diff --git a/tools/nextwks.sh b/tools/nextwks.sh
index 0fe311f..f6296a0 100755
--- a/tools/nextwks.sh
+++ b/tools/nextwks.sh
@@ -187,7 +187,14 @@ export PATH=$PATH:/usr/local/go/bin
 CGO_ENABLED=0 go build -o nextworkspace .
 
 # ============================================================
-# 5. CREATE target & backup directories (as root)
+# 5. STOP containers (all modes — binary is mounted, must stop before copy)
+# ============================================================
+echo "[*] Stopping containers..."
+podman stop caddy authelia launcher 2>/dev/null || true
+sleep 1
+
+# ============================================================
+# 6. CREATE target & backup directories (as root)
 # ============================================================
 maybe_sudo mkdir -p "$TARGET_DIR/config/caddy" "$TARGET_DIR/config/authelia" \
          "$TARGET_DIR/data/caddy" "$TARGET_DIR/data/authelia" \
@@ -196,7 +203,7 @@ maybe_sudo mkdir -p "$TARGET_DIR/config/caddy" "$TARGET_DIR/config/authelia" \
          "$BACKUP_DIR"
 
 # ============================================================
-# 6. TEARDOWN (destroy mode only — wipes target dir)
+# 7. TEARDOWN (destroy mode only — wipes target dir)
 # ============================================================
 if [ "$MODE" = "destroy" ]; then
     echo "[*] Full teardown..."
@@ -213,7 +220,7 @@ if [ "$MODE" = "destroy" ]; then
 fi
 
 # ============================================================
-# 7. COPY artifacts to target (as root)
+# 8. COPY artifacts to target (as root)
 # ============================================================
 echo "[*] Copying artifacts..."
 maybe_sudo cp nextworkspace "$TARGET_DIR/nextworkspace"
@@ -235,7 +242,7 @@ if [ -f "$BACKUP_DIR/.env" ]; then
 fi
 
 # ============================================================
-# 8. GENERATE config files with placeholder substitution
+# 9. GENERATE config files with placeholder substitution
 #    Write to /tmp first, then sudo cp to target
 # ============================================================
 GEN_DIR=$(mktemp -d)
@@ -288,7 +295,7 @@ if [ "$MODE" != "update" ]; then
 fi
 
 # ============================================================
-# 9. FIX OWNERSHIP — all files in TARGET_DIR/BACKUP_DIR to user
+# 10. FIX OWNERSHIP — all files in TARGET_DIR/BACKUP_DIR to user
 # ============================================================
 RUN_USER="${SUDO_USER:-${USER}}"
 echo "[*] Setting file ownership to $RUN_USER..."
@@ -296,7 +303,7 @@ maybe_sudo chown -R "$RUN_USER:" "$TARGET_DIR" 2>/dev/null || true
 maybe_sudo chown -R "$RUN_USER:" "$BACKUP_DIR" 2>/dev/null || true
 
 # ============================================================
-# 10. DEPLOY stack (rootless podman — no sudo!)
+# 11. DEPLOY stack (rootless podman — no sudo!)
 # ============================================================
 echo "[*] Deploying containers on $NETWORK_NAME..."
 
@@ -319,7 +326,7 @@ sleep 1
 podman-compose -f "$TARGET_DIR/compose/stack.yaml" up -d 2>&1 || echo "[WARN] Stack deploy had issues"
 
 # ============================================================
-# 11. HEALTH CHECK
+# 12. HEALTH CHECK
 # ============================================================
 echo "[*] Running health check..."
 for i in $(seq 1 $HEALTH_CHECK_RETRIES); do