diff --git a/CHANGELOG.md b/CHANGELOG.md
index fdd4e92..6dbcc13 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,8 @@
 
 ### Fixes
 
+- Add DNS propagation delay before ACME challenge validation
+
 ### Changes
 
 ## 0.2.0 (2026-04-12)
diff --git a/debian/changelog b/debian/changelog
index 2dd6ad8..d5b57b5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,6 +1,6 @@
 certforge (0.3.0-1) unstable; urgency=low
 
-  *
+  * Add DNS propagation delay before ACME challenge validation
 
  -- Roman Kivalin <roman@shl.dev>  Sat, 12 Apr 2026 22:30:00 +0000
 
diff --git a/src/renew.rs b/src/renew.rs
index e9d9e17..9bcd7c6 100644
--- a/src/renew.rs
+++ b/src/renew.rs
@@ -227,6 +227,10 @@ async fn renew_certificate(
 
     // Run the ACME order flow, ensuring TXT cleanup happens even on failure
     let order_result = async {
+        // Wait for DNS propagation
+        tracing::debug!("waiting 5s for DNS propagation");
+        tokio::time::sleep(std::time::Duration::from_secs(5)).await;
+
         // Tell ACME server challenges are ready
         tracing::debug!(name = %cert_config.name, "setting challenges ready");
         AcmeClient::set_challenges_ready(&mut order).await?;