diff --git a/app/Services/Traefik/SshTraefikWriter.php b/app/Services/Traefik/SshTraefikWriter.php
index d30b099..7ed516c 100644
--- a/app/Services/Traefik/SshTraefikWriter.php
+++ b/app/Services/Traefik/SshTraefikWriter.php
@@ -35,7 +35,14 @@ class SshTraefikWriter implements TraefikWriter
 
     public function certReachable(string $fqdn): bool
     {
-        return Http::timeout(5)->connectTimeout(5)->get("https://{$fqdn}/status.php")->successful();
+        // While DNS propagates / Traefik warms up, the client throws
+        // (ConnectionException, TLS) — that's "not ready yet", not a hard error,
+        // so the step keeps polling instead of burning the retry budget.
+        try {
+            return Http::timeout(5)->connectTimeout(5)->get("https://{$fqdn}/status.php")->successful();
+        } catch (\Throwable) {
+            return false;
+        }
     }
 
     private function render(string $subdomain, string $fqdn, string $targetHost): string