From 29d4a6221e70725b19af0f1661259afd6354fdaf Mon Sep 17 00:00:00 2001
From: Julian Sommer <115516918+juliansommer@users.noreply.github.com>
Date: Thu, 13 Aug 2026 11:55:38 +1000
Subject: [PATCH] fix: add nil check

---
 spinifex/handlers/acm/renewal.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/spinifex/handlers/acm/renewal.go b/spinifex/handlers/acm/renewal.go
index 9c2fda8d3..3c92be453 100644
--- a/spinifex/handlers/acm/renewal.go
+++ b/spinifex/handlers/acm/renewal.go
@@ -393,6 +393,11 @@ func (w *Worker) ForceRenewCertificate(ctx context.Context, input *ForceRenewCer
 	if err != nil {
 		return nil, fmt.Errorf("get renewed cert: %w", err)
 	}
+	// An absent record reads back as (nil, nil): the certificate was deleted
+	// between the ownership check and this re-read.
+	if renewed == nil {
+		return nil, errors.New(awserrors.ErrorResourceNotFound)
+	}
 	if renewed.RenewalSummary != nil && renewed.RenewalSummary.RenewalStatus == acm.RenewalStatusFailed {
 		return nil, fmt.Errorf("acm renewal: %s: %s", renewed.RenewalSummary.RenewalStatusReason, input.CertificateArn)
 	}