diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index 784dffb32..b5536eb34 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -52,6 +52,10 @@ jobs:
             VERSION=${TAG#beta-}
             VERSION=${VERSION#v}
           fi
+          if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$'; then
+            echo "::error::Version '$VERSION' is not valid semver (expected X.Y.Z). Fix your tag name."
+            exit 1
+          fi
           echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Setup pnpm
diff --git a/surfsense_desktop/src/modules/auto-updater.ts b/surfsense_desktop/src/modules/auto-updater.ts
index 2e7680953..47a85b730 100644
--- a/surfsense_desktop/src/modules/auto-updater.ts
+++ b/surfsense_desktop/src/modules/auto-updater.ts
@@ -1,16 +1,25 @@
 import { app, dialog } from 'electron';
-import { autoUpdater } from 'electron-updater';
+
+const SEMVER_RE = /^\d+\.\d+\.\d+/;
 
 export function setupAutoUpdater(): void {
   if (!app.isPackaged) return;
 
+  const version = app.getVersion();
+  if (!SEMVER_RE.test(version)) {
+    console.log(`Auto-updater: skipping — "${version}" is not valid semver`);
+    return;
+  }
+
+  const { autoUpdater } = require('electron-updater');
+
   autoUpdater.autoDownload = true;
 
-  autoUpdater.on('update-available', (info) => {
+  autoUpdater.on('update-available', (info: { version: string }) => {
     console.log(`Update available: ${info.version}`);
   });
 
-  autoUpdater.on('update-downloaded', (info) => {
+  autoUpdater.on('update-downloaded', (info: { version: string }) => {
     console.log(`Update downloaded: ${info.version}`);
     dialog.showMessageBox({
       type: 'info',
@@ -18,14 +27,14 @@ export function setupAutoUpdater(): void {
       defaultId: 0,
       title: 'Update Ready',
       message: `Version ${info.version} has been downloaded. Restart to apply the update.`,
-    }).then(({ response }) => {
+    }).then(({ response }: { response: number }) => {
       if (response === 0) {
         autoUpdater.quitAndInstall();
       }
     });
   });
 
-  autoUpdater.on('error', (err) => {
+  autoUpdater.on('error', (err: Error) => {
     console.log('Auto-updater: update check skipped —', err.message?.split('\n')[0]);
   });