diff --git a/ncc/main.py b/ncc/main.py
index a6c1cae..103c924 100644
--- a/ncc/main.py
+++ b/ncc/main.py
@@ -97,7 +97,13 @@ def cli():
     help="Try to fetch certificates and deploy",
 )
 @click.option("--skip-master-check", type=bool, is_flag=True)
-def up(certs_only: bool, skip_master_check: bool):
+@click.option(
+    "--skip-certs",
+    type=bool,
+    is_flag=True,
+    help="Do not fetch certificates",
+)
+def up(certs_only: bool, skip_master_check: bool, skip_certs: bool):
     """Deploy the configuration to the cluster
 
     Does the following:
@@ -123,20 +129,21 @@ def up(certs_only: bool, skip_master_check: bool):
                 Path(CONFIG["dehydrated_dir"]) / "domains.txt",
             )
 
-        ec, stdout = sysaction.run_shell(
-            (
-                str(dehydrated_dir / "dehydrated.sh"),
-                "-c",
-                *(["-g"] if certs_only else []),
-            ),
-            window_height=5,
-        )
-        if ec != 0:
-            log = Path(tempfile.mktemp())
-            log.write_text(stdout)
-            raise NccException(
-                f"dehydrated returned {ec} (log: {click.format_filename(log)})"
+        if not skip_certs:
+            ec, stdout = sysaction.run_shell(
+                (
+                    str(dehydrated_dir / "dehydrated.sh"),
+                    "-c",
+                    *(["-g"] if certs_only else []),
+                ),
+                window_height=5,
             )
+            if ec != 0:
+                log = Path(tempfile.mktemp())
+                log.write_text(stdout)
+                raise NccException(
+                    f"dehydrated returned {ec} (log: {click.format_filename(log)})"
+                )
 
         if not certs_only:
             ec, stdout = sysaction.run_shell(