diff --git a/.github/workflows/build_image.yml b/.github/workflows/build_image.yml
index 76aa8c4986..476275a355 100644
--- a/.github/workflows/build_image.yml
+++ b/.github/workflows/build_image.yml
@@ -40,8 +40,6 @@ jobs:
           
       - name: Set Branch
         run: |
-          export APPS_JSON_PATH='${{ github.workspace }}/.github/helper/apps.json'
-          echo "APPS_JSON_BASE64=$(cat $APPS_JSON_PATH | base64 -w 0)" >> $GITHUB_ENV
           echo "FRAPPE_BRANCH=version-15" >> $GITHUB_ENV
 
       - name: Set Image Tag
@@ -63,4 +61,5 @@ jobs:
             ghcr.io/${{ github.repository }}:${{ env.IMAGE_TAG }}
           build-args: |
             "FRAPPE_BRANCH=${{ env.FRAPPE_BRANCH }}"
-            "APPS_JSON_BASE64=${{ env.APPS_JSON_BASE64 }}"
\ No newline at end of file
+          secret-files: |
+            apps_json=${{ github.workspace }}/.github/helper/apps.json
\ No newline at end of file
diff --git a/frontend/src/views/leave/Form.vue b/frontend/src/views/leave/Form.vue
index ec3bf00791..2e6b710a37 100644
--- a/frontend/src/views/leave/Form.vue
+++ b/frontend/src/views/leave/Form.vue
@@ -18,7 +18,7 @@
 <script setup>
 import { IonPage, IonContent } from "@ionic/vue"
 import { createResource } from "frappe-ui"
-import { ref, watch, inject } from "vue"
+import { ref, watch, inject, nextTick } from "vue"
 
 import FormView from "@/components/FormView.vue"
 
@@ -39,6 +39,23 @@ const currEmployee = ref(sessionEmployee.data.name)
 // reactive object to store form data
 const leaveApplication = ref({})
 
+// For existing docs, watchers fire during initial data population from the DB.
+// This flag prevents setLeaveBalance() from overwriting the stored
+// "leave balance before application" value during that initial load.
+const isFormInitialized = ref(!props.id)
+if (props.id) {
+	watch(
+		() => leaveApplication.value.name,
+		(name) => {
+			if (name && !isFormInitialized.value) {
+				nextTick(() => {
+					isFormInitialized.value = true
+				})
+			}
+		}
+	)
+}
+
 // get form fields
 const formFields = createResource({
 	url: "hrms.api.get_doctype_fields",
@@ -207,6 +224,7 @@ function setTotalLeaveDays() {
 
 function setLeaveBalance() {
 	if (!areValuesSet()) return
+	if (!isFormInitialized.value) return
 
 	const leaveBalance = createResource({
 		url: "hrms.hr.doctype.leave_application.leave_application.get_leave_balance_on",
diff --git a/hrms/hr/doctype/leave_allocation/leave_allocation.py b/hrms/hr/doctype/leave_allocation/leave_allocation.py
index 180a99d4f6..89bb02d7b1 100755
--- a/hrms/hr/doctype/leave_allocation/leave_allocation.py
+++ b/hrms/hr/doctype/leave_allocation/leave_allocation.py
@@ -353,6 +353,7 @@ def create_leave_ledger_entry(self, submit=True):
 
 	@frappe.whitelist()
 	def allocate_leaves_manually(self, new_leaves: str | float, from_date: str | datetime.date | None = None):
+		self.check_permission("write")
 		if from_date and not (getdate(self.from_date) <= getdate(from_date) <= getdate(self.to_date)):
 			frappe.throw(
 				_("Cannot allocate leaves outside the allocation period {0} - {1}").format(
diff --git a/hrms/payroll/doctype/salary_structure/salary_structure.py b/hrms/payroll/doctype/salary_structure/salary_structure.py
index a6d52d721f..39ef26d4c2 100644
--- a/hrms/payroll/doctype/salary_structure/salary_structure.py
+++ b/hrms/payroll/doctype/salary_structure/salary_structure.py
@@ -374,6 +374,28 @@ def make_salary_slip(
 	print_format: str | None = None,
 	for_preview: int = 0,
 	lwp_days_corrected: float | None = None,
+) -> str | Document:
+	return _make_salary_slip(
+		source_name,
+		target_doc=target_doc,
+		employee=employee,
+		posting_date=posting_date,
+		as_print=as_print,
+		print_format=print_format,
+		for_preview=for_preview,
+		lwp_days_corrected=lwp_days_corrected,
+	)
+
+
+def _make_salary_slip(
+	source_name: str,
+	target_doc: str | Document | None = None,
+	employee: str | None = None,
+	posting_date: str | datetime.date | None = None,
+	as_print: bool = False,
+	print_format: str | None = None,
+	for_preview: int = 0,
+	lwp_days_corrected: float | None = None,
 	ignore_permissions: bool = False,
 ) -> str | Document:
 	def postprocess(source, target):
diff --git a/hrms/payroll/report/employee_ctc_break_up/employee_ctc_break_up.py b/hrms/payroll/report/employee_ctc_break_up/employee_ctc_break_up.py
index f92d15322d..fe58b558cf 100644
--- a/hrms/payroll/report/employee_ctc_break_up/employee_ctc_break_up.py
+++ b/hrms/payroll/report/employee_ctc_break_up/employee_ctc_break_up.py
@@ -3,11 +3,11 @@
 
 import frappe
 from frappe import _
-from frappe.utils import flt, get_link_to_form
+from frappe.utils import flt, get_link_to_form, has_common
 from frappe.utils.formatters import fmt_money
 from frappe.utils.jinja import render_template
 
-from hrms.payroll.doctype.salary_structure.salary_structure import make_salary_slip
+from hrms.payroll.doctype.salary_structure.salary_structure import _make_salary_slip
 
 
 class SalaryBreakupReport:
@@ -23,7 +23,7 @@ def __init__(self, employee, salary_structure_assignment):
 			)
 		)
 		self.validate_ctc()
-		self.salary_slip = make_salary_slip(
+		self.salary_slip = _make_salary_slip(
 			self.salary_structure,
 			employee=self.employee,
 			for_preview=1,
@@ -313,9 +313,26 @@ def execute(filters: dict | None = None):
 			title=_("Missing value for filters"),
 		)
 
+	validate_employee_access(employee)
+
 	salary_breakup_report = SalaryBreakupReport(employee, salary_structure_assignment)
 
 	data = salary_breakup_report.get_data()
 	columns = salary_breakup_report.get_columns()
 	message = salary_breakup_report.get_message()
 	return columns, data, message, None, None
+
+
+ROLES_ALLOWED_TO_VIEW_ANY_EMPLOYEE = ("System Manager", "HR Manager", "HR User")
+
+
+def validate_employee_access(employee: str):
+	can_view_any_employee = has_common(ROLES_ALLOWED_TO_VIEW_ANY_EMPLOYEE, frappe.get_roles())
+	is_own_record = frappe.db.get_value("Employee", employee, "user_id") == frappe.session.user
+
+	if not can_view_any_employee and not is_own_record:
+		frappe.throw(
+			_("You are not permitted to access the CTC report of another employee."),
+			frappe.PermissionError,
+			title=_("Not Permitted"),
+		)