diff --git a/services/asterisk.sh b/services/asterisk.sh
index 29cf2ba..25be8ea 100644
--- a/services/asterisk.sh
+++ b/services/asterisk.sh
@@ -426,6 +426,28 @@ fi' ./docker/entrypoint.sh
     else
         log_warning "entrypoint.sh cert-regen check changed upstream — a stale-domain cert won't auto-regenerate. Update the sed patch in this installer."
     fi
+
+    # noload the two voicemail storage backends this repo never configures.
+    # Vendor's entrypoint regenerates /etc/asterisk/modules.conf on EVERY
+    # container start (see the "always regenerated" comment right above this
+    # heredoc in entrypoint.sh) — that file is bind-mounted to this repo's own
+    # config/asterisk/modules.conf, so anything written there at install time
+    # gets silently clobbered within seconds of the container coming up.
+    # Confirmed live: app_voicemail.so, app_voicemail_imap.so, and
+    # app_voicemail_odbc.so all autoload by default and collide registering
+    # the same application/function names (VoiceMail, VoiceMailMain, VM_INFO,
+    # etc.) on every single start, with app_voicemail.so — the only backend
+    # this repo ever configures, via voicemail.conf's file-based [default]
+    # mailboxes — losing that race and failing to load at all. The fix has to
+    # land in the template that generates the live file, not the file itself.
+    if grep -q '^noload => format_ogg_opus.so$' ./docker/entrypoint.sh; then
+        sed -i '/^noload => format_ogg_opus.so$/a\
+noload => app_voicemail_imap.so\
+noload => app_voicemail_odbc.so' \
+            ./docker/entrypoint.sh
+    else
+        log_warning "entrypoint.sh modules.conf template changed upstream — app_voicemail_imap/_odbc will still collide with app_voicemail.so. Update the sed patch in this installer."
+    fi
 }
 
 # ── Shared: log rotation for logs/full (unbounded otherwise) ──────────────
@@ -1063,40 +1085,13 @@ operator=no
 EOF
 }
 
-# The easy-asterisk image ships app_voicemail.so, app_voicemail_imap.so, and
-# app_voicemail_odbc.so all autoloading by default — three alternative
-# storage backends for the SAME application (VoiceMail, VoiceMailMain,
-# VM_INFO, etc.), which collide registering those names against each other
-# on every single Asterisk start. Confirmed live: this box's own log on
-# every restart shows "Already have an application 'VoiceMail'" (and every
-# sibling app/function) followed by "app_voicemail.c:15897 load_module:
-# Failure registering applications, functions or tests" — app_voicemail
-# never actually finishes loading, on every install using this script, not
-# something specific to one box or one extension. This repo only ever uses
-# the plain file-based backend (voicemail.conf's [default] mailboxes,
-# written above), so noload the other two — modules.conf lands in the same
-# already-bind-mounted config/asterisk directory, no new volume needed.
-# Regenerated on every install/update (unlike voicemail.conf) since it
-# carries no per-install state of its own.
-_asterisk_write_modules_conf() {
-    local FILE="$1"
-    cat > "$FILE" << 'EOF'
-; services/asterisk.sh — regenerated on every install/update; edit there,
-; not here directly.
-;
-; app_voicemail_imap/_odbc are alternative voicemail storage backends this
-; repo never configures (no IMAP/ODBC settings are ever written) — loading
-; them alongside the plain file-based app_voicemail.so makes all three
-; collide registering the same application/function names, and
-; app_voicemail.so is the one that ends up losing that race and failing to
-; load at all. noload the two unused backends so the one actually
-; configured (file-based, via voicemail.conf) loads cleanly.
-[modules]
-autoload=yes
-noload => app_voicemail_imap.so
-noload => app_voicemail_odbc.so
-EOF
-}
+# NOTE: modules.conf is NOT written from here. Vendor's entrypoint.sh
+# regenerates /etc/asterisk/modules.conf (bind-mounted to this repo's own
+# config/asterisk/modules.conf) unconditionally on every container start, so
+# a host-side write at install time gets clobbered within seconds regardless
+# of what it contains. The app_voicemail_imap/_odbc noload fix lives in
+# _asterisk_refresh_vendor_files()'s sed patch against the vendor template
+# instead — see the comment there for the full "Confirmed live" writeup.
 
 # Same anchor-position reasoning as _asterisk_patch_messaging_vendor_files:
 # Same anchor as messaging's own patch (see the comment above
@@ -2056,10 +2051,9 @@ install_asterisk() {
                 _asterisk_patch_voicemail_vendor_files "$EA_DIR"
                 _asterisk_write_voicemail_dialplan "$EA_DIR/config/asterisk/voicemail-dialplan.conf"
                 _asterisk_write_voicemail_conf "$EA_DIR/config/asterisk/voicemail.conf"
-                _asterisk_write_modules_conf "$EA_DIR/config/asterisk/modules.conf"
                 _asterisk_ensure_live_voicemail_include "$EA_DIR" "$CONTAINER"
                 ensure_docker_dir_ownership "$EA_DIR/config/asterisk"
-                chmod 644 "$EA_DIR/config/asterisk/messaging-dialplan.conf" "$EA_DIR/config/asterisk/voicemail-dialplan.conf" "$EA_DIR/config/asterisk/modules.conf"
+                chmod 644 "$EA_DIR/config/asterisk/messaging-dialplan.conf" "$EA_DIR/config/asterisk/voicemail-dialplan.conf"
 
                 log_info "Rebuilding and restarting containers..."
                 if docker compose up -d --build --force-recreate; then
@@ -2152,10 +2146,9 @@ install_asterisk() {
     _asterisk_patch_voicemail_vendor_files "$EA_DIR"
     _asterisk_write_voicemail_dialplan "$EA_DIR/config/asterisk/voicemail-dialplan.conf"
     _asterisk_write_voicemail_conf "$EA_DIR/config/asterisk/voicemail.conf"
-    _asterisk_write_modules_conf "$EA_DIR/config/asterisk/modules.conf"
     _asterisk_ensure_live_voicemail_include "$EA_DIR" "$CONTAINER"
     ensure_docker_dir_ownership "$EA_DIR/config/asterisk"
-    chmod 644 "$EA_DIR/config/asterisk/messaging-dialplan.conf" "$EA_DIR/config/asterisk/voicemail-dialplan.conf" "$EA_DIR/config/asterisk/modules.conf"
+    chmod 644 "$EA_DIR/config/asterisk/messaging-dialplan.conf" "$EA_DIR/config/asterisk/voicemail-dialplan.conf"
 
     # ── Domain / networking mode ──────────────────────────────────────────────
     # A public cloud box is always reachable from anywhere, so there's no