diff --git a/manage.sh b/manage.sh
index d4818f7..9c2c090 100755
--- a/manage.sh
+++ b/manage.sh
@@ -380,15 +380,19 @@ EOF
     cat > /usr/local/bin/pymc-do-upgrade <<'UPGRADEEOF'
 #!/bin/bash
 # pymc-do-upgrade: invoked by the repeater service user via sudo for OTA upgrades.
-# Usage: sudo /usr/local/bin/pymc-do-upgrade [channel]
+# Usage: sudo /usr/local/bin/pymc-do-upgrade [channel] [pretend-version]
 set -e
 CHANNEL="${1:-main}"
+PRETEND_VERSION="${2:-}"
 # Validate: only allow safe git ref characters
 if ! [[ "$CHANNEL" =~ ^[a-zA-Z0-9._/-]{1,80}$ ]]; then
     echo "Invalid channel name: $CHANNEL" >&2
     exit 1
 fi
 export PIP_ROOT_USER_ACTION=ignore
+# If caller supplied a version string, tell setuptools_scm to use it (sudo
+# strips env vars so it is passed as a positional argument instead).
+[ -n "$PRETEND_VERSION" ] && export SETUPTOOLS_SCM_PRETEND_VERSION="$PRETEND_VERSION"
 exec python3 -m pip install \
     --break-system-packages \
     --no-cache-dir \
@@ -713,15 +717,19 @@ EOF
         cat > /usr/local/bin/pymc-do-upgrade <<'UPGRADEEOF'
 #!/bin/bash
 # pymc-do-upgrade: invoked by the repeater service user via sudo for OTA upgrades.
-# Usage: sudo /usr/local/bin/pymc-do-upgrade [channel]
+# Usage: sudo /usr/local/bin/pymc-do-upgrade [channel] [pretend-version]
 set -e
 CHANNEL="${1:-main}"
+PRETEND_VERSION="${2:-}"
 # Validate: only allow safe git ref characters
 if ! [[ "$CHANNEL" =~ ^[a-zA-Z0-9._/-]{1,80}$ ]]; then
     echo "Invalid channel name: $CHANNEL" >&2
     exit 1
 fi
 export PIP_ROOT_USER_ACTION=ignore
+# If caller supplied a version string, tell setuptools_scm to use it (sudo
+# strips env vars so it is passed as a positional argument instead).
+[ -n "$PRETEND_VERSION" ] && export SETUPTOOLS_SCM_PRETEND_VERSION="$PRETEND_VERSION"
 exec python3 -m pip install \
     --break-system-packages \
     --no-cache-dir \
diff --git a/repeater/web/update_endpoints.py b/repeater/web/update_endpoints.py
index 847d376..16a2c89 100644
--- a/repeater/web/update_endpoints.py
+++ b/repeater/web/update_endpoints.py
@@ -133,11 +133,13 @@ def _get_installed_version() -> str:
                 f"[Update] Disk version {disk_version!r} < running {_running!r};"
                 " using running __version__ as installed version."
             )
-            return _running
+            # Strip PEP 440 local identifier (+gXXXXXX) – it only encodes
+            # the git hash and causes spurious mismatches with GitHub versions.
+            return re.sub(r'\+[a-zA-Z0-9.]+$', '', _running)
     except Exception:
         pass
 
-    return disk_version
+    return re.sub(r'\+[a-zA-Z0-9.]+$', '', disk_version)
 
 # Channels file – persisted so the choice survives daemon restarts
 _CHANNELS_FILE = "/var/lib/pymc_repeater/.update_channel"
@@ -640,7 +642,9 @@ def _do_install() -> None:
         ]
     elif _os.path.isfile(_UPGRADE_WRAPPER):
         _state.append_line(f"[pyMC updater] Using sudo wrapper: {_UPGRADE_WRAPPER}")
-        cmd = ["sudo", _UPGRADE_WRAPPER, channel]
+        # Pass the target version as $2 so the wrapper can set
+        # SETUPTOOLS_SCM_PRETEND_VERSION (sudo strips our env).
+        cmd = ["sudo", _UPGRADE_WRAPPER, channel, _state.latest_version or ""]
     else:
         msg = (
             f"Upgrade wrapper not found at {_UPGRADE_WRAPPER}. "