diff --git a/deploy.sh b/deploy.sh
index 9041977..ed0d5a8 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -15,6 +15,13 @@ git pull origin main
 
 echo ""
 echo "=== Building: $SERVICES ==="
+# ERPNext bakes the custom Frappe apps into its image, so they must be staged
+# into the build context (erpnext/<app>/) from the repo first. Without this,
+# `docker compose build erpnext` would use stale app copies and silently ship
+# old code (e.g. the set-password controller rename would never take effect).
+case " $SERVICES " in
+  *" erpnext "*) echo "--- staging custom Frappe apps ---"; bash erpnext/build.sh ;;
+esac
 docker compose build $SERVICES
 
 echo ""
diff --git a/erpnext/Dockerfile b/erpnext/Dockerfile
index 72e3127..25f5509 100644
--- a/erpnext/Dockerfile
+++ b/erpnext/Dockerfile
@@ -17,7 +17,11 @@ COPY --chown=frappe:frappe frappe_ca_registry/ apps/frappe_ca_registry/
 COPY --chown=frappe:frappe performancewest_erpnext/ apps/performancewest_erpnext/
 
 # Install the payments app (not in base image) + all custom apps
-RUN git clone --depth=1 https://github.com/frappe/payments.git apps/payments \
+# Pin payments to the version-15 branch. The default branch now requires
+# Python >=3.14, but the frappe/erpnext:v15 base ships Python 3.11, so an
+# unpinned clone breaks the build ("Package 'payments' requires a different
+# Python: 3.11.6 not in '>=3.14'").
+RUN git clone --depth=1 --branch version-15 https://github.com/frappe/payments.git apps/payments \
     && env/bin/pip install --quiet -e apps/payments \
     && env/bin/pip install --quiet -e apps/frappe_crypto \
     && env/bin/pip install --quiet -e apps/frappe_adyen \