diff --git a/letsencrypt/Dockerfile b/letsencrypt/Dockerfile
index 05f554660..9252b13b6 100644
--- a/letsencrypt/Dockerfile
+++ b/letsencrypt/Dockerfile
@@ -4,6 +4,9 @@ FROM $BUILD_FROM
 # Allow pip to install packages system-wide on Debian
 ENV PIP_BREAK_SYSTEM_PACKAGES=1
 
+# Log the full date next to the time, bashio defaults to "%T" (time only)
+ENV LOG_TIMESTAMP="%Y-%m-%d %H:%M:%S"
+
 # setup base
 # certbot-dns-multi replaces most individual DNS plugins using lego
 # Only legacy plugins are kept for providers not supported by lego: gehirn, eurodns, noris
diff --git a/letsencrypt/rootfs/etc/services.d/lets-encrypt/run b/letsencrypt/rootfs/etc/services.d/lets-encrypt/run
index b0b35f910..d7b6ae855 100755
--- a/letsencrypt/rootfs/etc/services.d/lets-encrypt/run
+++ b/letsencrypt/rootfs/etc/services.d/lets-encrypt/run
@@ -28,6 +28,18 @@ TEST_CERT=$(bashio::config 'test_cert')
 VERBOSE=$(bashio::config 'verbose')
 FORCE_RENEW=$(bashio::config 'force_renew')
 
+# Prefix each line of a command's output with a timestamp, so certbot's output
+# is dated like the bashio::log messages around it. bashio writes to $LOG_FD,
+# a dup of the original stdout, so this only wraps the given command.
+timestamped() {
+    "$@" 2>&1 | while IFS= read -r line; do
+        printf '[%s] %s\n' "$(date +"${LOG_TIMESTAMP:-%Y-%m-%d %H:%M:%S}")" "${line}"
+    done
+    # The while loop always succeeds, so report the wrapped command's status instead.
+    local status="${PIPESTATUS[0]}"
+    return "${status}"
+}
+
 # Legacy providers not supported by lego/certbot-dns-multi
 LEGACY_PROVIDERS="dns-eurodns dns-gehirn dns-noris"
 
@@ -636,7 +648,7 @@ if bashio::config.has_value 'eab_kid' ; then
 fi
 
 # Generate a new certificate if necessary or expand a previous certificate if domains has changed
-certbot certonly --non-interactive --keep-until-expiring --expand \
+timestamped certbot certonly --non-interactive --keep-until-expiring --expand \
     --email "$EMAIL" --agree-tos \
     "${KEY_ARGUMENTS[@]}" \
     "${ADDITIONAL_ARGS[@]}" \