diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
index e11b5e05c..5ddec3273 100644
--- a/ipaserver/install/cainstance.py
+++ b/ipaserver/install/cainstance.py
@@ -1533,6 +1533,8 @@ class CAInstance(DogtagInstance):
             logger.debug('ACME service is already deployed')
             return False
 
+        configure_acme_acls()
+
         # create ACME agent group (if not exist already) and user
         self.ensure_group(ACME_AGENT_GROUP, "ACME RA accounts")
         acme_user = f"acme-{self.fqdn}"
@@ -1857,6 +1859,21 @@ def configure_lightweight_ca_acls():
     return __add_acls(new_rules)
 
 
+def configure_acme_acls():
+    """Allow the ACME Agents to modify profiles."""
+
+    # The "execute" operation sounds scary, but it actually only allows
+    # revocation and unrevocation.  See CertResource.java and
+    # base/ca/shared/conf/acl.properties in the Dogtag source.
+
+    new_rules = [
+        'certServer.ca.certs:execute'
+        f':allow (execute) group="{ACME_AGENT_GROUP}"'
+        ':ACME Agents may execute cert operations',
+    ]
+    return __add_acls(new_rules)
+
+
 def __add_acls(new_rules):
     """Add the given Dogtag ACLs.