diff --git a/cli/app/deploy.go b/cli/app/deploy.go
index edf8532f..fb72c0ec 100644
--- a/cli/app/deploy.go
+++ b/cli/app/deploy.go
@@ -97,6 +97,19 @@ recipes.
 			logrus.Fatal(err)
 		}
 
+		// NOTE(d1): check out specific version before dealing with secrets. This
+		// is because we need to deal with GetComposeFiles under the hood and these
+		// files change from version to version which therefore affects which
+		// secrets might be generated
+		version := deployedVersion
+		if specificVersion != "" {
+			version = specificVersion
+			logrus.Debugf("choosing %s as version to deploy", version)
+			if err := recipe.EnsureVersion(app.Recipe, version); err != nil {
+				logrus.Fatal(err)
+			}
+		}
+
 		secStats, err := secret.PollSecretsStatus(cl, app)
 		if err != nil {
 			logrus.Fatal(err)
@@ -116,15 +129,6 @@ recipes.
 			}
 		}
 
-		version := deployedVersion
-		if specificVersion != "" {
-			version = specificVersion
-			logrus.Debugf("choosing %s as version to deploy", version)
-			if err := recipe.EnsureVersion(app.Recipe, version); err != nil {
-				logrus.Fatal(err)
-			}
-		}
-
 		if !internal.Chaos && specificVersion == "" {
 			catl, err := recipe.ReadRecipeCatalogue(internal.Offline)
 			if err != nil {
diff --git a/tests/integration/app_deploy.bats b/tests/integration/app_deploy.bats
index 0df25675..ca546b51 100644
--- a/tests/integration/app_deploy.bats
+++ b/tests/integration/app_deploy.bats
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
 setup_file(){
+  load "$PWD/tests/integration/helpers/git"
   load "$PWD/tests/integration/helpers/common"
   _common_setup
   _add_server
@@ -362,6 +363,7 @@ teardown(){
   _reset_app
 }
 
+# bats test_tags=slow
 @test "recipe config comments not present in values" {
   run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input
   assert_success
@@ -370,3 +372,36 @@ teardown(){
   assert_success
   refute_output --partial 'should be removed'
 }
+
+# bats test_tags=slow
+@test "deploy specific version with incompatible HEAD" {
+  run sed -i 's/COMPOSE_FILE="compose.yml"/COMPOSE_FILE="compose.yml:compose.extra_secret.yml"/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run sed -i 's/#SECRET_EXTRA_PASS_VERSION=v1/SECRET_EXTRA_PASS_VERSION=v1/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app secret generate "$TEST_APP_DOMAIN" --all
+  assert_success
+  assert_output --partial 'extra_pass'
+
+  run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE/compose.extra_secret.yml"
+  assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE/compose.extra_secret.yml"
+
+  _git_commit
+
+  # NOTE(d1): 0.1.1+1.20.2 is a previous version which includes compose.extra_secret.yml
+  run $ABRA app deploy "$TEST_APP_DOMAIN" "0.1.1+1.20.2" --no-input --no-converge-checks
+  assert_success
+  refute_output --partial 'no such file or directory'
+
+  _undeploy_app
+  _reset_app
+
+  run $ABRA app secret rm "$TEST_APP_DOMAIN" --all
+  assert_success
+
+  _reset_recipe
+}
diff --git a/tests/integration/helpers/git.bash b/tests/integration/helpers/git.bash
index 2bde0df1..4a847fec 100644
--- a/tests/integration/helpers/git.bash
+++ b/tests/integration/helpers/git.bash
@@ -32,6 +32,7 @@ _reset_tags() {
 _set_git_author() {
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" config --local user.email test@example.com
   assert_success
+
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" config --local user.name test
   assert_success
 }
@@ -43,3 +44,11 @@ _latest_tag() {
 _latest_hash() {
   export LATEST_HASH=$(git -C "$ABRA_DIR/recipes/$TEST_RECIPE" log -1 --pretty=format:%h)
 }
+
+_git_commit() {
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" add .
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" commit -m "test: helpers/git.bash: _git_commit"
+  assert_success
+}