diff --git a/.github/workflows/beta-release.yml b/.github/workflows/beta-release.yml
index cfe22e3..f4c4d0f 100644
--- a/.github/workflows/beta-release.yml
+++ b/.github/workflows/beta-release.yml
@@ -116,10 +116,27 @@ jobs:
           git tag "$TAG"
           git push origin "$TAG"
 
-      # The `-beta.N` suffix is what makes electron-builder emit beta.yml
-      # rather than latest.yml — the whole isolation guarantee rests on it.
+      # The channel must be named explicitly. electron-builder takes its output
+      # channel from publish.channel (default "latest") and does NOT derive it
+      # from the version's prerelease tag — even though electron-updater derives
+      # its *read* channel exactly that way. Without this the build writes
+      # latest.yml, no beta feed is ever produced, and beta installs have
+      # nothing to update from. (v3.8.1-beta.1 shipped that way.)
       - name: Build the Windows installer
-        run: npx electron-builder --win --publish never
+        run: npx electron-builder --win --publish never -c.publish.channel=beta
+
+      # The upload action only *warns* on a glob that matches nothing, so the
+      # first beta published as a green run with no update feed at all. A
+      # release missing its channel file is broken — fail loudly instead.
+      - name: Verify the beta update feed was generated
+        shell: bash
+        run: |
+          if [ ! -f dist/beta.yml ]; then
+            echo "::error::dist/beta.yml was not generated — beta installs would have no update feed."
+            echo "dist/ contains:"; ls -la dist/
+            exit 1
+          fi
+          echo "beta.yml:"; cat dist/beta.yml
 
       - name: Publish the prerelease
         uses: softprops/action-gh-release@v3
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c47f304..a5c7d0e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -67,6 +67,19 @@ jobs:
       - name: Build the Windows installer
         run: npx electron-builder --win --publish never
 
+      # The upload action only warns on a glob that matches nothing, so a
+      # release missing latest.yml would publish as a green run and silently
+      # strand every existing install on its current version. Fail loudly.
+      - name: Verify the update feed was generated
+        shell: bash
+        run: |
+          if [ ! -f dist/latest.yml ]; then
+            echo "::error::dist/latest.yml was not generated — existing installs would never see this release."
+            echo "dist/ contains:"; ls -la dist/
+            exit 1
+          fi
+          echo "latest.yml:"; cat dist/latest.yml
+
       # The install header stays ABOVE the generated notes (the API
       # prepends `body`); the "What's Changed" changelog below it is
       # shaped by .github/release.yml.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index f05da00..932fb88 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -31,6 +31,13 @@ the last beta. Leaving the channel is deliberate: Settings → App → *Which bu
 to* → **Stable only** (`app.updateChannel`), which is also the only path allowed to step the
 version down.
 
+> The beta build must pass `-c.publish.channel=beta` to electron-builder. Its output channel
+> comes from `publish.channel` (default `latest`) and is **not** derived from the version's
+> prerelease tag — even though electron-updater derives its *read* channel exactly that way.
+> Both workflows assert their channel file exists before publishing, because the upload
+> action only warns on a glob that matches nothing: `v3.8.1-beta.1` shipped as a green run
+> with no update feed at all.
+
 > Beta tags are excluded wherever the next stable version is computed. They sort *above*
 > the release they precede, and `3.8.0-beta.1` split on `.` puts `0-beta.1` where a number
 > belongs — which is a fatal arithmetic error, not a wrong answer. Keep the