diff --git a/iso/builder/build.sh b/iso/builder/build.sh
index cd01975..d70c5bb 100755
--- a/iso/builder/build.sh
+++ b/iso/builder/build.sh
@@ -42,7 +42,7 @@ resolve_audit_version() {
 
     tag="$(git -C "${REPO_ROOT}" describe --tags --match 'audit/v*' --abbrev=7 --dirty 2>/dev/null || true)"
     if [ -z "${tag}" ]; then
-        tag="$(git -C "${REPO_ROOT}" describe --tags --match 'v*' --abbrev=7 --dirty 2>/dev/null || true)"
+        tag="$(git -C "${REPO_ROOT}" describe --tags --match 'v[0-9]*' --abbrev=7 --dirty 2>/dev/null || true)"
     fi
     case "${tag}" in
         audit/v*)
@@ -76,19 +76,20 @@ resolve_iso_version() {
         return 0
     fi
 
-    tag="$(git -C "${REPO_ROOT}" describe --tags --match 'iso/v*' --abbrev=7 --dirty 2>/dev/null || true)"
+    # Plain v* tags (e.g. v2.7) take priority — this is the current tagging scheme
+    tag="$(git -C "${REPO_ROOT}" describe --tags --match 'v[0-9]*' --abbrev=7 --dirty 2>/dev/null || true)"
     case "${tag}" in
-        iso/v*)
-            echo "${tag#iso/v}"
+        v*)
+            echo "${tag#v}"
             return 0
             ;;
     esac
 
-    # Also accept plain v* tags (e.g. v2, v2.1 used for GUI releases)
-    tag="$(git -C "${REPO_ROOT}" describe --tags --match 'v*' --abbrev=7 --dirty 2>/dev/null || true)"
+    # Legacy iso/v* tags fallback
+    tag="$(git -C "${REPO_ROOT}" describe --tags --match 'iso/v*' --abbrev=7 --dirty 2>/dev/null || true)"
     case "${tag}" in
-        v*)
-            echo "${tag#v}"
+        iso/v*)
+            echo "${tag#iso/v}"
             return 0
             ;;
     esac