diff --git a/AUTHORS.md b/AUTHORS.md
index 6ee739bc0..0e8d88a4d 100644
--- a/AUTHORS.md
+++ b/AUTHORS.md
@@ -75,6 +75,7 @@ Authors
 * [Fabian](https://github.com/faerbit)
 * [Faidon Liambotis](https://github.com/paravoid)
 * [Fan Jiang](https://github.com/tcz001)
+* [Felix Lechner](https://github.com/lechner)
 * [Felix Schwarz](https://github.com/FelixSchwarz)
 * [Felix Yan](https://github.com/felixonmars)
 * [Filip Ochnik](https://github.com/filipochnik)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8669d34a5..83e62c792 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,8 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
 
 * Renewal parameter `webroot_path` is always saved, avoiding some regressions
   when `webroot` authenticator plugin is invoked with no challenge to perform.
+* Scripts in Certbot hook directories are no longer executed when their
+  filenames end in a tilde.
 
 Despite us having broken lockstep, we are continuing to release new versions of
 all Certbot components during releases for the time being, however, the only
diff --git a/certbot/hooks.py b/certbot/hooks.py
index 7de846ae4..34e06e0a3 100644
--- a/certbot/hooks.py
+++ b/certbot/hooks.py
@@ -266,5 +266,6 @@ def list_hooks(dir_path):
     :rtype: sorted list of absolute paths to executables in dir_path
 
     """
-    paths = (os.path.join(dir_path, f) for f in os.listdir(dir_path))
-    return sorted(path for path in paths if util.is_exe(path))
+    allpaths = (os.path.join(dir_path, f) for f in os.listdir(dir_path))
+    hooks = [path for path in allpaths if util.is_exe(path) and not path.endswith('~')]
+    return sorted(hooks)
diff --git a/certbot/tests/hook_test.py b/certbot/tests/hook_test.py
index 2a3742aa2..2ed7d4229 100644
--- a/certbot/tests/hook_test.py
+++ b/certbot/tests/hook_test.py
@@ -480,6 +480,12 @@ class ListHooksTest(util.TempDirTestCase):
 
         self.assertEqual(self._call(self.tempdir), [name])
 
+    def test_ignore_tilde(self):
+        name = os.path.join(self.tempdir, "foo~")
+        create_hook(name)
+
+        self.assertEqual(self._call(self.tempdir), [])
+
 
 def create_hook(file_path):
     """Creates an executable file at the specified path.