PhotoPrism rotates its session HMAC key on every container start, so any auto-deploy that recreated pp-app invalidated in-flight OIDC logins. The deploy script was force-recreating + image-pulling on each push; pinned both so pp-app survives a routine code deploy.