diff --git a/Makefile b/Makefile
index 19022330d8..0e4457666a 100644
--- a/Makefile
+++ b/Makefile
@@ -309,7 +309,7 @@ cli: ## Run the multica CLI with ARGS or MULTICA_ARGS from source
 multica: ## Run the multica CLI entrypoint directly from the Go source tree
 	cd server && go run ./cmd/multica $(MULTICA_ARGS)
 
-VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+VERSION ?= $(shell git describe --tags --match 'v[0-9]*' --always --dirty 2>/dev/null || echo dev)
 COMMIT  ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
 DATE    ?= $(shell date -u '+%Y-%m-%dT%H:%M:%SZ')
 
diff --git a/apps/desktop/scripts/bundle-cli.mjs b/apps/desktop/scripts/bundle-cli.mjs
index 44a3ba1ba8..c3a6192731 100644
--- a/apps/desktop/scripts/bundle-cli.mjs
+++ b/apps/desktop/scripts/bundle-cli.mjs
@@ -101,7 +101,7 @@ async function exists(p) {
 }
 
 if (hasGo()) {
-  const version = sh("git describe --tags --always --dirty") || "dev";
+  const version = sh("git describe --tags --match 'v[0-9]*' --always --dirty") || "dev";
   const commit = sh("git rev-parse --short HEAD") || "unknown";
   const date = new Date().toISOString().replace(/\.\d+Z$/, "Z");
   const ldflags = `-X main.version=${version} -X main.commit=${commit} -X main.date=${date}`;
diff --git a/apps/desktop/scripts/package.mjs b/apps/desktop/scripts/package.mjs
index 4dbd96a307..aa1f5d9539 100644
--- a/apps/desktop/scripts/package.mjs
+++ b/apps/desktop/scripts/package.mjs
@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 // Wrapper around `electron-builder` that keeps the Desktop version in
 // lockstep with the CLI. Both are derived from `git describe --tags
-// --always --dirty` — the same source GoReleaser reads for the CLI
+// --match 'v[0-9]*' --always --dirty` — the same source GoReleaser reads
+// for the CLI
 // binary via the `main.version` ldflag — so a single `vX.Y.Z` tag push
 // produces matching CLI and Desktop versions.
 //
@@ -126,7 +127,9 @@ export function normalizeGitVersion(raw) {
 }
 
 function deriveVersion() {
-  return normalizeGitVersion(sh("git describe --tags --always --dirty"));
+  return normalizeGitVersion(
+    sh("git describe --tags --match 'v[0-9]*' --always --dirty"),
+  );
 }
 
 function uniqueOrdered(values) {
diff --git a/apps/desktop/scripts/package.test.mjs b/apps/desktop/scripts/package.test.mjs
index d5e5c98f36..8f880370c4 100644
--- a/apps/desktop/scripts/package.test.mjs
+++ b/apps/desktop/scripts/package.test.mjs
@@ -50,6 +50,23 @@ describe("normalizeGitVersion", () => {
     expect(normalizeGitVersion("2f24057b")).toBe("0.0.0-g2f24057b");
   });
 
+  it("degrades a non-semver tag prefix that slips past the --match filter", () => {
+    // `git describe` is invoked with `--match 'v[0-9]*'` so a release-train
+    // tag like `release_iteration/…` is never the nearest match; the version
+    // resolves to the `vX.Y.Z-N-g<hash>` shape instead. If that filter ever
+    // regresses, the describe output carries the non-semver tag verbatim and
+    // must NOT be passed through as a version — it has no `major.minor.patch`
+    // prefix, so it degrades to the `0.0.0-g<hash>` fallback rather than
+    // producing something electron-updater would choke on.
+    expect(
+      normalizeGitVersion("release_iteration/Sprint_0705-3-g9adfcd4d8"),
+    ).toBe("0.0.0-grelease_iteration/Sprint_0705-3-g9adfcd4d8");
+    // With the filter in place the real input is well-formed and passes through.
+    expect(normalizeGitVersion("v0.3.35-38-g9adfcd4d8")).toBe(
+      "0.3.35-38-g9adfcd4d8",
+    );
+  });
+
   it("prefixes an all-digit hash so the pre-release is valid semver", () => {
     // A short hash that is all decimal digits with a leading zero would
     // produce `0.0.0-0123456` — a numeric pre-release identifier must not
diff --git a/apps/desktop/src/main/app-version.ts b/apps/desktop/src/main/app-version.ts
index fd079c8677..73b4406c00 100644
--- a/apps/desktop/src/main/app-version.ts
+++ b/apps/desktop/src/main/app-version.ts
@@ -20,7 +20,7 @@ export function getAppVersion(): string {
     return app.getVersion();
   }
   try {
-    const raw = execSync("git describe --tags --always --dirty", {
+    const raw = execSync("git describe --tags --match 'v[0-9]*' --always --dirty", {
       cwd: app.getAppPath(),
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"],