diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9fad8a2..1524cfa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -55,6 +55,11 @@ jobs:
         with:
           workspaces: src-tauri
       - run: bun install --frozen-lockfile
+      - name: Get app version
+        id: get_version
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          echo "version=v$VERSION" >> $GITHUB_OUTPUT
       - uses: tauri-apps/tauri-action@v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -68,8 +73,8 @@ jobs:
           APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         with:
-          tagName: ${{ startsWith(github.ref, 'refs/tags/v') && github.ref_name || format('build-{0}', github.run_id) }}
-          releaseName: ${{ startsWith(github.ref, 'refs/tags/v') && format('SSHBool {0}', github.ref_name) || format('SSHBool build-{0}', github.run_id) }}
+          tagName: ${{ startsWith(github.ref, 'refs/tags/v') && github.ref_name || steps.get_version.outputs.version }}
+          releaseName: ${{ startsWith(github.ref, 'refs/tags/v') && format('SSHBool {0}', github.ref_name) || format('SSHBool {0}', steps.get_version.outputs.version) }}
           releaseBody: "See the docs for changelog."
           releaseDraft: false
           prerelease: false
diff --git a/src-tauri/crates/infrastructure/src/db.rs b/src-tauri/crates/infrastructure/src/db.rs
index 3e4dd88..9faf33d 100644
--- a/src-tauri/crates/infrastructure/src/db.rs
+++ b/src-tauri/crates/infrastructure/src/db.rs
@@ -183,15 +183,16 @@ async fn backfill_legacy_migrations(pool: &SqlitePool) -> Result<(), DomainError
 }
 
 async fn run_migration_sql(pool: &SqlitePool, id: &str, sql: &str) -> Result<(), DomainError> {
-    // Split on `;` and strip comment-only lines. Do NOT skip a whole chunk just because
-    // it begins with a `--` header comment (that used to drop CREATE TABLE statements).
-    for stmt in sql.split(';') {
-        let meaningful = stmt
-            .lines()
-            .map(str::trim)
-            .filter(|l| !l.is_empty() && !l.starts_with("--"))
-            .collect::<Vec<_>>()
-            .join("\n");
+    // Strip comment lines starting with `--` BEFORE splitting on `;` so semicolons in comments don't break statements.
+    let clean_sql = sql
+        .lines()
+        .map(str::trim)
+        .filter(|l| !l.starts_with("--"))
+        .collect::<Vec<_>>()
+        .join("\n");
+
+    for stmt in clean_sql.split(';') {
+        let meaningful = stmt.trim();
         if meaningful.is_empty() {
             continue;
         }
diff --git a/src-tauri/migrations/0018_reset_unverified_known_hosts.sql b/src-tauri/migrations/0018_reset_unverified_known_hosts.sql
index f3dd4d1..5e3f154 100644
--- a/src-tauri/migrations/0018_reset_unverified_known_hosts.sql
+++ b/src-tauri/migrations/0018_reset_unverified_known_hosts.sql
@@ -1,3 +1,4 @@
 -- 0018_reset_unverified_known_hosts.sql
 -- One-time reset for VULN-01 (legacy auto-trusted fingerprints).
--- The DELETE ran once during the original release; do not re-run on every startup.
+-- The DELETE ran once during the original release - do not re-run on every startup.
+SELECT 1;
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 8edaa6b..f4e3a99 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -66,8 +66,8 @@
   "bundle": {
     "active": true,
     "targets": "all",
-    "externalBin": ["binaries/wfreerdp"],
     "resources": {
+      "binaries/wfreerdp-x86_64-pc-windows-msvc.exe": "binaries/wfreerdp-x86_64-pc-windows-msvc.exe",
       "binaries/guacd/README.md": "binaries/guacd/README.md",
       "../scripts/download-guacd.ps1": "scripts/download-guacd.ps1"
     },