diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index 712e6be4c1d..c6cc873a46f 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -771,9 +771,39 @@ jobs:
     if: github.ref == 'refs/heads/main'
     environment:
       name: production
+    outputs:
+      version: ${{ steps.version.outputs.version }}
     steps:
       - run: echo "Production release approved — deploying web and desktop"
 
+      - name: Checkout web package.json
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: packages/web/package.json
+          sparse-checkout-cone-mode: false
+
+      # Desktop clients only pick up a release whose version is newer than the
+      # one they run: the web-update poll in electron.js needs the same
+      # major.minor and a higher patch, and electron-updater needs a higher
+      # version. Nothing bumps packages/web/package.json per release, so every
+      # release gets the next patch after whatever is newest, the repo or the
+      # last published marker. It's picked here, after approval, because runs
+      # wait at this gate for days and can be approved in any order.
+      - name: Pick release version
+        id: version
+        run: |
+          set -euo pipefail
+          repo=$(jq -r .version packages/web/package.json)
+          published=$(curl -fsS --retry 3 https://s3.us-west-1.amazonaws.com/audius.co/package.json | jq -r .version)
+          for v in "$repo" "$published"; do
+            [[ "$v" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "unexpected version '$v'"; exit 1; }
+          done
+          base=$(printf '%s\n%s\n' "$repo" "$published" | sort -V | tail -1)
+          IFS=. read -r major minor patch <<< "$base"
+          version="$major.$minor.$((patch + 1))"
+          echo "repo $repo, published $published -> releasing $version"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
   web-deploy:
     name: Web Deploy
     runs-on: ubuntu-latest
@@ -862,8 +892,13 @@ jobs:
       #     version marker the app reads back after applying an update
       #   - the tar must carry the `packages/web/` prefix, because the app looks
       #     for web-update/packages/web/build-production after extracting
+      #   - the version must be the one production-gate picked
       - name: Package build for desktop web-update
+        env:
+          VERSION: ${{ needs.production-gate.outputs.version }}
         run: |
+          jq --arg v "$VERSION" '.version = $v' packages/web/package.json > package.json.tmp
+          mv package.json.tmp packages/web/package.json
           cp packages/web/package.json packages/web/build-production/package.json
           tar -czf build-production.tar.gz packages/web/build-production
 
@@ -1095,6 +1130,16 @@ jobs:
           name: builds
           path: packages/web
 
+      # electron-builder takes the app version from package.json; see production-gate
+      - name: Stamp release version
+        env:
+          VERSION: ${{ needs.production-gate.outputs.version }}
+        run: |
+          cd packages/web
+          jq --arg v "$VERSION" '.version = $v' package.json > package.json.tmp
+          mv package.json.tmp package.json
+          cp package.json build-production/package.json
+
       - name: Build & publish Mac desktop app
         env:
           APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
@@ -1167,6 +1212,16 @@ jobs:
           name: builds
           path: packages/web
 
+      # electron-builder takes the app version from package.json; see production-gate
+      - name: Stamp release version
+        env:
+          VERSION: ${{ needs.production-gate.outputs.version }}
+        run: |
+          cd packages/web
+          jq --arg v "$VERSION" '.version = $v' package.json > package.json.tmp
+          mv package.json.tmp package.json
+          cp package.json build-production/package.json
+
       - name: Build & publish Windows desktop app
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -1231,6 +1286,16 @@ jobs:
           name: builds
           path: packages/web
 
+      # electron-builder takes the app version from package.json; see production-gate
+      - name: Stamp release version
+        env:
+          VERSION: ${{ needs.production-gate.outputs.version }}
+        run: |
+          cd packages/web
+          jq --arg v "$VERSION" '.version = $v' package.json > package.json.tmp
+          mv package.json.tmp package.json
+          cp package.json build-production/package.json
+
       - name: Build & publish Linux desktop app
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}