diff --git a/functions/renew.py b/functions/renew.py
index 268e7e8..dba45b5 100644
--- a/functions/renew.py
+++ b/functions/renew.py
@@ -4,9 +4,48 @@ Let's Encrypt certificate renewal gate.
 
 from __future__ import annotations
 
+from functions.common import log
+from functions.common import replace_exactly_once
+
+
+RENEW_FUNCTION_ANCHOR = '''\trenew: async (access, data) => {
+'''
+
+RENEW_GATE_FRAGMENT = '''\trenew: async (access, data) => {
+\t\trequireAcmeAuthority();
+'''
+
+RENEW_GATE_CALL = "\t\trequireAcmeAuthority();"
+
 
 def apply(source: str) -> str:
     """
     Gate internalCertificate.renew() before renewal dispatch.
     """
-    raise NotImplementedError("renew gate not implemented yet")
+
+    if RENEW_GATE_FRAGMENT in source:
+        log("renew_gate=already-present")
+        return source
+
+    source = replace_exactly_once(
+        source,
+        RENEW_FUNCTION_ANCHOR,
+        RENEW_GATE_FRAGMENT,
+        description="renew gate",
+    )
+
+    log("renew_gate=added")
+    return source
+
+
+def verify(source: str) -> None:
+    """
+    Verify that renew() contains the authority gate.
+    """
+
+    if RENEW_GATE_FRAGMENT not in source:
+        raise RuntimeError(
+            "renew gate verification: authority check not found in renew()"
+        )
+
+    log("renew_gate_verification=passed")