diff --git a/roles/lego/files/lego_run.sh b/roles/lego/files/lego_run.sh
index 63be0e8..4fd4c35 100644
--- a/roles/lego/files/lego_run.sh
+++ b/roles/lego/files/lego_run.sh
@@ -15,7 +15,7 @@ if [[ -n "${LEGO_HTTP_FALLBACK_PORT:-}" ]]; then
 fi
 
 if [[ -n "${LEGO_PRE_RENEWAL_HOOK:-}" ]]; then
-  $LEGO_PRE_RENEWAL_HOOK
+  /usr/bin/env bash -c "$LEGO_PRE_RENEWAL_HOOK"
 fi
 
 LEGO_COMMAND_ARGS_EXPANDED=$(bash -c "echo $LEGO_COMMAND_ARGS") # This is a bit icky
@@ -31,5 +31,5 @@ find "$LEGO_CERT_STORE_PATH/certificates" -type f | xargs -I{} -n 1 chmod "$LEGO
 find "$LEGO_CERT_STORE_PATH/certificates" -type f | xargs -I{} -n 1 chown "${LEGO_CERT_USER}:${LEGO_CERT_GROUP}" "{}"
 
 if [[ -n "${LEGO_POST_RENEWAL_HOOK:-}" ]]; then
-  $LEGO_POST_RENEWAL_HOOK
+  /usr/bin/env bash -c "$LEGO_POST_RENEWAL_HOOK"
 fi