Ah this is such an annoying problem to hit!
When generating version hashes, we include the credential UUID in the hash. The idea here of course being that if you change the credential, it will be recognised as a new version and track the change.
But there's a bit of a problem in the CLI with sandboxes. A Project and its Sandbox have different version hashes because they both have different credential UUIDs.