The help says --deploy-hook has to start with the absolute path of the command but how can I use sudo with it because the web server needs that to see the new certificates? I'm running certbot as a different user than root.
You could include the full path to sudo, but this isn't necessary.
The certbot help text says the following:
the command’s first word must be the absolute pathname of an executable or one found via the PATH environment variable.
$PATH is a colon separated string of directories that are searched through for programs. It normally includes the directory that sudo is in.