+
+      expect(configFileRepository.release).to.have.been.calledOnce();
+    });
+
+    it('should leave service-file repair to explicit config render', async function it() {
+      const { command, container } = createCommandWithContainer(this.sinon);
+
+      await command.init();
+
+      expect(container.resolve('writeConfigTemplates')).to.not.have.been.called();
+    });
+
+    it('should release after a failed command', async function it() {
+      const { command, configFileRepository } = createCommandWithContainer(this.sinon);
+
+      await command.init();
+      await command.finally(new Error('command failed'));
+
+      expect(configFileRepository.release).to.have.been.calledOnce();
+    });
+
+    it('should release when initialization throws after acquiring', async function it() {
+      const { command, configFileRepository } = createCommandWithContainer(this.sinon);
+      const initError = new Error('config read failed');
+      configFileRepository.readAndMigrate.throws(initError);
+
+      await expect(command.init()).to.be.rejectedWith(initError);
+      await command.finally(initError);
+
+      expect(configFileRepository.acquire).to.have.been.calledOnce();
+      expect(configFileRepository.release).to.have.been.calledOnce();
+    });
+
+    it('should not let an unrelated force flag skip config validation', async function it() {
+      const { command, configFileRepository } = createCommandWithContainer(
+        this.sinon,
+        BaseCommand,
+      );
+      command.parse.resolves({ args: {}, flags: { force: true } });
+
+      await command.init();
+
+      expect(configFileRepository.readAndMigrate.firstCall.args[0])
+        .to.deep.equal({ skipValidation: false });
+    });
+
+    it('should skip validation only for the config replaced by a forced total reset', async function it() {
+      const platformReset = createCommandWithContainer(this.sinon, ResetCommand);
+      platformReset.command.parse.resolves({
+        args: {},
+        flags: {
+          force: true, hard: true, platform: true, config: 'base',
+        },
+      });
+
+      await platformReset.command.init();
+
+      expect(platformReset.configFileRepository.readAndMigrate.firstCall.args[0])
+        .to.deep.equal({ skipValidation: false });
+
+      const totalReset = createCommandWithContainer(this.sinon, ResetCommand);
+      totalReset.command.parse.resolves({
+        args: {},
+        flags: {
+          force: true, hard: true, platform: false, config: 'base',
+        },
+      });
+
+      await totalReset.command.init();
+
+      const { skipValidation } = totalReset.configFileRepository.readAndMigrate.firstCall.args[0];
+
+      expect(skipValidation).to.be.a('function');
+      expect(skipValidation({ name: 'base', configFileData: {} })).to.be.true();
+      expect(skipValidation({ name: 'node1', configFileData: {} })).to.be.false();
+    });
+
+    it('should skip validation only for configs replaced by a forced group reset', async function it() {
+      const groupReset = createCommandWithContainer(this.sinon, GroupResetCommand);
+      groupReset.command.parse.resolves({
+        args: {},
+        flags: {
+          force: true, hard: true, platform: false, group: 'local',
+        },
+      });
+
+      await groupReset.command.init();
+
+      const { skipValidation } = groupReset.configFileRepository.readAndMigrate.firstCall.args[0];
+
+      expect(skipValidation).to.be.a('function');
+      expect(skipValidation({ options: { group: 'local' }, configFileData: {} })).to.be.true();
+      expect(skipValidation({ options: { group: 'other' }, configFileData: {} })).to.be.false();
+    });
+
+    it('should keep the command lease while graceful container cleanup runs', async function it() {
+      const homeDir = HomeDir.createTemp();
+      const previousHomeDir = process.env.DASHMATE_HOME_DIR;
+      let repository;
+      let release;
+
+      try {
+        process.env.DASHMATE_HOME_DIR = homeDir.getPath();
+
+        let exitHandler;
+        graceful.on.callsFake((event, handler) => {
+          if (event === 'exit') {
+            exitHandler = handler;
+          }
+        });
+
+        const command = new MutatingCommand();
+        command.parse = this.sinon.stub().resolves({ args: {}, flags: {} });
+
+        await command.init();
+
+        repository = command.container.resolve('configFileRepository');
+        release = this.sinon.spy(repository, 'release');
+
+        await exitHandler();
+
+        expect(release).to.not.have.been.called();
+        expect(fs.existsSync(homeDir.joinPath('.config.json.lock'))).to.be.true();
+      } finally {
+        if (release) {
+          release.wrappedMethod.call(repository);
+        }
+
+        if (previousHomeDir === undefined) {
+          delete process.env.DASHMATE_HOME_DIR;
+        } else {
+          process.env.DASHMATE_HOME_DIR = previousHomeDir;
+        }
+
+        homeDir.remove();
+      }
+    });
+  });
+
+  describe('#saveConfigAndStopContainers', () => {
+    let command;
+    let config;
+    let configFile;
+    let configFileRepository;
+    let writeConfigTemplates;
+    let stopAllContainers;
+    let startedContainers;
+
+    beforeEach(function beforeEach() {
+      config = {
+        isChanged: this.sinon.stub().returns(true),
+      };
+      configFile = {
+        isChanged: this.sinon.stub().returns(true),
+        getAllConfigs: this.sinon.stub().returns([config]),
+      };
+      configFileRepository = {
+        write: this.sinon.stub(),
+        isExclusive: () => true,
+      };
+      writeConfigTemplates = this.sinon.stub();
+      stopAllContainers = this.sinon.stub().resolves();
+      startedContainers = {
+        getContainers: this.sinon.stub().returns([]),
+      };
+
+      const dependencies = {
+        configFile,
+        configFileRepository,
+        startedContainers,
+        stopAllContainers,
+        writeConfigTemplates,
+      };
+
+      command = new MutatingCommand();
+      command.container = {
+        has: this.sinon.stub().callsFake((name) => name === 'configFile'),
+        resolve: this.sinon.stub().callsFake((name) => dependencies[name]),
+      };
+    });
+
+    it('should keep the saved config when template rendering fails', async function it() {
+      configFileRepository.write.callsFake(() => {
+        configFile.isChanged.returns(false);
+      });
+      writeConfigTemplates.onFirstCall().throws(new Error('template write failed'));
+
+      await expect(command.saveConfigAndStopContainers())
+        .to.be.rejectedWith('template write failed');
+
+      expect(configFileRepository.write).to.have.been.calledOnceWith(configFile);
+      expect(writeConfigTemplates).to.have.been.calledOnceWith(config);
+      this.sinon.assert.callOrder(configFileRepository.write, writeConfigTemplates);
+    });
+
+    // Check exclusivity before saving so a command whose lock was stolen does
+    // not persist or render its stale snapshot. With a live lease, JSON is
+    // saved before the derived service files are rendered.
+    it('should not render service files once the lock has been lost', async function it() {
+      configFileRepository.isExclusive = () => false;
+      // What saving does when the lease is gone: refuse, but first put the
+      // pending configuration somewhere the operator can get it back from.
+      configFileRepository.write.throws(new Error('Lost the lock; rescue written'));
+
+      await expect(command.saveConfigAndStopContainers())
+        .to.be.rejectedWith('Lost the lock; rescue written');
+
+      // The rescue is the only copy of work a completed setup already did out
+      // in the world, so the save has to be attempted even though it fails.
+      expect(configFileRepository.write).to.have.been.calledOnceWith(configFile);
+
+      // Rendering would overwrite service files the process that took the lock
+      // has already written from newer state.
+      expect(writeConfigTemplates).to.not.have.been.called();
+    });
+
+    it('should stop started containers when a refused config save throws', async function it() {
+      configFileRepository.write.throws(new Error('Lost the lock; rescue written'));
+
+      await expect(command.saveConfigAndStopContainers())
+        .to.be.rejectedWith('Lost the lock; rescue written');
+
+      expect(stopAllContainers).to.have.been.calledOnceWith([], { remove: true });
+    });
+
+    it('should not save the startup config for a non-mutating command', async function it() {
+      const nonMutatingCommand = new BaseCommand();
+      nonMutatingCommand.container = command.container;
+
+      await nonMutatingCommand.saveConfigAndStopContainers();
+
+      expect(configFileRepository.write).to.not.have.been.called();
+      expect(writeConfigTemplates).to.not.have.been.called();
+    });
+  });
+});
diff --git a/packages/dashmate/test/unit/ssl/configureSSLCertificateTaskFactory.spec.js b/packages/dashmate/test/unit/ssl/configureSSLCertificateTaskFactory.spec.js
new file mode 100644
index 00000000000..6b2d8acedcb
--- /dev/null
+++ b/packages/dashmate/test/unit/ssl/configureSSLCertificateTaskFactory.spec.js
@@ -0,0 +1,48 @@
+import { SSL_PROVIDERS } from '../../../src/constants.js';
+import configureSSLCertificateTaskFactory
+  from '../../../src/listr/tasks/setup/regular/configureSSLCertificateTaskFactory.js';
+
+describe('configureSSLCertificateTaskFactory', () => {
+  it('should checkpoint a ZeroSSL certificate created during setup', async function it() {
+    const config = {
+      set: this.sinon.stub(),
+    };
+    const configFile = {
+      setConfig: this.sinon.stub(),
+    };
+    const configFileRepository = {
+      write: this.sinon.stub(),
+    };
+    const obtainZeroSSLCertificateTask = this.sinon.stub()
+      .callsFake((taskConfig, { onCertificateCreated }) => {
+        onCertificateCreated();
+        return 'obtain-task';
+      });
+    const configureSSLCertificateTask = configureSSLCertificateTaskFactory(
+      this.sinon.stub(),
+      obtainZeroSSLCertificateTask,
+      this.sinon.stub(),
+      this.sinon.stub(),
+      configFile,
+      configFileRepository,
+    );
+    const context = {
+      certificateProvider: SSL_PROVIDERS.ZEROSSL,
+      config,
+      nodeType: 'fullnode',
+      preset: 'testnet',
+    };
+    const tasks = configureSSLCertificateTask();
+    const providerTasks = await tasks.tasks[0].task(context, {
+      prompt: this.sinon.stub(),
+    });
+
+    const result = await providerTasks.tasks[0].task(context, {
+      prompt: this.sinon.stub().resolves('api-key'),
+    });
+
+    expect(result).to.equal('obtain-task');
+    expect(configFile.setConfig).to.have.been.calledOnceWith(config);
+    expect(configFileRepository.write).to.have.been.calledOnceWith(configFile);
+  });
+});
diff --git a/packages/dashmate/test/unit/ssl/letsencrypt/obtainLetsEncryptCertificateTaskFactory.spec.js b/packages/dashmate/test/unit/ssl/letsencrypt/obtainLetsEncryptCertificateTaskFactory.spec.js
new file mode 100644
index 00000000000..5fe7b95e497
--- /dev/null
+++ b/packages/dashmate/test/unit/ssl/letsencrypt/obtainLetsEncryptCertificateTaskFactory.spec.js
@@ -0,0 +1,278 @@
+import fs from 'fs';
+import path from 'path';
+import { Listr } from 'listr2';
+import HomeDir from '../../../../src/config/HomeDir.js';
+import obtainLetsEncryptCertificateTaskFactory from '../../../../src/listr/tasks/ssl/letsencrypt/obtainLetsEncryptCertificateTaskFactory.js';
+import getBaseConfigFactory from '../../../../configs/defaults/getBaseConfigFactory.js';
+
+describe('obtainLetsEncryptCertificateTaskFactory', () => {
+  it('should reject a plaintext ACME directory before lego starts', async function it() {
+    const homeDir = HomeDir.createTemp();
+
+    try {
+      const config = getBaseConfigFactory(homeDir)();
+      const options = config.getStoredOptions();
+      options.externalIp = '127.0.0.1';
+      options.platform.gateway.ssl.providerConfigs.letsencrypt.email = 'operator@example.com';
+      options.platform.gateway.ssl.providerConfigs.letsencrypt.acmeDirectoryUrl = 'http://acme.example/directory';
+      config.setOptions(options, true);
+
+      const missingContainerError = new Error('container not found');
+      missingContainerError.statusCode = 404;
+      const docker = {
+        getContainer: this.sinon.stub().rejects(missingContainerError),
+        createContainer: this.sinon.stub().throws(new Error('lego was started')),
+      };
+      const obtainCertificateTask = obtainLetsEncryptCertificateTaskFactory(
+        docker,
+        this.sinon.stub().resolves(),
+        { addContainer: this.sinon.stub() },
+        homeDir,
+        this.sinon.stub(),
+        this.sinon.stub(),
+        null,
+        {},
+      )(config);
+
+      await expect(obtainCertificateTask.run({ force: true }))
+        .to.be.rejectedWith('ACME directory URL must use HTTPS');
+
+      expect(docker.createContainer).to.not.have.been.called();
+    } finally {
+      homeDir.remove();
+    }
+  });
+
+  it('should not change config when a valid certificate pair is already installed', async function it() {
+    const homeDir = HomeDir.createTemp();
+
+    try {
+      const config = getBaseConfigFactory(homeDir)();
+      config.set('externalIp', '127.0.0.1');
+      config.set('platform.gateway.ssl.enabled', true);
+      config.set('platform.gateway.ssl.provider', 'letsencrypt');
+      config.set(
+        'platform.gateway.ssl.providerConfigs.letsencrypt.email',
+        'operator@example.com',
+      );
+      config.markAsSaved();
+
+      const validateLetsEncryptCertificate = this.sinon.stub().resolves({
+        data: {
+          certificate: {
+            expires: new Date('2026-10-01T00:00:00.000Z'),
+          },
+          isCertificatePairInstalled: true,
+        },
+      });
+      const saveCertificateTask = this.sinon.stub();
+      const obtainCertificateTask = obtainLetsEncryptCertificateTaskFactory(
+        {},
+        this.sinon.stub(),
+        { addContainer: this.sinon.stub() },
+        homeDir,
+        validateLetsEncryptCertificate,
+        saveCertificateTask,
+        null,
+        {},
+      )(config);
+
+      await obtainCertificateTask.run();
+
+      expect(config.isChanged()).to.be.false();
+      expect(saveCertificateTask).to.not.have.been.called();
+    } finally {
+      homeDir.remove();
+    }
+  });
+
+  it('should select Let’s Encrypt when its valid pair is installed but not configured', async function it() {
+    const homeDir = HomeDir.createTemp();
+
+    try {
+      const config = getBaseConfigFactory(homeDir)();
+      config.set('externalIp', '127.0.0.1');
+      config.set(
+        'platform.gateway.ssl.providerConfigs.letsencrypt.email',
+        'operator@example.com',
+      );
+      config.markAsSaved();
+
+      const validateLetsEncryptCertificate = this.sinon.stub().resolves({
+        data: {
+          certificate: {
+            expires: new Date('2026-10-01T00:00:00.000Z'),
+          },
+          isCertificatePairInstalled: true,
+        },
+      });
+      const saveCertificateTask = this.sinon.stub();
+      const obtainCertificateTask = obtainLetsEncryptCertificateTaskFactory(
+        {},
+        this.sinon.stub(),
+        { addContainer: this.sinon.stub() },
+        homeDir,
+        validateLetsEncryptCertificate,
+        saveCertificateTask,
+        null,
+        {},
+      )(config);
+
+      await obtainCertificateTask.run();
+
+      expect(config.get('platform.gateway.ssl.enabled')).to.be.true();
+      expect(config.get('platform.gateway.ssl.provider')).to.equal('letsencrypt');
+      expect(saveCertificateTask).to.not.have.been.called();
+    } finally {
+      homeDir.remove();
+    }
+  });
+
+  it('should not select Let’s Encrypt when saving certificate files fails', async function it() {
+    const homeDir = HomeDir.createTemp();
+
+    try {
+      const config = getBaseConfigFactory(homeDir)();
+      config.set('externalIp', '127.0.0.1');
+      config.set(
+        'platform.gateway.ssl.providerConfigs.letsencrypt.email',
+        'operator@example.com',
+      );
+
+      const missingContainerError = new Error('container not found');
+      missingContainerError.statusCode = 404;
+      const docker = {
+        getContainer: this.sinon.stub().rejects(missingContainerError),
+        createContainer: this.sinon.stub(),
+      };
+      const externalIp = config.get('externalIp');
+      const legoCertificatesDir = homeDir.joinPath(
+        config.getName(),
+        'platform',
+        'gateway',
+        'lego',
+        'certificates',
+      );
+      const container = {
+        start: this.sinon.stub().resolves(),
+        wait: this.sinon.stub().callsFake(async () => {
+          fs.writeFileSync(path.join(legoCertificatesDir, `${externalIp}.crt`), 'certificate');
+          fs.writeFileSync(path.join(legoCertificatesDir, `${externalIp}.key`), 'private-key');
+
+          return { StatusCode: 0 };
+        }),
+      };
+      docker.createContainer.resolves(container);
+
+      const saveCertificateTask = this.sinon.stub().returns(new Listr([
+        {
+          task: async () => {
+            throw new Error('save failed');
+          },
+        },
+      ]));
+      const obtainCertificateTask = obtainLetsEncryptCertificateTaskFactory(
+        docker,
+        this.sinon.stub().resolves(),
+        { addContainer: this.sinon.stub() },
+        homeDir,
+        this.sinon.stub(),
+        saveCertificateTask,
+        null,
+        {},
+      )(config);
+
+      await expect(obtainCertificateTask.run({ force: true }))
+        .to.be.rejectedWith('save failed');
+
+      expect(config.get('platform.gateway.ssl.enabled')).to.be.false();
+      expect(config.get('platform.gateway.ssl.provider')).to.equal('zerossl');
+    } finally {
+      homeDir.remove();
+    }
+  });
+
+  it('should finish installing an already issued certificate after a save failure', async function it() {
+    const homeDir = HomeDir.createTemp();
+
+    try {
+      const config = getBaseConfigFactory(homeDir)();
+      config.set('externalIp', '127.0.0.1');
+      config.set(
+        'platform.gateway.ssl.providerConfigs.letsencrypt.email',
+        'operator@example.com',
+      );
+
+      const externalIp = config.get('externalIp');
+      const legoCertificatesDir = homeDir.joinPath(
+        config.getName(),
+        'platform',
+        'gateway',
+        'lego',
+        'certificates',
+      );
+      fs.mkdirSync(legoCertificatesDir, { recursive: true });
+      const legoCertPath = path.join(legoCertificatesDir, `${externalIp}.crt`);
+      const legoKeyPath = path.join(legoCertificatesDir, `${externalIp}.key`);
+      fs.writeFileSync(legoCertPath, 'certificate');
+      fs.writeFileSync(legoKeyPath, 'private-key');
+
+      const validateLetsEncryptCertificate = this.sinon.stub().resolves({
+        data: {
+          certificate: {
+            expires: new Date('2026-10-01T00:00:00.000Z'),
+          },
+          isBundleFilePresent: true,
+          isCertificatePairInstalled: false,
+          isPrivateKeyFilePresent: true,
+          legoCertPath,
+          legoKeyPath,
+        },
+      });
+      let saveAttempts = 0;
+      const saveCertificateTask = this.sinon.stub().callsFake(() => new Listr([
+        {
+          task: async () => {
+            saveAttempts += 1;
+
+            if (saveAttempts === 1) {
+              throw new Error('save failed');
+            }
+
+            config.set('platform.gateway.ssl.enabled', true);
+          },
+        },
+      ]));
+      const missingContainerError = new Error('container not found');
+      missingContainerError.statusCode = 404;
+      const docker = {
+        getContainer: this.sinon.stub().rejects(missingContainerError),
+        createContainer: this.sinon.stub().resolves({
+          start: this.sinon.stub().resolves(),
+          wait: this.sinon.stub().resolves({ StatusCode: 0 }),
+        }),
+      };
+      const obtainCertificateTask = obtainLetsEncryptCertificateTaskFactory(
+        docker,
+        this.sinon.stub(),
+        { addContainer: this.sinon.stub() },
+        homeDir,
+        validateLetsEncryptCertificate,
+        saveCertificateTask,
+        null,
+        {},
+      );
+
+      await expect(obtainCertificateTask(config).run({ force: true }))
+        .to.be.rejectedWith('save failed');
+      await expect(obtainCertificateTask(config).run())
+        .to.not.be.rejected();
+
+      expect(saveCertificateTask).to.have.been.calledTwice();
+      expect(config.get('platform.gateway.ssl.enabled')).to.be.true();
+      expect(config.get('platform.gateway.ssl.provider')).to.equal('letsencrypt');
+    } finally {
+      homeDir.remove();
+    }
+  });
+});
diff --git a/packages/dashmate/test/unit/ssl/saveCertificateTask.spec.js b/packages/dashmate/test/unit/ssl/saveCertificateTask.spec.js
new file mode 100644
index 00000000000..a6c85ac61ab
--- /dev/null
+++ b/packages/dashmate/test/unit/ssl/saveCertificateTask.spec.js
@@ -0,0 +1,161 @@
+import fs from 'fs';
+import path from 'path';
+import graceful from 'node-graceful';
+import HomeDir from '../../../src/config/HomeDir.js';
+import getBaseConfigFactory from '../../../configs/defaults/getBaseConfigFactory.js';
+import saveCertificateTaskFactory from '../../../src/listr/tasks/ssl/saveCertificateTask.js';
+
+describe('saveCertificateTaskFactory', () => {
+  let homeDir;
+  let config;
+  let certificatesDir;
+  let certificatePath;
+  let keyPath;
+  let previousUmask;
+
+  beforeEach(() => {
+    previousUmask = process.umask(0o022);
+    homeDir = HomeDir.createTemp();
+    config = getBaseConfigFactory(homeDir)();
+    config.set('platform.gateway.ssl.enabled', true);
+    certificatesDir = homeDir.joinPath(
+      config.getName(),
+      'platform',
+      'gateway',
+      'ssl',
+    );
+    certificatePath = path.join(certificatesDir, 'bundle.crt');
+    keyPath = path.join(certificatesDir, 'private.key');
+  });
+
+  afterEach(() => {
+    process.umask(previousUmask);
+    homeDir.remove();
+  });
+
+  async function savePair() {
+    const task = saveCertificateTaskFactory(homeDir)(config);
+
+    await task.run({
+      certificateFile: 'new-certificate',
+      privateKeyFile: 'new-key',
+    });
+  }
+
+  function mode(filePath) {
+    // eslint-disable-next-line no-bitwise
+    return fs.statSync(filePath).mode & 0o777;
+  }
+
+  it('should create a private key with mode 0600', async () => {
+    await savePair();
+
+    expect(mode(keyPath)).to.equal(0o600);
+  });
+
+  it('should preserve existing certificate and key modes when replacing them', async () => {
+    fs.mkdirSync(certificatesDir, { recursive: true });
+    fs.writeFileSync(certificatePath, 'old-certificate');
+    fs.writeFileSync(keyPath, 'old-key');
+    fs.chmodSync(certificatePath, 0o640);
+    fs.chmodSync(keyPath, 0o600);
+
+    await savePair();
+
+    expect(mode(certificatePath)).to.equal(0o640);
+    expect(mode(keyPath)).to.equal(0o600);
+  });
+
+  // A node set up before Dashmate chose a mode carries a private key readable
+  // by every local account. Renewal is the only thing that touches the file
+  // again, so preserving what it finds would leave that key exposed for the
+  // life of the node.
+  it('should tighten a private key left group- and world-readable by an older version', async () => {
+    fs.mkdirSync(certificatesDir, { recursive: true });
+    fs.writeFileSync(certificatePath, 'old-certificate');
+    fs.writeFileSync(keyPath, 'old-key');
+    fs.chmodSync(keyPath, 0o644);
+
+    await savePair();
+
+    expect(mode(keyPath)).to.equal(0o600);
+  });
+
+  it('should keep a private key mode stricter than Dashmate would choose', async () => {
+    fs.mkdirSync(certificatesDir, { recursive: true });
+    fs.writeFileSync(certificatePath, 'old-certificate');
+    fs.writeFileSync(keyPath, 'old-key');
+    fs.chmodSync(keyPath, 0o400);
+
+    await savePair();
+
+    expect(mode(keyPath)).to.equal(0o400);
+  });
+
+  it('should restore the previous certificate pair and modes when saving the key fails', async function it() {
+    fs.mkdirSync(certificatesDir, { recursive: true });
+    fs.writeFileSync(certificatePath, 'old-certificate');
+    fs.writeFileSync(keyPath, 'old-key');
+    fs.chmodSync(certificatePath, 0o640);
+    fs.chmodSync(keyPath, 0o600);
+
+    const originalRenameSync = fs.renameSync.bind(fs);
+    this.sinon.stub(fs, 'renameSync').callsFake((source, destination) => {
+      if (destination === keyPath) {
+        throw new Error('key replace failed');
+      }
+
+      return originalRenameSync(source, destination);
+    });
+
+    await expect(savePair()).to.be.rejectedWith('key replace failed');
+
+    expect(fs.readFileSync(certificatePath, 'utf8')).to.equal('old-certificate');
+    expect(fs.readFileSync(keyPath, 'utf8')).to.equal('old-key');
+    expect(mode(certificatePath)).to.equal(0o640);
+    expect(mode(keyPath)).to.equal(0o600);
+    expect(fs.readdirSync(certificatesDir).filter((name) => name.includes('.tmp-')))
+      .to.be.empty();
+    expect(config.get('platform.gateway.ssl.enabled')).to.be.true();
+  });
+
+  it('should sweep stale certificate temp files before writing', async () => {
+    fs.mkdirSync(certificatesDir, { recursive: true });
+    fs.writeFileSync(path.join(certificatesDir, 'bundle.crt.tmp-stale'), 'old-certificate');
+    fs.writeFileSync(path.join(certificatesDir, 'private.key.tmp-stale'), 'old-key');
+
+    await savePair();
+
+    expect(fs.readdirSync(certificatesDir).filter((name) => name.includes('.tmp-')))
+      .to.be.empty();
+  });
+
+  it('should remove active certificate temp files from the graceful exit handler', async function it() {
+    let exitHandler;
+    const unsubscribe = this.sinon.stub();
+    this.sinon.stub(graceful, 'on').callsFake((event, handler) => {
+      expect(event).to.equal('exit');
+      exitHandler = handler;
+      return unsubscribe;
+    });
+
+    const originalRenameSync = fs.renameSync.bind(fs);
+    this.sinon.stub(fs, 'renameSync').callsFake((source, destination) => {
+      if (destination === certificatePath) {
+        expect(exitHandler).to.be.a('function');
+        expect(fs.existsSync(source)).to.be.true();
+        exitHandler();
+        expect(fs.existsSync(source)).to.be.false();
+        throw new Error('exit cleanup observed');
+      }
+
+      return originalRenameSync(source, destination);
+    });
+
+    await expect(savePair()).to.be.rejectedWith('exit cleanup observed');
+
+    expect(unsubscribe).to.have.been.calledOnce();
+    expect(fs.readdirSync(certificatesDir).filter((name) => name.includes('.tmp-')))
+      .to.be.empty();
+  });
+});
diff --git a/packages/dashmate/test/unit/ssl/zerossl/obtainZeroSSLCertificateTaskFactory.spec.js b/packages/dashmate/test/unit/ssl/zerossl/obtainZeroSSLCertificateTaskFactory.spec.js
index 12bbb460e05..5c7feb47988 100644
--- a/packages/dashmate/test/unit/ssl/zerossl/obtainZeroSSLCertificateTaskFactory.spec.js
+++ b/packages/dashmate/test/unit/ssl/zerossl/obtainZeroSSLCertificateTaskFactory.spec.js
@@ -1,4 +1,10 @@
+import fs from 'fs';
 import obtainZeroSSLCertificateTaskFactory from '../../../../src/listr/tasks/ssl/zerossl/obtainZeroSSLCertificateTaskFactory.js';
+import HomeDir from '../../../../src/config/HomeDir.js';
+import ConfigFile from '../../../../src/config/configFile/ConfigFile.js';
+import ConfigFileJsonRepository from '../../../../src/config/configFile/ConfigFileJsonRepository.js';
+import getBaseConfigFactory from '../../../../configs/defaults/getBaseConfigFactory.js';
+import { ERRORS } from '../../../../src/ssl/zerossl/validateZeroSslCertificateFactory.js';
 
 describe('obtainZeroSSLCertificateTaskFactory', () => {
   let config;
@@ -37,13 +43,13 @@ describe('obtainZeroSSLCertificateTaskFactory', () => {
       verificationServer,
       { joinPath: this.sinon.stub() }, // homeDir
       validateZeroSslCertificate,
-      { write: this.sinon.stub() }, // configFileRepository
-      {}, // configFile
     );
   });
 
-  it('should stop and destroy the verification server when the pipeline fails', async () => {
-    const tasks = obtainZeroSSLCertificateTask(config);
+  it('should stop and destroy the verification server when the pipeline fails', async function it() {
+    const tasks = obtainZeroSSLCertificateTask(config, {
+      onCertificateCreated: this.sinon.stub(),
+    });
 
     let thrownError;
     try {
@@ -61,4 +67,255 @@ describe('obtainZeroSSLCertificateTaskFactory', () => {
     expect(verificationServer.stop).to.have.been.called();
     expect(verificationServer.destroy).to.have.been.called();
   });
+
+  it('should defer SSL persistence until command finalization', async function it() {
+    const homeDir = HomeDir.createTemp();
+
+    try {
+      const realConfig = getBaseConfigFactory(homeDir)();
+      const configFile = new ConfigFile(
+        [realConfig],
+        '4.1.0',
+        'abcdef12',
+        realConfig.getName(),
+        null,
+      );
+      const configFilePath = homeDir.joinPath('config.json');
+
+      fs.writeFileSync(
+        configFilePath,
+        `${JSON.stringify(configFile.toObject(), undefined, 2)}\n`,
+        'utf8',
+      );
+
+      const repository = new ConfigFileJsonRepository(
+        (data) => data,
+        homeDir,
+        () => null,
+      );
+      const sslConfigDir = homeDir.joinPath('ssl');
+      const validate = this.sinon.stub().resolves({
+        error: ERRORS.CERTIFICATE_ID_IS_NOT_SET,
+        data: {
+          apiKey: 'api-key',
+          bundleFilePath: homeDir.joinPath('bundle.crt'),
+          certificate: null,
+          csr: 'certificate-request',
+          csrFilePath: homeDir.joinPath('certificate.csr'),
+          externalIp: '127.0.0.1',
+          isBundleFilePresent: true,
+          isCsrFilePresent: true,
+          isPrivateKeyFilePresent: true,
+          privateKeyFilePath: homeDir.joinPath('private.key'),
+          sslConfigDir,
+        },
+      });
+      const createCertificate = this.sinon.stub().resolves({
+        id: 'certificate-id-000000000000000000',
+        status: 'issued',
+      });
+      const task = obtainZeroSSLCertificateTaskFactory(
+        this.sinon.stub(),
+        this.sinon.stub(),
+        createCertificate,
+        this.sinon.stub(),
+        this.sinon.stub(),
+        this.sinon.stub(),
+        this.sinon.stub(),
+        this.sinon.stub(),
+        verificationServer,
+        homeDir,
+        validate,
+      )(realConfig, {
+        onCertificateCreated: this.sinon.stub(),
+      });
+
+      await task.run({ expirationDays: 30 });
+
+      expect(realConfig.isChanged()).to.be.true();
+      expect(repository.read().getConfig(realConfig.getName())
+        .get('platform.gateway.ssl.enabled')).to.be.false();
+      expect(repository.read().getConfig(realConfig.getName())
+        .get('platform.gateway.ssl.providerConfigs.zerossl.id')).to.equal(null);
+    } finally {
+      homeDir.remove();
+    }
+  });
+
+  it('should not enable SSL when verification fails after creating a certificate', async function it() {
+    const homeDir = HomeDir.createTemp();
+
+    try {
+      const realConfig = getBaseConfigFactory(homeDir)();
+      const configFile = new ConfigFile(
+        [realConfig],
+        '4.1.0',
+        'abcdef12',
+        realConfig.getName(),
+        null,
+      );
+      const repository = new ConfigFileJsonRepository(
+        (data) => data,
+        homeDir,
+        () => null,
+      );
+      repository.write(configFile);
+
+      const validate = this.sinon.stub().resolves({
+        error: ERRORS.CERTIFICATE_ID_IS_NOT_SET,
+        data: {
+          apiKey: 'api-key',
+          bundleFilePath: homeDir.joinPath('bundle.crt'),
+          certificate: null,
+          csrFilePath: homeDir.joinPath('certificate.csr'),
+          externalIp: '127.0.0.1',
+          isBundleFilePresent: false,
+          isCsrFilePresent: false,
+          isPrivateKeyFilePresent: false,
+          privateKeyFilePath: homeDir.joinPath('private.key'),
+          sslConfigDir: homeDir.joinPath('ssl'),
+        },
+      });
+      const verifyDomain = this.sinon.stub().rejects(new Error('verification failed'));
+      const task = obtainZeroSSLCertificateTaskFactory(
+        this.sinon.stub().resolves('certificate-request'),
+        this.sinon.stub().resolves({ privateKey: 'private-key' }),
+        this.sinon.stub().resolves({
+          id: 'certificate-id-000000000000000000',
+          status: 'pending_validation',
+          validation: {
+            other_methods: {
+              '127.0.0.1': {
+                file_validation_url_http: 'http://127.0.0.1/verification',
+                file_validation_content: ['verification'],
+              },
+            },
+          },
+        }),
+        verifyDomain,
+        this.sinon.stub(),
+        this.sinon.stub(),
+        this.sinon.stub(),
+        this.sinon.stub(),
+        verificationServer,
+        homeDir,
+        validate,
+      )(realConfig, {
+        onCertificateCreated: this.sinon.stub(),
+      });
+
+      await expect(task.run({ expirationDays: 30, noRetry: true }))
+        .to.be.rejectedWith('verification failed');
+
+      expect(realConfig.get('platform.gateway.ssl.enabled')).to.be.false();
+      expect(realConfig.get('platform.gateway.ssl.providerConfigs.zerossl.id'))
+        .to.equal('certificate-id-000000000000000000');
+      expect(repository.read().getConfig(realConfig.getName())
+        .get('platform.gateway.ssl.enabled')).to.be.false();
+    } finally {
+      homeDir.remove();
+    }
+  });
+
+  it('should require a certificate-created persistence callback', () => {
+    expect(() => obtainZeroSSLCertificateTask(config))
+      .to.throw('onCertificateCreated callback is required');
+  });
+
+  it('should activate a resumed issued certificate', async function it() {
+    const homeDir = HomeDir.createTemp();
+
+    try {
+      const realConfig = getBaseConfigFactory(homeDir)();
+      realConfig.set('platform.gateway.ssl.provider', 'self-signed');
+      const validate = this.sinon.stub().resolves({
+        data: {
+          apiKey: 'api-key',
+          bundleFilePath: homeDir.joinPath('bundle.crt'),
+          certificate: {
+            expires: new Date('2026-10-01T00:00:00.000Z'),
+            status: 'issued',
+          },
+          csrFilePath: homeDir.joinPath('certificate.csr'),
+          externalIp: '127.0.0.1',
+          isBundleFilePresent: true,
+          isCsrFilePresent: true,
+          isPrivateKeyFilePresent: true,
+          privateKeyFilePath: homeDir.joinPath('private.key'),
+          sslConfigDir: homeDir.joinPath('ssl'),
+        },
+      });
+      const task = obtainZeroSSLCertificateTaskFactory(
+        this.sinon.stub(),
+        this.sinon.stub(),
+        this.sinon.stub(),
+        this.sinon.stub(),
+        this.sinon.stub(),
+        this.sinon.stub(),
+        this.sinon.stub(),
+        this.sinon.stub(),
+        verificationServer,
+        homeDir,
+        validate,
+      )(realConfig, {
+        onCertificateCreated: this.sinon.stub(),
+      });
+
+      await task.run({ expirationDays: 30 });
+
+      expect(realConfig.get('platform.gateway.ssl.enabled')).to.be.true();
+      expect(realConfig.get('platform.gateway.ssl.provider')).to.equal('zerossl');
+    } finally {
+      homeDir.remove();
+    }
+  });
+
+  it('should create the ZeroSSL private key with mode 0600', async function it() {
+    const homeDir = HomeDir.createTemp();
+
+    try {
+      const realConfig = getBaseConfigFactory(homeDir)();
+      const privateKeyFilePath = homeDir.joinPath('ssl', 'private.key');
+      const validate = this.sinon.stub().resolves({
+        error: ERRORS.CERTIFICATE_ID_IS_NOT_SET,
+        data: {
+          apiKey: 'api-key',
+          bundleFilePath: homeDir.joinPath('ssl', 'bundle.crt'),
+          certificate: null,
+          csrFilePath: homeDir.joinPath('ssl', 'certificate.csr'),
+          externalIp: '127.0.0.1',
+          isBundleFilePresent: true,
+          isCsrFilePresent: false,
+          isPrivateKeyFilePresent: false,
+          privateKeyFilePath,
+          sslConfigDir: homeDir.joinPath('ssl'),
+        },
+      });
+      const task = obtainZeroSSLCertificateTaskFactory(
+        this.sinon.stub().resolves('certificate-request'),
+        this.sinon.stub().resolves({ privateKey: 'private-key' }),
+        this.sinon.stub().resolves({
+          id: 'certificate-id-000000000000000000',
+          status: 'issued',
+        }),
+        this.sinon.stub(),
+        this.sinon.stub(),
+        this.sinon.stub(),
+        this.sinon.stub(),
+        this.sinon.stub(),
+        verificationServer,
+        homeDir,
+        validate,
+      )(realConfig, {
+        onCertificateCreated: this.sinon.stub(),
+      });
+
+      await task.run({ expirationDays: 30 });
+
+      // eslint-disable-next-line no-bitwise
+      expect(fs.statSync(privateKeyFilePath).mode & 0o777).to.equal(0o600);
+    } finally {
+      homeDir.remove();
+    }
+  });
 });
diff --git a/packages/dashmate/test/unit/tasks/startGroupNodesTaskFactory.spec.js b/packages/dashmate/test/unit/tasks/startGroupNodesTaskFactory.spec.js
new file mode 100644
index 00000000000..6d833c747d4
--- /dev/null
+++ b/packages/dashmate/test/unit/tasks/startGroupNodesTaskFactory.spec.js
@@ -0,0 +1,121 @@
+import fs from 'fs';
+import HomeDir from '../../../src/config/HomeDir.js';
+import ConfigFile from '../../../src/config/configFile/ConfigFile.js';
+import ConfigFileJsonRepository from '../../../src/config/configFile/ConfigFileJsonRepository.js';
+import getBaseConfigFactory from '../../../configs/defaults/getBaseConfigFactory.js';
+import startGroupNodesTaskFactory from '../../../src/listr/tasks/startGroupNodesTaskFactory.js';
+import { NETWORK_LOCAL } from '../../../src/constants.js';
+
+describe('startGroupNodesTaskFactory', () => {
+  let homeDir;
+  let configFileRepository;
+  let dockerCompose;
+  let startGroupNodesTask;
+  let writeConfigTemplates;
+  let renderedConfig;
+  let renderedWhileLocked;
+  let renderedAfterSave;
+
+  function createMinerConfig(address) {
+    const config = getBaseConfigFactory(homeDir)();
+
+    config.set('network', NETWORK_LOCAL);
+    config.set('group', 'local');
+    config.set('core.miner.enable', true);
+    config.set('core.miner.address', address);
+
+    return config;
+  }
+
+  function seedConfigFile(config) {
+    const configFile = new ConfigFile(
+      [config],
+      '4.1.0',
+      'abcdef12',
+      config.getName(),
+      'local',
+    );
+
+    fs.writeFileSync(
+      homeDir.joinPath('config.json'),
+      `${JSON.stringify(configFile.toObject(), undefined, 2)}\n`,
+      'utf8',
+    );
+  }
+
+  beforeEach(function beforeEach() {
+    homeDir = HomeDir.createTemp();
+    configFileRepository = new ConfigFileJsonRepository(
+      (data) => data,
+      homeDir,
+      () => null,
+    );
+    dockerCompose = {
+      execCommand: this.sinon.stub().resolves(),
+    };
+    renderedConfig = null;
+    renderedWhileLocked = false;
+    renderedAfterSave = false;
+    writeConfigTemplates = this.sinon.stub().callsFake((config) => {
+      renderedConfig = config;
+      renderedWhileLocked = fs.existsSync(homeDir.joinPath('.config.json.lock'));
+      renderedAfterSave = configFileRepository.read()
+        .getConfig(config.getName())
+        .get('core.miner.address') === config.get('core.miner.address');
+    });
+
+    startGroupNodesTask = startGroupNodesTaskFactory(
+      dockerCompose,
+      this.sinon.stub().resolves(),
+      this.sinon.stub().resolves(),
+      this.sinon.stub().returns({}),
+      {},
+      this.sinon.stub().resolves(),
+      this.sinon.stub().resolves(),
+      this.sinon.stub().resolves(),
+      this.sinon.stub().resolves('127.0.0.1'),
+      configFileRepository,
+      writeConfigTemplates,
+    );
+  });
+
+  afterEach(() => {
+    homeDir.remove();
+  });
+
+  it('should persist a generated miner address instead of relying on command finalization', async () => {
+    const minerConfig = createMinerConfig(null);
+    seedConfigFile(minerConfig);
+
+    await startGroupNodesTask([minerConfig]).run({ waitForReadiness: false });
+
+    const persistedAddress = configFileRepository.read()
+      .getConfig(minerConfig.getName())
+      .get('core.miner.address');
+
+    expect(persistedAddress).to.be.a('string').and.not.empty();
+    expect(minerConfig.get('core.miner.address')).to.equal(persistedAddress);
+    expect(dockerCompose.execCommand.firstCall.args[2][2]).to.include(persistedAddress);
+    expect(writeConfigTemplates).to.have.been.calledOnce();
+    expect(renderedConfig.get('core.miner.address')).to.equal(persistedAddress);
+    expect(renderedWhileLocked).to.be.true();
+    expect(renderedAfterSave).to.be.true();
+  });
+
+  it('should use an address set after the command loaded its config', async () => {
+    const minerConfig = createMinerConfig(null);
+    const freshConfig = createMinerConfig('yM6vM3D8R3g7v2YVnN9VqQqxv3ZQGQy2jS');
+    seedConfigFile(freshConfig);
+
+    await startGroupNodesTask([minerConfig]).run({ waitForReadiness: false });
+
+    expect(minerConfig.get('core.miner.address'))
+      .to.equal('yM6vM3D8R3g7v2YVnN9VqQqxv3ZQGQy2jS');
+    expect(dockerCompose.execCommand.firstCall.args[2][2])
+      .to.include('yM6vM3D8R3g7v2YVnN9VqQqxv3ZQGQy2jS');
+    expect(writeConfigTemplates).to.have.been.calledOnce();
+    expect(renderedConfig.get('core.miner.address'))
+      .to.equal('yM6vM3D8R3g7v2YVnN9VqQqxv3ZQGQy2jS');
+    expect(renderedWhileLocked).to.be.true();
+  });
+});
diff --git a/packages/dashmate/test/unit/templates/writeConfigTemplatesFactory.spec.js b/packages/dashmate/test/unit/templates/writeConfigTemplatesFactory.spec.js
new file mode 100644
index 00000000000..28b2bbb80c0
--- /dev/null
+++ b/packages/dashmate/test/unit/templates/writeConfigTemplatesFactory.spec.js
@@ -0,0 +1,23 @@
+import writeConfigTemplatesFactory from '../../../src/templates/writeConfigTemplatesFactory.js';
+
+describe('writeConfigTemplatesFactory', () => {
+  it('should mark the config saved only after writing its service files', function it() {
+    const config = {
+      getName: this.sinon.stub().returns('base'),
+      markAsSaved: this.sinon.stub(),
+    };
+    const serviceConfigs = { core: 'rendered' };
+    const renderServiceTemplates = this.sinon.stub().returns(serviceConfigs);
+    const writeServiceConfigs = this.sinon.stub();
+    const writeConfigTemplates = writeConfigTemplatesFactory(
+      renderServiceTemplates,
+      writeServiceConfigs,
+    );
+
+    writeConfigTemplates(config);
+
+    expect(writeServiceConfigs).to.have.been.calledOnceWithExactly('base', serviceConfigs);
+    expect(config.markAsSaved).to.have.been.calledOnce();
+    expect(writeServiceConfigs).to.have.been.calledBefore(config.markAsSaved);
+  });
+});
diff --git a/yarn.lock b/yarn.lock
index c21621aecb0..659b772ef72 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -7351,6 +7351,7 @@ __metadata:
     oclif: "npm:^4.0.3"
     pretty-bytes: "npm:^5.3.0"
     pretty-ms: "npm:^7.0.0"
+    proper-lockfile: "npm:^4.1.2"
     public-ip: "npm:^6.0.1"
     qs: "npm:^6.14.2"
     rxjs: "npm:^6.6.7"
@@ -7361,6 +7362,7 @@ __metadata:
     table: "npm:^6.8.1"
     tar: "npm:7.5.10"
     wrap-ansi: "npm:^7.0.0"
+    write-file-atomic: "npm:^5.0.1"
   bin:
     dashmate: ./bin/run.js
   languageName: unknown
@@ -14769,6 +14771,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"proper-lockfile@npm:^4.1.2":
+  version: 4.1.2
+  resolution: "proper-lockfile@npm:4.1.2"
+  dependencies:
+    graceful-fs: "npm:^4.2.4"
+    retry: "npm:^0.12.0"
+    signal-exit: "npm:^3.0.2"
+  checksum: 10/000a4875f543f591872b36ca94531af8a6463ddb0174f41c0b004d19e231d7445268b422ff1ea595e43d238655c702250cd3d27f408e7b9d97b56f1533ba26bf
+  languageName: node
+  linkType: hard
+
 "protobufjs@npm:^6.11.4":
   version: 6.11.4
   resolution: "protobufjs@npm:6.11.4"
@@ -18741,6 +18754,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"write-file-atomic@npm:^5.0.1":
+  version: 5.0.1
+  resolution: "write-file-atomic@npm:5.0.1"
+  dependencies:
+    imurmurhash: "npm:^0.1.4"
+    signal-exit: "npm:^4.0.1"
+  checksum: 10/648efddba54d478d0e4330ab6f239976df3b9752b123db5dc9405d9b5af768fa9d70ce60c52fdbe61d1200d24350bc4fbcbaf09288496c2be050de126bd95b7e
+  languageName: node
+  linkType: hard
+
 "ws@npm:^8.17.1":
   version: 8.17.1
   resolution: "ws@npm:8.17.1"