diff --git a/.github/workflows/nightly-dmg.yml b/.github/workflows/nightly-dmg.yml
index bd93876..f4fc96b 100644
--- a/.github/workflows/nightly-dmg.yml
+++ b/.github/workflows/nightly-dmg.yml
@@ -5,10 +5,10 @@ on:
     - cron: '0 4 * * *'
   workflow_dispatch:
     inputs:
-      version:
-        description: 'Version to bake into Info.plist and artifact names (defaults to nightly 150.0.1)'
+      release_version:
+        description: 'BearBrowser release version to bake into Info.plist + artifact filename (upstream Firefox version stays pinned at 150.0.1). Defaults to nightly.'
         required: false
-        default: '150.0.1'
+        default: ''
         type: string
   push:
     branches: [main]
@@ -30,11 +30,15 @@ jobs:
 
     env:
       MOZBUILD_STATE_PATH: ${{ github.workspace }}/.mozbuild
-      # A workflow_dispatch input overrides the nightly default; every other
-      # trigger (schedule, push) still ships a dev-versioned artifact. This
-      # closes the "release artifacts carry nightly version 150.0.1" root
-      # cause behind the plist-version-equals-tag gate rejection.
-      VERSION: ${{ inputs.version || '150.0.1' }}
+      # VERSION = pinned UPSTREAM Firefox tarball we build on (workspace paths,
+      # cache keys, tarball URL). Never overridden — the upstream source is
+      # what it is.
+      VERSION: 150.0.1
+      # BEARBROWSER_VERSION = what we call OUR release. Baked into Info.plist
+      # via prepare-macos-app-bundle.sh's --version arg and into the artifact
+      # filename. workflow_dispatch input overrides for release cuts; every
+      # other trigger falls back to VERSION so nightlies keep dev semantics.
+      BEARBROWSER_VERSION: ${{ inputs.release_version != '' && inputs.release_version || '150.0.1' }}
       RELEASE: 1
       PROFILE: human-secure
 
@@ -199,11 +203,13 @@ jobs:
 
       - name: Package BearBrowser.app
         run: |
+          # --version is the RELEASE version baked into Info.plist, NOT the
+          # upstream Firefox tarball version (which stays pinned via VERSION).
           bash scripts/bearbrowser-package-source-build.sh \
             --workspace build/workspaces/${{ env.PROFILE }}-${{ env.VERSION }}-${{ env.RELEASE }}/source/bearbrowser-${{ env.VERSION }}-${{ env.RELEASE }} \
             --profile ${{ env.PROFILE }} \
             --out-dir build/nightly \
-            --version ${{ env.VERSION }} \
+            --version ${{ env.BEARBROWSER_VERSION }} \
             --skip-verify
 
       - name: Verify the package carries the hardening (gate)
@@ -227,7 +233,10 @@ jobs:
         id: dmg
         run: |
           DATE=$(date +%Y%m%d)
-          DMG="BearBrowser-${{ env.VERSION }}-${DATE}-dev.dmg"
+          # Filename uses the RELEASE version (BEARBROWSER_VERSION), not the
+          # Firefox upstream version, so a release cut produces a correctly-
+          # named artifact ready for `gh release create v<version>`.
+          DMG="BearBrowser-${{ env.BEARBROWSER_VERSION }}-${DATE}-dev.dmg"
           hdiutil create \
             -volname "BearBrowser" \
             -srcfolder "build/nightly/BearBrowser.app" \
diff --git a/.github/workflows/nightly-linux.yml b/.github/workflows/nightly-linux.yml
index 95af0fc..4d29621 100644
--- a/.github/workflows/nightly-linux.yml
+++ b/.github/workflows/nightly-linux.yml
@@ -5,10 +5,10 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      version:
-        description: 'Version to bake into artifact names + Info metadata (defaults to nightly 150.0.1)'
+      release_version:
+        description: 'BearBrowser release version to bake into artifact filename (upstream Firefox version stays pinned at 150.0.1). Defaults to nightly.'
         required: false
-        default: '150.0.1'
+        default: ''
         type: string
   push:
     # anti-fingerprint-verify added so the compile can be triggered on this branch
@@ -75,10 +75,13 @@ jobs:
 
     env:
       MOZBUILD_STATE_PATH: ${{ github.workspace }}/.mozbuild
-      # workflow_dispatch input overrides for release cuts; other triggers get
-      # the nightly default. Root cause of the "release ships nightly version"
-      # bug that promotion-gate now catches.
-      VERSION: ${{ inputs.version || '150.0.1' }}
+      # VERSION = pinned UPSTREAM Firefox tarball (workspace paths, cache
+      # keys, tarball URL). Never overridden — the upstream source is what
+      # it is.
+      VERSION: 150.0.1
+      # BEARBROWSER_VERSION = what we ship as. Baked into the tarball
+      # filename. workflow_dispatch input overrides for release cuts.
+      BEARBROWSER_VERSION: ${{ inputs.release_version != '' && inputs.release_version || '150.0.1' }}
       RELEASE: 1
       PROFILE: human-secure
 
@@ -234,7 +237,10 @@ jobs:
           # filter lists / substitutions / stripped prefs must not ship.
           bash scripts/verify-package.sh "$OBJ/dist/bearbrowser"
 
-          TAR="BearBrowser-${{ env.VERSION }}-${DATE}-${{ matrix.artifact_suffix }}.tar.xz"
+          # Filename uses the RELEASE version (BEARBROWSER_VERSION), not the
+          # Firefox upstream version, so release cuts produce correctly-named
+          # artifacts ready for `gh release create v<version>`.
+          TAR="BearBrowser-${{ env.BEARBROWSER_VERSION }}-${DATE}-${{ matrix.artifact_suffix }}.tar.xz"
           mkdir -p build/nightly
           tar -C "$OBJ/dist" -cJf "build/nightly/${TAR}" bearbrowser
           echo "name=${TAR}" >> $GITHUB_OUTPUT
@@ -247,8 +253,8 @@ jobs:
           bash scripts/package-linux-appimage.sh \
             --workspace "build/workspaces/${{ env.PROFILE }}-${{ env.VERSION }}-${{ env.RELEASE }}/source/bearbrowser-${{ env.VERSION }}-${{ env.RELEASE }}" \
             --out-dir build/nightly \
-            --version ${{ env.VERSION }} || echo "AppImage packaging non-fatal" >&2
-          APPIMG="BearBrowser-${{ env.VERSION }}-${DATE}-${{ matrix.appimage_suffix }}.AppImage"
+            --version ${{ env.BEARBROWSER_VERSION }} || echo "AppImage packaging non-fatal" >&2
+          APPIMG="BearBrowser-${{ env.BEARBROWSER_VERSION }}-${DATE}-${{ matrix.appimage_suffix }}.AppImage"
           [ -f "build/nightly/${APPIMG}" ] && echo "name=${APPIMG}" >> $GITHUB_OUTPUT && echo "path=build/nightly/${APPIMG}" >> $GITHUB_OUTPUT || true
 
       - name: Upload tarball artifact