diff --git a/.github/workflows/build-kiosk.yml b/.github/workflows/build-kiosk.yml
index 54812c1..b77e1b1 100644
--- a/.github/workflows/build-kiosk.yml
+++ b/.github/workflows/build-kiosk.yml
@@ -2,9 +2,7 @@ name: Build & Release Kiosk APK
 
 on:
   push:
-    branches:
-      - main
-      - develop
+    branches: [main]
     paths:
       - 'evershelf-kiosk/**'
   workflow_dispatch:
@@ -30,7 +28,14 @@ jobs:
       - name: Set up Gradle
         uses: gradle/actions/setup-gradle@v3
         with:
-          gradle-version: '8.4'
+          gradle-version: '8.6'
+
+      - name: Get version name
+        id: version
+        run: |
+          VERSION=$(grep 'versionName' evershelf-kiosk/app/build.gradle.kts | grep -oP '"\K[^"]+')
+          echo "name=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Kiosk version: $VERSION"
 
       - name: Build debug APK
         run: gradle assembleDebug --no-daemon
@@ -41,29 +46,33 @@ jobs:
           mkdir -p artifacts
           cp evershelf-kiosk/app/build/outputs/apk/debug/app-debug.apk artifacts/evershelf-kiosk.apk
 
-      - name: Get version name
-        id: version
-        run: |
-          VERSION=$(grep 'versionName' evershelf-kiosk/app/build.gradle.kts | grep -oP '"\K[^"]+')
-          echo "name=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Delete existing kiosk release
+      # Publish with a semver-compatible tag so the in-app update check can
+      # compare versions numerically (tag "kiosk-1.7.0" → norm → "1.7.0").
+      # Also update the "kiosk-latest" tag so the hardcoded download URL still works.
+      - name: Create versioned release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh release delete kiosk-latest --yes || true
-          sleep 5
+          TAG="kiosk-${{ steps.version.outputs.name }}"
+          # Delete old release with same tag if it exists (e.g. re-run on same version)
+          gh release delete "$TAG" --yes 2>/dev/null || true
+          git push --delete origin "$TAG" 2>/dev/null || true
+          gh release create "$TAG" \
+            --title "EverShelf Kiosk v${{ steps.version.outputs.name }}" \
+            --notes "Kiosk mode app. Scarica e installa su Android 7.0+. L'aggiornamento OTA è automatico." \
+            --latest \
+            artifacts/evershelf-kiosk.apk
 
-      - name: Create GitHub Release and upload APK
+      - name: Update kiosk-latest tag (for hardcoded download URL)
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          for i in 1 2 3; do
-            gh release create kiosk-latest \
-              --title "EverShelf Kiosk v${{ steps.version.outputs.name }}" \
-              --notes "Kiosk mode app with embedded BLE scale gateway. Install on your Android device (7.0+)." \
-              --prerelease \
-              artifacts/evershelf-kiosk.apk && break
-            echo "Attempt $i failed, retrying in 10s..."
-            sleep 10
-          done
+          gh release delete kiosk-latest --yes 2>/dev/null || true
+          git push --delete origin kiosk-latest 2>/dev/null || true
+          sleep 3
+          gh release create kiosk-latest \
+            --title "EverShelf Kiosk Latest" \
+            --notes "Alias automatico → kiosk-${{ steps.version.outputs.name }}" \
+            --prerelease \
+            artifacts/evershelf-kiosk.apk
+
diff --git a/evershelf-kiosk.apk b/evershelf-kiosk.apk
index a7debff..c1f2e79 100644
Binary files a/evershelf-kiosk.apk and b/evershelf-kiosk.apk differ
diff --git a/evershelf-kiosk/app/src/main/kotlin/it/dadaloop/evershelf/kiosk/KioskActivity.kt b/evershelf-kiosk/app/src/main/kotlin/it/dadaloop/evershelf/kiosk/KioskActivity.kt
index 6a642a9..06a34b9 100644
--- a/evershelf-kiosk/app/src/main/kotlin/it/dadaloop/evershelf/kiosk/KioskActivity.kt
+++ b/evershelf-kiosk/app/src/main/kotlin/it/dadaloop/evershelf/kiosk/KioskActivity.kt
@@ -555,8 +555,10 @@ class KioskActivity : AppCompatActivity() {
                     packageManager.getPackageInfo(packageName, 0).versionName ?: ""
                 } catch (_: Exception) { "" }
 
-                val norm = { v: String -> v.trimStart('v') }
-                val isSemver = latestTag.trimStart('v').matches(Regex("\\d+\\.\\d+.*"))
+                // Strip any non-numeric prefix so "kiosk-1.7.0", "v1.7.0", "kiosk-v1.7.1"
+                // all normalise to "1.7.0" / "1.7.1" for comparison.
+                val norm = { v: String -> v.replace(Regex("^[^0-9]*"), "") }
+                val isSemver = norm(latestTag).matches(Regex("\\d+\\.\\d+.*"))
 
                 // Compare semver: returns true if `remote` is strictly greater than `local`
                 fun semverNewer(remote: String, local: String): Boolean {
@@ -583,8 +585,12 @@ class KioskActivity : AppCompatActivity() {
                 }
                 if (kioskApkUrl.isEmpty()) kioskApkUrl = KIOSK_DOWNLOAD_URL
 
+                // Only flag an update when the remote tag is parseable as semver AND
+                // the remote version is strictly greater than the installed version.
+                // Non-semver tags (e.g. "kiosk-latest", "rolling") cannot be compared
+                // numerically → treat as "no update" to avoid false positives.
                 val kioskNeedsUpdate = currentKiosk.isNotEmpty() &&
-                    (!isSemver || semverNewer(norm(latestTag), norm(currentKiosk)))
+                    isSemver && semverNewer(norm(latestTag), norm(currentKiosk))
 
                 val result = JSONObject()
                     .put("has_update", kioskNeedsUpdate)