diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 34eb554d..62e5eae6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -144,6 +144,8 @@ jobs:
       - name: Patch manifests with WASM checksums
         if: ${{ needs.plan.outputs.publishing == 'true' }}
         shell: bash
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
         run: |
           CHECKSUMS="target/distrib/checksums.txt"
           if [ ! -f "$CHECKSUMS" ]; then
@@ -154,12 +156,17 @@ jobs:
           while IFS= read -r line; do
             sha256=$(echo "$line" | awk '{print $1}')
             filename=$(echo "$line" | awk '{print $2}')
-            name=$(echo "$filename" | sed 's/-wasm32-wasip2\.tar\.gz$//')
+            # Strip -{version}-wasm32-wasip2.tar.gz to get the extension name.
+            # Use '.*' (greedy) so pre-release suffixes like -alpha.1 are consumed too.
+            name=$(echo "$filename" | sed 's/-[0-9].*-wasm32-wasip2\.tar\.gz$//')
+            url="https://github.com/nearai/ironclaw/releases/download/${RELEASE_TAG}/${filename}"
 
             for manifest in registry/tools/${name}.json registry/channels/${name}.json; do
               if [ -f "$manifest" ]; then
-                jq --arg sha "$sha256" '.artifacts["wasm32-wasip2"].sha256 = $sha' "$manifest" > "${manifest}.tmp" && mv "${manifest}.tmp" "$manifest"
-                echo "Patched $manifest with sha256=$sha256"
+                jq --arg sha "$sha256" --arg url "$url" \
+                  '.artifacts["wasm32-wasip2"].sha256 = $sha | .artifacts["wasm32-wasip2"].url = $url' \
+                  "$manifest" > "${manifest}.tmp" && mv "${manifest}.tmp" "$manifest"
+                echo "Patched $manifest with sha256=$sha256 url=$url"
               fi
             done
           done < "$CHECKSUMS"
@@ -268,21 +275,41 @@ jobs:
           for manifest in registry/tools/*.json registry/channels/*.json; do
             [ -f "$manifest" ] || continue
 
-            name=$(jq -r '.name' "$manifest")
+            # file_stem: JSON filename without extension (e.g. "slack" for slack.json).
+            # Used for the bundle filename and CI manifest lookup, so patching always
+            # finds the right file regardless of whether manifest.name matches the filename.
+            file_stem=$(basename "$manifest" .json)
+            # ext_name: the manifest's .name field (e.g. "slack-tool").
+            # Used for file names *inside* the archive — the installer extracts by manifest.name.
+            ext_name=$(jq -r '.name' "$manifest")
             source_dir=$(jq -r '.source.dir' "$manifest")
             caps_file=$(jq -r '.source.capabilities' "$manifest")
             crate_name=$(jq -r '.source.crate_name' "$manifest")
+            ext_version=$(jq -r '.version // ""' "$manifest")
 
             if [ ! -d "$source_dir" ]; then
-              echo "::warning::Source dir '$source_dir' not found for '$name', skipping"
+              echo "::warning::Source dir '$source_dir' not found for '$file_stem', skipping"
               continue
             fi
 
-            echo "=== Building $name from $source_dir ==="
+            # Skip rebuild if this exact version was already built and checksummed.
+            # Checks that (1) the manifest already has a sha256, and (2) the version
+            # embedded in the existing artifact URL matches the current manifest version.
+            # This ensures stable checksums: only rebuild when the source version changes.
+            existing_sha=$(jq -r '.artifacts["wasm32-wasip2"].sha256 // ""' "$manifest")
+            existing_url=$(jq -r '.artifacts["wasm32-wasip2"].url // ""' "$manifest")
+            url_version=$(echo "$existing_url" | sed -n 's/.*-\([0-9].*\)-wasm32-wasip2\.tar\.gz$/\1/p')
+
+            if [[ -n "$ext_version" && "$url_version" == "$ext_version" && -n "$existing_sha" ]]; then
+              echo "=== Skipping $file_stem v$ext_version — already checksummed at $existing_url ==="
+              continue
+            fi
+
+            echo "=== Building $file_stem ($ext_name) v$ext_version from $source_dir ==="
 
             # Build WASM component
             cargo component build --release --manifest-path "$source_dir/Cargo.toml" || {
-              echo "::warning::Build failed for '$name', skipping"
+              echo "::warning::Build failed for '$file_stem', skipping"
               continue
             }
 
@@ -298,30 +325,36 @@ jobs:
             done
 
             if [ -z "$wasm_path" ]; then
-              echo "::warning::No WASM output found for '$name', skipping"
+              echo "::warning::No WASM output found for '$file_stem', skipping"
               continue
             fi
 
-            # Copy files with standardized names for the archive
-            cp "$wasm_path" "target/wasm-bundles/${name}.wasm"
+            # Archive contents use ext_name (manifest .name) — the installer extracts
+            # files by manifest.name, so these must match even when file_stem differs.
+            cp "$wasm_path" "target/wasm-bundles/${ext_name}.wasm"
 
             caps_path="$source_dir/$caps_file"
             if [ -f "$caps_path" ]; then
-              cp "$caps_path" "target/wasm-bundles/${name}.capabilities.json"
+              cp "$caps_path" "target/wasm-bundles/${ext_name}.capabilities.json"
             else
-              echo "::warning::No capabilities file at '$caps_path' for '$name'"
+              echo "::warning::No capabilities file at '$caps_path' for '$file_stem'"
             fi
 
-            # Create tar.gz bundle
-            bundle="target/wasm-bundles/${name}-wasm32-wasip2.tar.gz"
-            (cd target/wasm-bundles && if [ -f "${name}.capabilities.json" ]; then tar czf "${name}-wasm32-wasip2.tar.gz" "${name}.wasm" "${name}.capabilities.json"; else tar czf "${name}-wasm32-wasip2.tar.gz" "${name}.wasm"; fi)
+            # Bundle filename uses file_stem so CI patching can find the manifest by
+            # filename (e.g. slack-0.1.0-wasm32-wasip2.tar.gz → registry/tools/slack.json).
+            bundle="target/wasm-bundles/${file_stem}-${ext_version}-wasm32-wasip2.tar.gz"
+            (cd target/wasm-bundles && if [ -f "${ext_name}.capabilities.json" ]; then
+              tar czf "${file_stem}-${ext_version}-wasm32-wasip2.tar.gz" "${ext_name}.wasm" "${ext_name}.capabilities.json"
+            else
+              tar czf "${file_stem}-${ext_version}-wasm32-wasip2.tar.gz" "${ext_name}.wasm"
+            fi)
 
             # Compute SHA256
             sha256=$(sha256sum "$bundle" | cut -d' ' -f1)
-            echo "$sha256  ${name}-wasm32-wasip2.tar.gz" >> target/wasm-bundles/checksums.txt
+            echo "$sha256  ${file_stem}-${ext_version}-wasm32-wasip2.tar.gz" >> target/wasm-bundles/checksums.txt
 
             # Clean up intermediate files
-            rm -f "target/wasm-bundles/${name}.wasm" "target/wasm-bundles/${name}.capabilities.json"
+            rm -f "target/wasm-bundles/${ext_name}.wasm" "target/wasm-bundles/${ext_name}.capabilities.json"
 
             echo "  -> $bundle ($sha256)"
           done
@@ -427,8 +460,10 @@ jobs:
         with:
           name: artifacts-wasm-extensions
           path: target/wasm-bundles/
-      - name: Patch manifests with SHA256
+      - name: Patch manifests with SHA256 and version-pinned URL
         shell: bash
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
         run: |
           CHECKSUMS="target/wasm-bundles/checksums.txt"
           if [ ! -f "$CHECKSUMS" ]; then
@@ -439,12 +474,17 @@ jobs:
           while IFS= read -r line; do
             sha256=$(echo "$line" | awk '{print $1}')
             filename=$(echo "$line" | awk '{print $2}')
-            name=$(echo "$filename" | sed 's/-wasm32-wasip2\.tar\.gz$//')
+            # Strip -{version}-wasm32-wasip2.tar.gz to get the extension name.
+            # Use '.*' (greedy) so pre-release suffixes like -alpha.1 are consumed too.
+            name=$(echo "$filename" | sed 's/-[0-9].*-wasm32-wasip2\.tar\.gz$//')
+            url="https://github.com/nearai/ironclaw/releases/download/${RELEASE_TAG}/${filename}"
 
             for manifest in registry/tools/${name}.json registry/channels/${name}.json; do
               if [ -f "$manifest" ]; then
-                jq --arg sha "$sha256" '.artifacts["wasm32-wasip2"].sha256 = $sha' "$manifest" > "${manifest}.tmp" && mv "${manifest}.tmp" "$manifest"
-                echo "Patched $manifest with sha256=$sha256"
+                jq --arg sha "$sha256" --arg url "$url" \
+                  '.artifacts["wasm32-wasip2"].sha256 = $sha | .artifacts["wasm32-wasip2"].url = $url' \
+                  "$manifest" > "${manifest}.tmp" && mv "${manifest}.tmp" "$manifest"
+                echo "Patched $manifest with sha256=$sha256 url=$url"
               fi
             done
           done < "$CHECKSUMS"
@@ -461,8 +501,8 @@ jobs:
             git commit -m "chore: update WASM artifact SHA256 checksums [skip ci]"
             git push origin "$BRANCH"
             gh pr create \
-              --title "chore: update WASM artifact SHA256 checksums" \
-              --body "Auto-generated by release CI. Updates SHA256 checksums in registry manifests to match the released WASM artifacts." \
+              --title "chore: update WASM artifact checksums and version-pinned URLs" \
+              --body "Auto-generated by release CI. Updates SHA256 checksums and version-pinned artifact URLs in registry manifests to match the released WASM artifacts. Only extensions whose version changed since the last release are included." \
               --base main \
               --head "$BRANCH"
           fi
diff --git a/.gitignore b/.gitignore
index 80135737..51b461f2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,3 +28,4 @@ trace_*.json
 
 # Local Claude Code settings (machine-specific, should not be committed)
 .claude/settings.local.json
+.worktrees/
diff --git a/registry/channels/discord.json b/registry/channels/discord.json
index abd29d82..1b13658a 100644
--- a/registry/channels/discord.json
+++ b/registry/channels/discord.json
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/discord-wasm32-wasip2.tar.gz",
-      "sha256": "030707431717bca3411a48f311c6ab5f92a45c747de26cafe4f6e3e23a8b3b2d"
+      "sha256": null
     }
   },
   "auth_summary": {
diff --git a/registry/channels/slack.json b/registry/channels/slack.json
index f123798f..593c2758 100644
--- a/registry/channels/slack.json
+++ b/registry/channels/slack.json
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/slack-wasm32-wasip2.tar.gz",
-      "sha256": "6ed36077b67ac70a041f06f760f93ba79b33269885413c3c3f2c8c87ee60807e"
+      "sha256": null
     }
   },
   "auth_summary": {
diff --git a/registry/channels/telegram.json b/registry/channels/telegram.json
index 42fd7fb3..07975121 100644
--- a/registry/channels/telegram.json
+++ b/registry/channels/telegram.json
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/telegram-wasm32-wasip2.tar.gz",
-      "sha256": "98c86895a9c4b0a1e19fe8a47f1ccbfe7e972e112b05e584bc897130dc32283a"
+      "sha256": null
     }
   },
   "auth_summary": {
diff --git a/registry/channels/whatsapp.json b/registry/channels/whatsapp.json
index 84a69dc0..5e7c2bc3 100644
--- a/registry/channels/whatsapp.json
+++ b/registry/channels/whatsapp.json
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/whatsapp-wasm32-wasip2.tar.gz",
-      "sha256": "bd35cad18d87292ea8d2f52db9b514ed9f814a414de910f59073d475c26c4c14"
+      "sha256": null
     }
   },
   "auth_summary": {
diff --git a/registry/tools/github.json b/registry/tools/github.json
index 67d41882..bf7af291 100644
--- a/registry/tools/github.json
+++ b/registry/tools/github.json
@@ -20,7 +20,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/github-wasm32-wasip2.tar.gz",
-      "sha256": "6fcd32719a4ff15641a4b50fff8984686550f0c491dce60518f4126857d0c544"
+      "sha256": null
     }
   },
   "auth_summary": {
diff --git a/registry/tools/gmail.json b/registry/tools/gmail.json
index f1e7ab6e..2bdf6350 100644
--- a/registry/tools/gmail.json
+++ b/registry/tools/gmail.json
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/gmail-wasm32-wasip2.tar.gz",
-      "sha256": "023da7000b17568bf0e64b2e5013c8a042b2f323c85f1632339231c73d500e39"
+      "sha256": null
     }
   },
   "auth_summary": {
diff --git a/registry/tools/google-calendar.json b/registry/tools/google-calendar.json
index cfc6ec92..7b0afd80 100644
--- a/registry/tools/google-calendar.json
+++ b/registry/tools/google-calendar.json
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/google-calendar-wasm32-wasip2.tar.gz",
-      "sha256": "fc42277b65881d6e9bcc5403dc54c7f5b3ddeaaaf04617fce2c5da05d76325f0"
+      "sha256": null
     }
   },
   "auth_summary": {
diff --git a/registry/tools/google-docs.json b/registry/tools/google-docs.json
index 3f7107b2..b564d0e6 100644
--- a/registry/tools/google-docs.json
+++ b/registry/tools/google-docs.json
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/google-docs-wasm32-wasip2.tar.gz",
-      "sha256": "385c04abd1e6b8011ccc330e1f4bd7ce58577e488959b51594aa04eb26cbe7cc"
+      "sha256": null
     }
   },
   "auth_summary": {
diff --git a/registry/tools/google-drive.json b/registry/tools/google-drive.json
index d0e02f56..180aaa1e 100644
--- a/registry/tools/google-drive.json
+++ b/registry/tools/google-drive.json
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/google-drive-wasm32-wasip2.tar.gz",
-      "sha256": "1b107d575a5d52cc8c76d9a681802190f4373fb485f7f54f445533f097fa37c0"
+      "sha256": null
     }
   },
   "auth_summary": {
diff --git a/registry/tools/google-sheets.json b/registry/tools/google-sheets.json
index 8eb88ced..82575182 100644
--- a/registry/tools/google-sheets.json
+++ b/registry/tools/google-sheets.json
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/google-sheets-wasm32-wasip2.tar.gz",
-      "sha256": "c4f6b1e8c5126ac2c8a4b98e4283a3afa32223d2488fc3c3a609758c0c9beb90"
+      "sha256": null
     }
   },
   "auth_summary": {
diff --git a/registry/tools/google-slides.json b/registry/tools/google-slides.json
index 6c3a187c..5127b17d 100644
--- a/registry/tools/google-slides.json
+++ b/registry/tools/google-slides.json
@@ -18,7 +18,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/google-slides-wasm32-wasip2.tar.gz",
-      "sha256": "7110b8565340c888e51f99e9c013bf4de8f8a7f7b33bace00eb8fc47831ff20b"
+      "sha256": null
     }
   },
   "auth_summary": {
diff --git a/registry/tools/slack.json b/registry/tools/slack.json
index c1102021..fe038438 100644
--- a/registry/tools/slack.json
+++ b/registry/tools/slack.json
@@ -18,7 +18,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/slack-tool-wasm32-wasip2.tar.gz",
-      "sha256": "6ed36077b67ac70a041f06f760f93ba79b33269885413c3c3f2c8c87ee60807e"
+      "sha256": null
     }
   },
   "auth_summary": {
diff --git a/registry/tools/telegram.json b/registry/tools/telegram.json
index d96d8985..ab036396 100644
--- a/registry/tools/telegram.json
+++ b/registry/tools/telegram.json
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/telegram-mtproto-wasm32-wasip2.tar.gz",
-      "sha256": "98c86895a9c4b0a1e19fe8a47f1ccbfe7e972e112b05e584bc897130dc32283a"
+      "sha256": null
     }
   },
   "auth_summary": {
diff --git a/registry/tools/web-search.json b/registry/tools/web-search.json
index 7112d9b2..9c9111ac 100644
--- a/registry/tools/web-search.json
+++ b/registry/tools/web-search.json
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/web-search-wasm32-wasip2.tar.gz",
-      "sha256": "66cb2b9b00652385e9f30f17c74902b9222c17c53e9d3bd1ef42f5cab705bcf6"
+      "sha256": null
     }
   },
   "auth_summary": {
diff --git a/src/registry/installer.rs b/src/registry/installer.rs
index e4ae785c..342af326 100644
--- a/src/registry/installer.rs
+++ b/src/registry/installer.rs
@@ -20,16 +20,22 @@ const ALLOWED_ARTIFACT_HOSTS: &[&str] = &[
 ];
 
 fn should_attempt_source_fallback(err: &RegistryError) -> bool {
-    // MissingChecksum is intentionally allowed here — it's a bootstrapping issue
-    // (no release has populated checksums yet), not a security concern. Source
-    // builds use local trusted code. ChecksumMismatch (tampered artifact) and
-    // InvalidManifest (structural problem) remain blocked.
-    !matches!(
-        err,
-        RegistryError::AlreadyInstalled { .. }
-            | RegistryError::ChecksumMismatch { .. }
-            | RegistryError::InvalidManifest { .. }
-    )
+    match err {
+        // `releases/latest` is a moving target: every new release rebuilds WASM
+        // extensions, so a mismatch against a `latest` URL just means the binary
+        // was compiled against an older release's checksum. Not a security concern
+        // — fall back to building from source.
+        //
+        // Version-pinned URLs (`releases/download/vX.Y.Z/`) point to an immutable
+        // asset; a mismatch there is genuinely suspicious and remains a hard block.
+        RegistryError::ChecksumMismatch { url, .. } => {
+            url.contains("github.com/nearai/ironclaw/releases/latest/")
+        }
+        // Never fall back for these — they signal a structural problem or a
+        // deliberate "already done" state, not a transient artifact issue.
+        RegistryError::AlreadyInstalled { .. } | RegistryError::InvalidManifest { .. } => false,
+        _ => true,
+    }
 }
 
 fn is_allowed_artifact_host(host: &str) -> bool {
@@ -931,14 +937,6 @@ mod tests {
         };
         assert!(!should_attempt_source_fallback(&already));
 
-        let checksum = RegistryError::ChecksumMismatch {
-            url: "https://github.com/nearai/ironclaw/releases/latest/download/demo.wasm"
-                .to_string(),
-            expected_sha256: "deadbeef".to_string(),
-            actual_sha256: "feedface".to_string(),
-        };
-        assert!(!should_attempt_source_fallback(&checksum));
-
         let invalid = RegistryError::InvalidManifest {
             name: "demo".to_string(),
             field: "artifacts.wasm32-wasip2.url",
@@ -1088,4 +1086,30 @@ mod tests {
 
         assert!(result.is_err());
     }
+
+    // Regression test for issue #439: ChecksumMismatch on a `releases/latest` URL
+    // must allow source-build fallback (moving-target URL, not a security concern),
+    // while a mismatch on a version-pinned URL must remain a hard block.
+    #[test]
+    fn test_source_fallback_on_latest_url_mismatch() {
+        let latest_mismatch = RegistryError::ChecksumMismatch {
+            url: "https://github.com/nearai/ironclaw/releases/latest/download/github-wasm32-wasip2.tar.gz".to_string(),
+            expected_sha256: "aaa".to_string(),
+            actual_sha256: "bbb".to_string(),
+        };
+        assert!(
+            should_attempt_source_fallback(&latest_mismatch),
+            "ChecksumMismatch on releases/latest URL should allow source fallback"
+        );
+
+        let pinned_mismatch = RegistryError::ChecksumMismatch {
+            url: "https://github.com/nearai/ironclaw/releases/download/v0.7.0/github-0.2.0-wasm32-wasip2.tar.gz".to_string(),
+            expected_sha256: "aaa".to_string(),
+            actual_sha256: "bbb".to_string(),
+        };
+        assert!(
+            !should_attempt_source_fallback(&pinned_mismatch),
+            "ChecksumMismatch on version-pinned URL must remain a hard block"
+        );
+    }
 }