diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2a9d274b763cd9bb5a722b2841c31a1ff8b7b16d..d8d14108257ad9f720a8f0b0b1ef43334cd5fe98 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,6 +22,8 @@ jobs:
     outputs:
       version: ${{ steps.release_meta.outputs.version }}
       tag: ${{ steps.release_meta.outputs.tag }}
+      is_prerelease: ${{ steps.release_meta.outputs.is_prerelease }}
+      make_latest: ${{ steps.release_meta.outputs.make_latest }}
       ref: ${{ github.sha }}
     steps:
       - name: Checkout
@@ -45,6 +47,13 @@ jobs:
 
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "tag=v$version" >> "$GITHUB_OUTPUT"
+          if [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "is_prerelease=false" >> "$GITHUB_OUTPUT"
+            echo "make_latest=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
+            echo "make_latest=false" >> "$GITHUB_OUTPUT"
+          fi
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
@@ -260,7 +269,8 @@ jobs:
           target_commitish: ${{ needs.preflight.outputs.ref }}
           name: T3 Code v${{ needs.preflight.outputs.version }}
           generate_release_notes: true
-          make_latest: true
+          prerelease: ${{ needs.preflight.outputs.is_prerelease }}
+          make_latest: ${{ needs.preflight.outputs.make_latest }}
           files: |
             release-assets/*.dmg
             release-assets/*.zip
diff --git a/apps/desktop/src/main.ts b/apps/desktop/src/main.ts
index 787ec3e04b751776055122d67a37d15ecfe36a3c..945f1d27907f86b248ed63c0291e3ff93b204b16 100644
--- a/apps/desktop/src/main.ts
+++ b/apps/desktop/src/main.ts
@@ -58,6 +58,8 @@ const LOG_FILE_MAX_FILES = 10;
 const APP_RUN_ID = Crypto.randomBytes(6).toString("hex");
 const AUTO_UPDATE_STARTUP_DELAY_MS = 15_000;
 const AUTO_UPDATE_POLL_INTERVAL_MS = 4 * 60 * 60 * 1000;
+const DESKTOP_UPDATE_CHANNEL = "latest";
+const DESKTOP_UPDATE_ALLOW_PRERELEASE = false;
 
 type DesktopUpdateErrorContext = DesktopUpdateState["errorContext"];
 
@@ -725,7 +727,10 @@ function configureAutoUpdater(): void {
 
   autoUpdater.autoDownload = false;
   autoUpdater.autoInstallOnAppQuit = false;
-  autoUpdater.allowPrerelease = app.getVersion().includes("-");
+  // Keep alpha branding, but force all installs onto the stable update track.
+  autoUpdater.channel = DESKTOP_UPDATE_CHANNEL;
+  autoUpdater.allowPrerelease = DESKTOP_UPDATE_ALLOW_PRERELEASE;
+  autoUpdater.allowDowngrade = false;
   let lastLoggedDownloadMilestone = -1;
 
   autoUpdater.on("checking-for-update", () => {
diff --git a/docs/release.md b/docs/release.md
index 68a77f4d940aa1ff60b911f32a168b70596fc110..6c338ee641cf46325afd69deb4b8c2c6390cfa22 100644
--- a/docs/release.md
+++ b/docs/release.md
@@ -12,6 +12,8 @@ This document covers how to run desktop releases from one tag, first without sig
   - Linux `x64` AppImage
   - Windows `x64` NSIS installer
 - Publishes one GitHub Release with all produced files.
+  - Versions with a suffix after `X.Y.Z` (for example `1.2.3-alpha.1`) are published as GitHub prereleases.
+  - Only plain `X.Y.Z` releases are marked as the repository's latest release.
 - Includes Electron auto-update metadata (for example `latest*.yml` and `*.blockmap`) in release assets.
 - Publishes the CLI package (`apps/server`, npm package `t3`) with OIDC trusted publishing.
 - Signing is optional and auto-detected per platform from secrets.