diff --git a/installer/windows/installer.iss b/installer/windows/installer.iss
index ff131a7..744f486 100644
--- a/installer/windows/installer.iss
+++ b/installer/windows/installer.iss
@@ -5,10 +5,14 @@
 ; runtime. Nothing on the target machine requires internet access.
 ;
 ; Usage:
-;   iscc installer\windows\installer.iss
-;   theta-agent-2.1.0-windows-amd64-setup.exe /SILENT ^
+;   iscc "/DMyAppVersion=2.2.0" installer\windows\installer.iss
+;   theta-agent-2.2.0-windows-amd64-setup.exe /SILENT ^
 ;       /SERVER_URL=https://sso.example.com /JOIN_KEY=tjk_...
 ;
+; The version is passed in by scripts/setup-build-env.ps1 (derived from the
+; git tag). The default below exists only so a bare `iscc installer.iss` call
+; still compiles; it should never be the version in a real build.
+;
 ; Interactively, a wizard page asks for the Theta Directory URL and a join key
 ; (with a button that opens the Theta Directory's Directory -> Install Agent page
 ; to mint one). In silent mode, /SERVER_URL, /JOIN_KEY, /AUTH_TOKEN, /PUBLIC_KEY
@@ -16,7 +20,7 @@
 ; are written into agent.yml so the installed service enrolls on first start.
 
 #ifndef MyAppVersion
-  #define MyAppVersion "2.1.0"
+  #define MyAppVersion "0.0.0-dev"
 #endif
 
 #define MyAppName "Theta Agent"
diff --git a/scripts/setup-build-env.ps1 b/scripts/setup-build-env.ps1
index 483b305..1a0f962 100644
--- a/scripts/setup-build-env.ps1
+++ b/scripts/setup-build-env.ps1
@@ -273,8 +273,21 @@ function Invoke-Build {
 
     $iscc = Find-Iscc
     if (-not $iscc) { Write-Fail 'ISCC not found; cannot build installer'; return }
-    Write-Step "Compiling installer with ISCC"
-    & $iscc (Join-Path $RepoRoot 'installer\windows\installer.iss')
+
+    # The installer must not carry a stale hardcoded version: derive it from
+    # the tag on CI (GITHUB_REF_NAME, e.g. "v2.2.0"), else the nearest local
+    # tag, else a plain dev marker. Passed as -DMyAppVersion so
+    # installer.iss's #ifndef default is always overridden by the build.
+    $appVer = '0.0.0-dev'
+    if ($env:GITHUB_REF_NAME -match 'v?([0-9]+\.[0-9]+\.[0-9]+)') {
+        $appVer = $matches[1]
+    } else {
+        $desc = git describe --tags --abbrev=0 2>$null
+        if ($desc -match 'v?([0-9]+\.[0-9]+\.[0-9]+)') { $appVer = $matches[1] }
+    }
+
+    Write-Step "Compiling installer with ISCC (version $appVer)"
+    & $iscc "/DMyAppVersion=$appVer" (Join-Path $RepoRoot 'installer\windows\installer.iss')
     if ($LASTEXITCODE -ne 0) { Write-Fail 'ISCC compile failed' }
 }