As it seems we were originally doing the right thing, and what we saw was probably a Certbot bug, I will revert to our old system behavior - and then I’ll post in the Certbot issue tracker when / if we see issues in the future.
I’ll try and remember to post back here if I run into something relevant.
I should probably start with posting this issue with redirects … It seems like a bug.