Turns out I forgot I had enabled a new feature (dynamic firewall) on my Turris router a while back. I feel like I did this long enough ago it wasn't a problem at the last renewal, but people are reporting issues with it blocking Let's Encrypt. I removed the feature and certbot succeeded. All is good now.

https://forum.turris.cz/t/dynamic-firewall-blocks-lets-encrypt-renewals/16876