sudo certbot renew --quiet --deploy-hook 'systemctl reload nginx'

The cron-friendly form: --quiet suppresses all output except errors, and --deploy-hook runs the quoted command only when a certificate was actually renewed — the hook makes nginx pick up the new certificate files. Because it runs only on real renewal, it is safe on a nightly schedule. This mirrors what the packaged certbot timer does.