diff --git a/deploy/gcp/main.tf b/deploy/gcp/main.tf
index 0b2c309..e51ae74 100644
--- a/deploy/gcp/main.tf
+++ b/deploy/gcp/main.tf
@@ -221,11 +221,23 @@ resource "google_compute_backend_service" "roach" {
   }
 }
 
+# A new domain needs a new certificate. The proxy uses the old one until
+# the new one exists, so each certificate gets its own name.
+resource "random_id" "certificate" {
+  byte_length = 4
+  keepers = {
+    domain = var.domain
+  }
+}
+
 resource "google_compute_managed_ssl_certificate" "roach" {
-  name = "roach"
+  name = "roach-${random_id.certificate.hex}"
   managed {
     domains = [var.domain]
   }
+  lifecycle {
+    create_before_destroy = true
+  }
 }
 
 resource "google_compute_target_ssl_proxy" "roach" {