diff --git a/Cargo.lock b/Cargo.lock
index 2695c1d41..e59e6819f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -216,9 +216,9 @@ dependencies = [
 
 [[package]]
 name = "axoupdater"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fb8d8889305a413a040f281197bb2f8982a1d25c9696707cab350e3cc780ba5"
+checksum = "a70b7d3a9ea86ef8d17dada23f2c42518ed4b75dd6a8ff761f8988b448db8454"
 dependencies = [
  "axoasset",
  "axoprocess",
diff --git a/Cargo.toml b/Cargo.toml
index bfb3a2697..fd097b4f5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -22,7 +22,7 @@ axoproject = { version = "=0.26.1", path = "axoproject", default-features = fals
 
 # first-party deps
 axocli = { version = "0.2.0" }
-axoupdater = { version = "0.8.1" }
+axoupdater = { version = "0.8.2" }
 axotag = "0.2.0"
 axoasset = { version = "1.2.0", features = ["json-serde", "toml-serde", "toml-edit", "yaml-serde", "compression", "remote"] }
 axoprocess = { version = "0.2.0" }
diff --git a/cargo-dist/src/config/v0.rs b/cargo-dist/src/config/v0.rs
index 79cb27215..176f031fb 100644
--- a/cargo-dist/src/config/v0.rs
+++ b/cargo-dist/src/config/v0.rs
@@ -426,6 +426,10 @@ pub struct DistMetadata {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub install_updater: Option<bool>,
 
+    /// Whether to always use the latest axoupdater instead of a known-good version
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub always_use_latest_updater: Option<bool>,
+
     /// Whether artifacts/installers for this app should be displayed in release bodies
     #[serde(skip_serializing_if = "Option::is_none")]
     pub display: Option<bool>,
@@ -533,6 +537,7 @@ impl DistMetadata {
             bin_aliases: _,
             tag_namespace: _,
             install_updater: _,
+            always_use_latest_updater: _,
             github_releases_repo: _,
             github_releases_submodule_path: _,
             display: _,
@@ -634,6 +639,7 @@ impl DistMetadata {
             bin_aliases,
             tag_namespace,
             install_updater,
+            always_use_latest_updater,
             github_releases_repo,
             github_releases_submodule_path,
             display,
@@ -818,6 +824,9 @@ impl DistMetadata {
         if install_updater.is_none() {
             *install_updater = workspace_config.install_updater;
         }
+        if always_use_latest_updater.is_none() {
+            *always_use_latest_updater = workspace_config.always_use_latest_updater;
+        }
         if display.is_none() {
             *display = workspace_config.display;
         }
diff --git a/cargo-dist/src/config/v0_to_v1.rs b/cargo-dist/src/config/v0_to_v1.rs
index a600da127..6ffb0ef5a 100644
--- a/cargo-dist/src/config/v0_to_v1.rs
+++ b/cargo-dist/src/config/v0_to_v1.rs
@@ -78,6 +78,7 @@ impl DistMetadata {
             bin_aliases,
             tag_namespace,
             install_updater,
+            always_use_latest_updater,
             display,
             display_name,
             package_libraries,
@@ -314,7 +315,8 @@ impl DistMetadata {
             || install_success_msg.is_some()
             || install_libraries.is_some()
             || bin_aliases.is_some()
-            || install_updater.is_some();
+            || install_updater.is_some()
+            || always_use_latest_updater.is_some();
         let installer_layer = needs_installer_layer.then_some(InstallerLayer {
             common: CommonInstallerLayer {
                 install_path,
@@ -329,6 +331,7 @@ impl DistMetadata {
             shell: shell_installer_layer,
             pkg: pkg_installer_layer,
             updater: install_updater,
+            always_use_latest_updater,
         });
 
         // publish
diff --git a/cargo-dist/src/config/v1/installers/mod.rs b/cargo-dist/src/config/v1/installers/mod.rs
index becd15639..a3ee203ce 100644
--- a/cargo-dist/src/config/v1/installers/mod.rs
+++ b/cargo-dist/src/config/v1/installers/mod.rs
@@ -21,6 +21,8 @@ use shell::*;
 pub struct WorkspaceInstallerConfig {
     /// Whether to install an updater program alongside the software
     pub updater: bool,
+    /// Whether to always use the latest version instead of a known-good version
+    pub always_use_latest_updater: bool,
 }
 /// package installer config (final)
 #[derive(Debug, Default, Clone)]
@@ -58,6 +60,8 @@ pub struct InstallerConfigInheritable {
     pub pkg: Option<PkgInstallerLayer>,
     /// Whether to install an updater program alongside the software
     pub updater: bool,
+    /// Whether to always use the latest version instead of a fixed version
+    pub always_use_latest_updater: bool,
 }
 
 /// installer config (raw from file)
@@ -82,6 +86,9 @@ pub struct InstallerLayer {
     /// Whether to install an updater program alongside the software
     #[serde(skip_serializing_if = "Option::is_none")]
     pub updater: Option<bool>,
+    /// Whether to always use the latest updater version instead of a fixed version
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub always_use_latest_updater: Option<bool>,
 }
 impl InstallerConfigInheritable {
     /// defaults for a workspace
@@ -103,6 +110,7 @@ impl InstallerConfigInheritable {
             shell: None,
             pkg: None,
             updater: false,
+            always_use_latest_updater: false,
         }
     }
     /// apply inheritance to and get final workspace config
@@ -113,6 +121,7 @@ impl InstallerConfigInheritable {
         let Self {
             // global
             updater,
+            always_use_latest_updater,
             // local-only
             common: _,
             homebrew: _,
@@ -123,7 +132,10 @@ impl InstallerConfigInheritable {
             pkg: _,
         } = self;
 
-        WorkspaceInstallerConfig { updater }
+        WorkspaceInstallerConfig {
+            updater,
+            always_use_latest_updater,
+        }
     }
     /// apply inheritance to get final package config
     pub fn apply_inheritance_for_package(
@@ -141,6 +153,7 @@ impl InstallerConfigInheritable {
             pkg,
             // global-only
             updater: _,
+            always_use_latest_updater: _,
         } = self;
         let homebrew = homebrew.map(|homebrew| {
             let mut default =
@@ -201,6 +214,7 @@ impl ApplyLayer for InstallerConfigInheritable {
             shell,
             pkg,
             updater,
+            always_use_latest_updater,
         }: Self::Layer,
     ) {
         self.common.apply_layer(common);
@@ -211,6 +225,8 @@ impl ApplyLayer for InstallerConfigInheritable {
         self.shell.apply_bool_layer(shell);
         self.pkg.apply_bool_layer(pkg);
         self.updater.apply_val(updater);
+        self.always_use_latest_updater
+            .apply_val(always_use_latest_updater);
     }
 }
 
diff --git a/cargo-dist/src/init.rs b/cargo-dist/src/init.rs
index fa781245c..75c1f7162 100644
--- a/cargo-dist/src/init.rs
+++ b/cargo-dist/src/init.rs
@@ -456,6 +456,7 @@ fn get_new_dist_metadata(
             bin_aliases: None,
             tag_namespace: None,
             install_updater: None,
+            always_use_latest_updater: None,
             display: None,
             display_name: None,
             package_libraries: None,
@@ -951,6 +952,7 @@ fn apply_dist_to_metadata(metadata: &mut toml_edit::Item, meta: &DistMetadata) {
         hosting,
         tag_namespace,
         install_updater,
+        always_use_latest_updater,
         display,
         display_name,
         github_release,
@@ -1340,6 +1342,13 @@ fn apply_dist_to_metadata(metadata: &mut toml_edit::Item, meta: &DistMetadata) {
         *install_updater,
     );
 
+    apply_optional_value(
+        table,
+        "always-use-latest-updater",
+        "# Whether to always use the latest updater instead of a specific known-good version\n",
+        *always_use_latest_updater,
+    );
+
     apply_optional_value(
         table,
         "display",
diff --git a/cargo-dist/src/lib.rs b/cargo-dist/src/lib.rs
index b02525e7c..4c2a52023 100644
--- a/cargo-dist/src/lib.rs
+++ b/cargo-dist/src/lib.rs
@@ -251,10 +251,17 @@ fn run_build_step(
     Ok(())
 }
 
-const AXOUPDATER_ASSET_ROOT: &str =
-    "https://github.com/axodotdev/axoupdater/releases/latest/download";
+const AXOUPDATER_ASSET_ROOT: &str = "https://github.com/axodotdev/axoupdater/releases";
 const AXOUPDATER_MINIMUM_VERSION: &str = "0.7.0";
 
+fn axoupdater_latest_asset_root() -> String {
+    format!("{AXOUPDATER_ASSET_ROOT}/latest/download")
+}
+
+fn axoupdater_asset_root() -> String {
+    format!("{AXOUPDATER_ASSET_ROOT}/download/v{}", axoupdater::VERSION)
+}
+
 /// Fetches an installer executable and installs it in the expected target path.
 pub fn fetch_updater(dist_graph: &DistGraph, updater: &UpdaterStep) -> DistResult<()> {
     let ext = if updater.target_triple.is_windows() {
@@ -262,9 +269,16 @@ pub fn fetch_updater(dist_graph: &DistGraph, updater: &UpdaterStep) -> DistResul
     } else {
         ".tar.xz"
     };
+
+    let asset_root = if updater.use_latest {
+        axoupdater_latest_asset_root()
+    } else {
+        axoupdater_asset_root()
+    };
+
     let expected_url = format!(
-        "{AXOUPDATER_ASSET_ROOT}/axoupdater-cli-{}{ext}",
-        updater.target_triple
+        "{}/axoupdater-cli-{}{ext}",
+        asset_root, updater.target_triple
     );
 
     let handle = tokio::runtime::Handle::current();
diff --git a/cargo-dist/src/tasks.rs b/cargo-dist/src/tasks.rs
index 4c83ec88f..5975ba4fb 100644
--- a/cargo-dist/src/tasks.rs
+++ b/cargo-dist/src/tasks.rs
@@ -662,6 +662,8 @@ pub struct UpdaterStep {
     pub target_triple: TripleName,
     /// The file this should produce
     pub target_filename: Utf8PathBuf,
+    /// Whether to use the latest release instead of a fixed version
+    pub use_latest: bool,
 }
 
 /// A kind of symbols (debuginfo)
@@ -802,7 +804,10 @@ pub struct ExtraArtifactImpl {
 
 /// An updater executable
 #[derive(Clone, Debug)]
-pub struct UpdaterImpl {}
+pub struct UpdaterImpl {
+    /// Whether to use the latest or a specific known-good version
+    pub use_latest: bool,
+}
 
 /// A file containing a Software Bill Of Materials
 #[derive(Clone, Debug)]
@@ -1811,7 +1816,9 @@ impl<'pkg_graph> DistGraphBuilder<'pkg_graph> {
             file_path: target_path.to_owned(),
             required_binaries: FastMap::new(),
             archive: None,
-            kind: ArtifactKind::Updater(UpdaterImpl {}),
+            kind: ArtifactKind::Updater(UpdaterImpl {
+                use_latest: self.inner.config.installers.always_use_latest_updater,
+            }),
             checksum: None,
             is_global: false,
         }
@@ -2739,11 +2746,12 @@ impl<'pkg_graph> DistGraphBuilder<'pkg_graph> {
                 ArtifactKind::ExtraArtifact(_) => {
                     // compute_extra_builds handles this
                 }
-                ArtifactKind::Updater(_) => {
+                ArtifactKind::Updater(UpdaterImpl { use_latest }) => {
                     build_steps.push(BuildStep::Updater(UpdaterStep {
                         // There should only be one triple per artifact
                         target_triple: artifact.target_triples.first().unwrap().to_owned(),
                         target_filename: artifact.file_path.to_owned(),
+                        use_latest: *use_latest,
                     }))
                 }
                 ArtifactKind::SBOM(_) => {
diff --git a/cargo-dist/tests/integration-tests.rs b/cargo-dist/tests/integration-tests.rs
index 4edb243cf..2a4a81f4e 100644
--- a/cargo-dist/tests/integration-tests.rs
+++ b/cargo-dist/tests/integration-tests.rs
@@ -895,6 +895,7 @@ unix-archive = ".tar.gz"
 windows-archive = ".tar.gz"
 npm-scope ="@axodotdev"
 install-updater = true
+always-use-latest-updater = true
 
 [package.metadata.wix]
 upgrade-guid = "B36177BE-EA4D-44FB-B05C-EDDABDAA95CA"