diff --git a/package-lock.json b/package-lock.json
index e2a72d6..a23433d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "domcloud-bridge",
-  "version": "0.48.0",
+  "version": "0.48.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "domcloud-bridge",
-      "version": "0.48.0",
+      "version": "0.48.1",
       "license": "MIT",
       "dependencies": {
         "axios": "^1.6.8",
diff --git a/package.json b/package.json
index 6c4ddb2..db2e0da 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "domcloud-bridge",
-  "version": "0.48.0",
+  "version": "0.48.1",
   "description": "Deployment runner for DOM Cloud",
   "main": "app.js",
   "engines": {
diff --git a/src/executor/runnersub.js b/src/executor/runnersub.js
index 3dfee8a..b5d2318 100644
--- a/src/executor/runnersub.js
+++ b/src/executor/runnersub.js
@@ -180,8 +180,8 @@ export async function runConfigSubdomain(config, domaindata, subdomain, sshExec,
                         });
                     }
                     // if LE ON AND force self-sign / shared on, must turn off
-                    // if it was shared, just assume that's also LE ON
-                } else if ((selfSignSsl || sharedSSL) && ((subdomaindata['SSL shared with'] && changed) || subdomaindata['Lets Encrypt renewal'] == 'Enabled')) {
+                    // if it was shared or ssl path don't match, just assume that's also LE ON
+                } else if ((selfSignSsl || sharedSSL) && ((subdomaindata['SSL shared with'] && changed && !expectedSslMode) || subdomaindata['Lets Encrypt renewal'] == 'Enabled')) {
                     await writeLog("$> Generating self signed cert and turning off let's encrypt renewal");
                     await virtExec("generate-cert", {
                         domain: subdomain,