diff --git a/spinifex/handlers/acm/renewal.go b/spinifex/handlers/acm/renewal.go
index 9c2fda8d3..3c92be453 100644
--- a/spinifex/handlers/acm/renewal.go
+++ b/spinifex/handlers/acm/renewal.go
@@ -393,6 +393,11 @@ func (w *Worker) ForceRenewCertificate(ctx context.Context, input *ForceRenewCer
 	if err != nil {
 		return nil, fmt.Errorf("get renewed cert: %w", err)
 	}
+	// An absent record reads back as (nil, nil): the certificate was deleted
+	// between the ownership check and this re-read.
+	if renewed == nil {
+		return nil, errors.New(awserrors.ErrorResourceNotFound)
+	}
 	if renewed.RenewalSummary != nil && renewed.RenewalSummary.RenewalStatus == acm.RenewalStatusFailed {
 		return nil, fmt.Errorf("acm renewal: %s: %s", renewed.RenewalSummary.RenewalStatusReason, input.CertificateArn)
 	}