diff --git a/tests/integration/app_check.bats b/tests/integration/app_check.bats
index 6d5ea1c97..d1ee7b8d3 100644
--- a/tests/integration/app_check.bats
+++ b/tests/integration/app_check.bats
@@ -118,3 +118,20 @@ teardown(){
   assert_success
   assert_output --partial '❌'
 }
+
+# bats test_tags=slow
+@test "respects env version" {
+  tagHash=$(_get_tag_hash "0.1.0+1.20.0")
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" "0.1.0+1.20.0" --no-input --no-converge-checks
+  assert_success
+
+  run grep -q "TYPE=$TEST_RECIPE:0.1.0+1.20.0" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app check "$TEST_APP_DOMAIN"
+  assert_success
+
+  assert_equal $(_get_current_hash) "$tagHash"
+}
diff --git a/tests/integration/app_cmd.bats b/tests/integration/app_cmd.bats
index 1d4abc89d..9df0efbc9 100644
--- a/tests/integration/app_cmd.bats
+++ b/tests/integration/app_cmd.bats
@@ -187,6 +187,24 @@ test_cmd_export"
   assert_output --partial 'baz'
 }
 
+# bats test_tags=slow
+@test "respects env version" {
+  tagHash=$(_get_tag_hash "0.1.0+1.20.0")
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" "0.1.0+1.20.0" --no-input
+  assert_success
+
+  run grep -q "TYPE=$TEST_RECIPE:0.1.0+1.20.0" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app cmd "$TEST_APP_DOMAIN" app test_cmd
+  assert_success
+  assert_output --partial 'baz'
+
+  assert_equal $(_get_current_hash) "$tagHash"
+}
+
 # bats test_tags=slow
 @test "error if missing service" {
   _deploy_app
diff --git a/tests/integration/app_deploy.bats b/tests/integration/app_deploy.bats
index 8ba05f5da..c9f7c1123 100644
--- a/tests/integration/app_deploy.bats
+++ b/tests/integration/app_deploy.bats
@@ -325,8 +325,6 @@ teardown(){
 
 # bats test_tags=slow
 @test "deploy specific version with incompatible HEAD" {
-  skip "https://git.coopcloud.tech/coop-cloud/organising/issues/541"
-
   run sed -i 's/COMPOSE_FILE="compose.yml"/COMPOSE_FILE="compose.yml:compose.extra_secret.yml"/g' \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
@@ -352,6 +350,6 @@ teardown(){
 
   _undeploy_app
 
-  run $ABRA app secret rm "$TEST_APP_DOMAIN" --all --chaos
+  run $ABRA app secret rm "$TEST_APP_DOMAIN" --all
   assert_success
 }
diff --git a/tests/integration/app_deploy_env_version.bats b/tests/integration/app_deploy_env_version.bats
index 63d4d775b..0522ea057 100644
--- a/tests/integration/app_deploy_env_version.bats
+++ b/tests/integration/app_deploy_env_version.bats
@@ -78,3 +78,22 @@ teardown(){
   assert_success
   assert_output --partial '0.1.0+1.20.0'
 }
+
+# bats test_tags=slow
+@test "specific version overrides env version" {
+  run $ABRA app deploy "$TEST_APP_DOMAIN" "0.1.0+1.20.0" --no-input --no-converge-checks
+  assert_success
+
+  run grep -q "TYPE=$TEST_RECIPE:0.1.0+1.20.0" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" "0.2.0+1.21.0" \
+    --no-input --no-converge-checks --force --debug
+  assert_success
+  assert_output --partial "overriding env file version"
+
+  run grep -q "TYPE=$TEST_RECIPE:0.2.0+1.21.0" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+}
diff --git a/tests/integration/app_deploy_remote_recipes.bats b/tests/integration/app_deploy_remote_recipes.bats
index 56b6ce56c..c45819c0e 100644
--- a/tests/integration/app_deploy_remote_recipes.bats
+++ b/tests/integration/app_deploy_remote_recipes.bats
@@ -27,7 +27,7 @@ teardown(){
 
 # bats test_tags=slow
 @test "deploy remote recipe" {
-  run sed -i 's/TYPE=abra-test-recipe/TYPE=git.coopcloud.tech\/coop-cloud\/abra-test-recipe/g' \
+  run sed -i 's/TYPE=abra-test-recipe:.*/TYPE=git.coopcloud.tech\/coop-cloud\/abra-test-recipe/g' \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 
@@ -38,7 +38,7 @@ teardown(){
 
 # bats test_tags=slow
 @test "deploy remote recipe with version" {
-  run sed -i 's/TYPE=abra-test-recipe/TYPE=git.coopcloud.tech\/coop-cloud\/abra-test-recipe:0.2.0+1.21.0/g' \
+  run sed -i 's/TYPE=abra-test-recipe:.*/TYPE=git.coopcloud.tech\/coop-cloud\/abra-test-recipe:0.2.0+1.21.0/g' \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 
@@ -49,7 +49,7 @@ teardown(){
 
 # bats test_tags=slow
 @test "deploy remote recipe with chaos commit" {
-  run sed -i 's/TYPE=abra-test-recipe/TYPE=git.coopcloud.tech\/coop-cloud\/abra-test-recipe:1e83340e/g' \
+  run sed -i 's/TYPE=abra-test-recipe:.*/TYPE=git.coopcloud.tech\/coop-cloud\/abra-test-recipe:1e83340e/g' \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 
@@ -60,7 +60,7 @@ teardown(){
 
 # bats test_tags=slow
 @test "remote recipe version written to env" {
-  run sed -i 's/TYPE=abra-test-recipe/TYPE=git.coopcloud.tech\/coop-cloud\/abra-test-recipe/g' \
+  run sed -i 's/TYPE=abra-test-recipe:.*/TYPE=git.coopcloud.tech\/coop-cloud\/abra-test-recipe/g' \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 
diff --git a/tests/integration/app_env_version.bats b/tests/integration/app_env_version.bats
new file mode 100644
index 000000000..90743f654
--- /dev/null
+++ b/tests/integration/app_env_version.bats
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+setup_file(){
+  load "$PWD/tests/integration/helpers/common"
+  _common_setup
+  _add_server
+  _new_app
+}
+
+teardown_file(){
+  _rm_app
+  _rm_server
+  _reset_recipe
+}
+
+setup(){
+  load "$PWD/tests/integration/helpers/common"
+  _common_setup
+  _ensure_catalogue
+}
+
+teardown(){
+  _reset_app
+}
+
+@test "badly formatted env version bails out" {
+  run sed -i 's/TYPE=abra-test-recipe/TYPE=abra-test-recipe:0.2.0+1.21.0/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input --no-converge-checks
+  assert_failure
+  assert_output --partial 'seems invalid'
+}
+
+@test "invalid env version bails out" {
+  run sed -i 's/TYPE=abra-test-recipe:.*/TYPE=abra-test-recipe:DOESNTEXIST/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input --no-converge-checks
+  assert_failure
+  assert_output --partial 'not found'
+}
diff --git a/tests/integration/app_rollback_env_version.bats b/tests/integration/app_rollback_env_version.bats
index a06d22a42..bdb3ced38 100644
--- a/tests/integration/app_rollback_env_version.bats
+++ b/tests/integration/app_rollback_env_version.bats
@@ -32,9 +32,11 @@ teardown(){
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 
-  run $ABRA app rollback "$TEST_APP_DOMAIN" "0.1.0+1.20.0" --no-input --no-converge-checks
+  run $ABRA app rollback "$TEST_APP_DOMAIN" "0.1.0+1.20.0" \
+    --no-input --no-converge-checks --debug
   assert_success
   assert_output --partial "0.1.0+1.20.0"
+  assert_output --partial "overriding env file version"
 
   run grep -q "TYPE=abra-test-recipe:0.1.0+1.20.0" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
diff --git a/tests/integration/app_secret_env_version.bats b/tests/integration/app_secret_env_version.bats
new file mode 100644
index 000000000..de35e0401
--- /dev/null
+++ b/tests/integration/app_secret_env_version.bats
@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+
+setup_file(){
+  load "$PWD/tests/integration/helpers/common"
+  _common_setup
+  _add_server
+
+  # NOTE(d1): create new app without secrets
+  run $ABRA app new "$TEST_RECIPE" \
+    --no-input \
+    --server "$TEST_SERVER" \
+    --domain "$TEST_APP_DOMAIN"
+  assert_success
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+}
+
+teardown_file(){
+  _rm_app
+  _rm_server
+  _reset_recipe
+}
+
+setup(){
+  load "$PWD/tests/integration/helpers/common"
+  _common_setup
+}
+
+teardown(){
+  _reset_recipe
+  _reset_app
+
+  run $ABRA app secret rm "$TEST_APP_DOMAIN" --all --no-input
+}
+
+@test "generate: respect env version" {
+  tagHash=$(_get_tag_hash "0.2.0+1.21.0")
+
+  run sed -i 's/TYPE=abra-test-recipe:.*/TYPE=abra-test-recipe:0.2.0+1.21.0/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app secret generate "$TEST_APP_DOMAIN" --all
+  assert_success
+
+  assert_equal $(_get_current_hash) "$tagHash"
+}
+
+@test "insert: respect env version" { 
+  tagHash=$(_get_tag_hash "0.2.0+1.21.0")
+
+  run sed -i 's/TYPE=abra-test-recipe:.*/TYPE=abra-test-recipe:0.2.0+1.21.0/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app secret insert "$TEST_APP_DOMAIN" test_pass_one v1 foo
+  assert_success
+  assert_output --partial 'successfully stored on server'
+
+  assert_equal $(_get_current_hash) "$tagHash"
+}
+
+@test "rm: respect env version" { 
+  tagHash=$(_get_tag_hash "0.2.0+1.21.0")
+
+  run sed -i 's/TYPE=abra-test-recipe:.*/TYPE=abra-test-recipe:0.2.0+1.21.0/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+
+  assert_success
+  run $ABRA app secret generate "$TEST_APP_DOMAIN" --all
+  assert_success
+
+  run $ABRA app secret rm "$TEST_APP_DOMAIN" --all
+  assert_success
+
+  assert_equal $(_get_current_hash) "$tagHash"
+}
+
+@test "ls: respect env version" { 
+  tagHash=$(_get_tag_hash "0.2.0+1.21.0")
+
+  run sed -i 's/TYPE=abra-test-recipe:.*/TYPE=abra-test-recipe:0.2.0+1.21.0/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+
+  run $ABRA app secret generate "$TEST_APP_DOMAIN" --all
+  assert_success
+
+  run $ABRA app secret ls "$TEST_APP_DOMAIN"
+  assert_success
+  assert_output --partial 'true'
+
+  assert_equal $(_get_current_hash) "$tagHash"
+}
diff --git a/tests/integration/app_upgrade_env_version.bats b/tests/integration/app_upgrade_env_version.bats
index b4fa1c46d..292a121aa 100644
--- a/tests/integration/app_upgrade_env_version.bats
+++ b/tests/integration/app_upgrade_env_version.bats
@@ -31,9 +31,11 @@ teardown(){
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 
-  run $ABRA app upgrade "$TEST_APP_DOMAIN" "0.2.0+1.21.0" --no-input --no-converge-checks
+  run $ABRA app upgrade "$TEST_APP_DOMAIN" "0.2.0+1.21.0" \
+    --no-input --no-converge-checks --debug
   assert_success
   assert_output --partial "0.2.0+1.21.0"
+  assert_output --partial "overriding env file version"
 
   run grep -q "TYPE=abra-test-recipe:0.2.0+1.21.0" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"