diff --git a/letsencrypt-auto-source/letsencrypt-auto b/letsencrypt-auto-source/letsencrypt-auto
index 1f2dfcf85..72adfccb1 100755
--- a/letsencrypt-auto-source/letsencrypt-auto
+++ b/letsencrypt-auto-source/letsencrypt-auto
@@ -55,7 +55,7 @@ export CERTBOT_AUTO="$0"
 if test "`id -u`" -ne "0" ; then
   if command -v sudo 1>/dev/null 2>&1; then
     SUDO=sudo
-    SUDO_ENV="CERTBOT_AUTO=\"$0\""
+    SUDO_ENV="CERTBOT_AUTO=$0"
   else
     echo \"sudo\" is not available, will use \"su\" for installation steps...
     # Because the parameters in `su -c` has to be a string,
@@ -827,8 +827,16 @@ UNLIKELY_EOF
     echo "Installation succeeded."
   fi
   echo "Requesting root privileges to run certbot..."
-  echo "  " $SUDO $SUDO_ENV "$VENV_BIN/letsencrypt" "$@"
-  $SUDO $SUDO_ENV "$VENV_BIN/letsencrypt" "$@"
+  if [ -z "$SUDO_ENV" ] ; then
+    # SUDO is su wrapper / noop
+    echo "  " $SUDO "$VENV_BIN/letsencrypt" "$@"
+    $SUDO "$VENV_BIN/letsencrypt" "$@"
+  else
+    # sudo
+    echo "  " $SUDO "$SUDO_ENV" "$VENV_BIN/letsencrypt" "$@"
+    $SUDO "$SUDO_ENV" "$VENV_BIN/letsencrypt" "$@"
+  fi
+
 else
   # Phase 1: Upgrade letsencrypt-auto if neceesary, then self-invoke.
   #
diff --git a/letsencrypt-auto-source/letsencrypt-auto.template b/letsencrypt-auto-source/letsencrypt-auto.template
index 580ee7c07..4e32d8b4f 100755
--- a/letsencrypt-auto-source/letsencrypt-auto.template
+++ b/letsencrypt-auto-source/letsencrypt-auto.template
@@ -55,7 +55,7 @@ export CERTBOT_AUTO="$0"
 if test "`id -u`" -ne "0" ; then
   if command -v sudo 1>/dev/null 2>&1; then
     SUDO=sudo
-    SUDO_ENV="CERTBOT_AUTO=\"$0\""
+    SUDO_ENV="CERTBOT_AUTO=$0"
   else
     echo \"sudo\" is not available, will use \"su\" for installation steps...
     # Because the parameters in `su -c` has to be a string,
@@ -223,8 +223,16 @@ UNLIKELY_EOF
     echo "Installation succeeded."
   fi
   echo "Requesting root privileges to run certbot..."
-  echo "  " $SUDO $SUDO_ENV "$VENV_BIN/letsencrypt" "$@"
-  $SUDO $SUDO_ENV "$VENV_BIN/letsencrypt" "$@"
+  if [ -z "$SUDO_ENV" ] ; then
+    # SUDO is su wrapper / noop
+    echo "  " $SUDO "$VENV_BIN/letsencrypt" "$@"
+    $SUDO "$VENV_BIN/letsencrypt" "$@"
+  else
+    # sudo
+    echo "  " $SUDO "$SUDO_ENV" "$VENV_BIN/letsencrypt" "$@"
+    $SUDO "$SUDO_ENV" "$VENV_BIN/letsencrypt" "$@"
+  fi
+
 else
   # Phase 1: Upgrade letsencrypt-auto if neceesary, then self-invoke.
   #