diff --git a/constraints.txt b/constraints.txt
index 0737b16..de91f5e 100644
--- a/constraints.txt
+++ b/constraints.txt
@@ -48,7 +48,7 @@ django-otp==1.1.4
     # via django-two-factor-auth
 django-phonenumber-field==6.4.0
     # via django-two-factor-auth
-django-two-factor-auth==1.15.0
+django-two-factor-auth==1.14.0
     # via -r requirements.in
 gunicorn==20.1.0
     # via -r requirements.in
diff --git a/requirements.in b/requirements.in
index 7ecea7d..dfb70c4 100644
--- a/requirements.in
+++ b/requirements.in
@@ -4,7 +4,7 @@ django-environ>=0.9.0
 django-extensions>=3.1.5
 django-anymail[mailgun]>=8.6
 django-csp>=3.7
-django-two-factor-auth[phonenumberslite]>=1.14
+django-two-factor-auth[phonenumberslite]>=1.14,<1.15  # bug with phonedevice
 whitenoise>=6.2
 Markdown>=3.2
 requests>=2.28.1
diff --git a/requirements.txt b/requirements.txt
index 8e3a81f..64982df 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -249,9 +249,9 @@ django-phonenumber-field==6.4.0 \
     --hash=sha256:72a3e7a3e7493bf2a12c07a3bc77ce89813acc16592bf04d0eee3b5a452097ed \
     --hash=sha256:a31b4f05ac0ff898661516c84940f83adb5cdcf0ae4b9b1d31bb8ad3ff345b58
     # via django-two-factor-auth
-django-two-factor-auth[phonenumberslite]==1.15.0 \
-    --hash=sha256:def6b3242cbc53476c06972f1ba5069edd89a94edeb0f2723a6536ff4002dae0 \
-    --hash=sha256:e40e32cd418b274905d94940c1e16678b147105542a3d7239fe015d262b367a4
+django-two-factor-auth[phonenumberslite]==1.14.0 \
+    --hash=sha256:b414ef51cc84335e0049e3f98ef89ac15a09187efa381f3acd321651afae95b3 \
+    --hash=sha256:d18290f02766f400537b88937df06aa0a2d6d6d37937fbfb84896c4790a9e59b
     # via -r requirements.in
 gunicorn==20.1.0 \
     --hash=sha256:9dcc4547dbb1cb284accfb15ab5667a0e5d1881cc443e0677b4882a4067a807e \