diff --git a/app/cmd/root.go b/app/cmd/root.go
index 18a5e75..d79c439 100644
--- a/app/cmd/root.go
+++ b/app/cmd/root.go
@@ -24,6 +24,7 @@ const (
 	appLogLevelEnv           = "HYSTERIA_LOG_LEVEL"
 	appLogFormatEnv          = "HYSTERIA_LOG_FORMAT"
 	appDisableUpdateCheckEnv = "HYSTERIA_DISABLE_UPDATE_CHECK"
+	appACMEDirEnv            = "HYSTERIA_ACME_DIR"
 )
 
 var (
diff --git a/app/cmd/server.go b/app/cmd/server.go
index 0240dbd..2d20022 100644
--- a/app/cmd/server.go
+++ b/app/cmd/server.go
@@ -232,7 +232,11 @@ func (c *serverConfig) fillTLSConfig(hyConfig *server.Config) error {
 		// ACME
 		dataDir := c.ACME.Dir
 		if dataDir == "" {
-			dataDir = "acme"
+			// If not specified in the config, check the environment variable
+			// before resorting to the default "acme" value. The main reason
+			// we have this is so that our setup script can set it to the
+			// user's home directory.
+			dataDir = envOrDefaultString(appACMEDirEnv, "acme")
 		}
 		cmCfg := &certmagic.Config{
 			RenewalWindowRatio: certmagic.DefaultRenewalWindowRatio,