diff --git a/scripts/node-onboarding/dpl-certbot-apparmor.service b/scripts/node-onboarding/dpl-certbot-apparmor.service
index 3d96645..c7b568a 100644
--- a/scripts/node-onboarding/dpl-certbot-apparmor.service
+++ b/scripts/node-onboarding/dpl-certbot-apparmor.service
@@ -1,6 +1,7 @@
 [Unit]
 Description=Load existing Certbot AppArmor profiles for DPL certificate operations
 After=local-fs.target
+RequiresMountsFor=/snap/core/current /snap/certbot/current /var/lib/snapd/apparmor/profiles
 Before=snap.certbot.renew.service
 ConditionPathExists=/var/lib/snapd/apparmor/profiles/snap.certbot.certbot
 
diff --git a/scripts/node-onboarding/load-certbot-apparmor.sh b/scripts/node-onboarding/load-certbot-apparmor.sh
index cf2d196..f856c97 100644
--- a/scripts/node-onboarding/load-certbot-apparmor.sh
+++ b/scripts/node-onboarding/load-certbot-apparmor.sh
@@ -11,7 +11,10 @@ directory=/var/lib/snapd/apparmor/profiles
 [[ -z $(find "$directory" -maxdepth 0 -perm /022 -print) ]] || exit 4
 [[ -f $directory/snap.certbot.certbot && -f $directory/snap.certbot.renew ]] || exit 5
 shopt -s nullglob
-profiles=("$directory"/snap.certbot.* "$directory"/snap-update-ns.certbot "$directory"/snap-confine.core.*)
+core=$(readlink -f /snap/core/current)
+[[ $core =~ ^/(var/lib/snapd/)?snap/core/([0-9]+)$ ]] || exit 5
+revision=${BASH_REMATCH[2]}
+profiles=("$directory"/snap.certbot.* "$directory"/snap-update-ns.certbot "$directory/snap-confine.core.$revision")
 (( ${#profiles[@]} >= 4 )) || exit 5
 # Validate every input before loading any profile. Never use complain/disable flags.
 for profile in "${profiles[@]}"; do