diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ec2e73aca1..640afbdf01 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,9 +18,10 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: "Version to release (e.g., 1.1.57)"
-        required: true
+        description: "Version to release (x.y.z). Leave empty for auto patch bump."
+        required: false
         type: string
+        default: ''
 
 env:
   REGISTRY: "ghcr.io"
@@ -32,6 +33,12 @@ env:
 # =============================================================================
 
 jobs:
+  version:
+    name: Resolve Version
+    uses: ./.github/workflows/version.yml
+    with:
+      version: ${{ inputs.version }}
+
   changes:
     name: Detect Changes
     uses: ./.github/workflows/changes.yml
@@ -42,11 +49,11 @@ jobs:
 
   build:
     name: "Build meshcentral"
-    needs: [changes]
+    needs: [version, changes]
     runs-on: ubuntu-latest
     if: |
       (github.event_name == 'push' && needs.changes.outputs.docker == 'true') ||
-      (github.event_name == 'workflow_dispatch' && inputs.version != '')
+      (github.event_name == 'workflow_dispatch' && needs.version.outputs.version != '')
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -87,7 +94,7 @@ jobs:
           tags: |
             type=ref,event=tag
             type=raw,value=latest,enable={{is_default_branch}}
-            type=raw,value=${{ inputs.version }},enable=${{ inputs.version != '' }}
+            type=raw,value=${{ needs.version.outputs.version }},enable=${{ needs.version.outputs.version != '' }}
           labels: |
             org.opencontainers.image.vendor=${{ env.ORGANISATION }}
             org.opencontainers.image.description=MeshCentral - full computer management web site
@@ -120,11 +127,11 @@ jobs:
 
   build_helm:
     name: "Build Helm Chart"
-    needs: [changes]
+    needs: [version, changes]
     runs-on: ubuntu-latest
     if: |
       (github.event_name == 'push' && needs.changes.outputs.helm == 'true') ||
-      (github.event_name == 'workflow_dispatch' && inputs.version != '')
+      (github.event_name == 'workflow_dispatch' && needs.version.outputs.version != '')
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -137,7 +144,7 @@ jobs:
         with:
           name: meshcentral
           repository: ${{ github.repository }}/helm-charts
-          tag: ${{ inputs.version || '9.9.9' }}
+          tag: ${{ needs.version.outputs.version }}
           path: ./charts/meshcentral
           registry: ${{ env.REGISTRY }}
           registry_username: ${{ github.actor }}
@@ -146,16 +153,15 @@ jobs:
 
   release:
     name: "Create Release"
-    needs: [build, build_helm]
+    needs: [version, build, build_helm]
     runs-on: ubuntu-latest
-    if: ${{ !failure() && !cancelled() }} 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Generate release header
         run: |
-          VERSION="${{ inputs.version || 'latest' }}"
+          VERSION="${{ needs.version.outputs.version }}"
           cat > RELEASE_HEADER.md <<EOF
           ## Images
           - \`${{ env.REGISTRY }}/${{ github.repository }}/meshcentral:${VERSION}\`
@@ -168,8 +174,8 @@ jobs:
       - name: Create Release
         uses: softprops/action-gh-release@v2
         with:
-          tag_name: ${{ inputs.version || 'latest' }}
-          name: "🦩 ${{ inputs.version || 'latest' }}"
+          tag_name: ${{ needs.version.outputs.version }}
+          name: "🦩 ${{ needs.version.outputs.version }}"
           draft: false
           prerelease: ${{ github.event_name == 'push' }}
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml
new file mode 100644
index 0000000000..37f882e6b5
--- /dev/null
+++ b/.github/workflows/version.yml
@@ -0,0 +1,66 @@
+name: Resolve Version
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: "Version to release (x.y.z). Leave empty for auto patch bump."
+        required: false
+        type: string
+        default: ''
+    outputs:
+      version:
+        description: "Resolved release version"
+        value: ${{ jobs.version.outputs.version }}
+
+jobs:
+  version:
+    name: Resolve version
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version_push.outputs.version || steps.version_dispatch.outputs.version }}
+    steps:
+      - name: Resolve version (push)
+        id: version_push
+        if: github.event_name != 'workflow_dispatch'
+        run: |
+          echo "push event: version resolves to latest"
+          echo "version=latest" >> "$GITHUB_OUTPUT"
+
+      - name: Resolve version (dispatch)
+        id: version_dispatch
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          # Releases, not git tags: upstream's inherited bare tags and the 9.9.x sentinel outrank the real line under sort -V
+          latest=$(gh release list --limit 100 --exclude-drafts --exclude-pre-releases \
+            --json tagName --jq '.[].tagName' \
+            | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | grep -v '^9\.9\.' | sort -V | tail -1 || true)
+          latest=${latest:-0.0.0}
+          IFS='.' read -r cur_major cur_minor cur_patch <<< "$latest"
+
+          if [ -z "$INPUT_VERSION" ]; then
+            version="${cur_major}.${cur_minor}.$((cur_patch + 1))"
+            echo "No version provided, auto patch bump: ${latest} -> ${version}"
+          else
+            if ! [[ "$INPUT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              echo "Invalid version format: ${INPUT_VERSION} (expected x.y.z)"
+              exit 1
+            fi
+            IFS='.' read -r new_major new_minor new_patch <<< "$INPUT_VERSION"
+            if ! ([ "$new_major" -eq $((cur_major + 1)) ] && [ "$new_minor" -eq 0 ] && [ "$new_patch" -eq 0 ]) &&
+               ! ([ "$new_major" -eq "$cur_major" ] && [ "$new_minor" -eq $((cur_minor + 1)) ] && [ "$new_patch" -eq 0 ]) &&
+               ! ([ "$new_major" -eq "$cur_major" ] && [ "$new_minor" -eq "$cur_minor" ] && [ "$new_patch" -eq $((cur_patch + 1)) ]); then
+              echo "Invalid version bump: ${latest} -> ${INPUT_VERSION} (expected $((cur_major + 1)).0.0, ${cur_major}.$((cur_minor + 1)).0, or ${cur_major}.${cur_minor}.$((cur_patch + 1)))"
+              exit 1
+            fi
+            version="$INPUT_VERSION"
+            echo "Using provided version: ${version}"
+          fi
+
+          echo "version=${version}" >> "$GITHUB_OUTPUT"