diff --git a/.gitea/workflows/build-windows.yml b/.gitea/workflows/build-windows.yml
index 7ead94974..a0f68acb3 100644
--- a/.gitea/workflows/build-windows.yml
+++ b/.gitea/workflows/build-windows.yml
@@ -4,6 +4,11 @@ on:
   push:
     branches: [pro-features]
   workflow_dispatch:
+    inputs:
+      version_suffix:
+        description: "Version suffix (e.g. 'cst', 'beta1'). Empty = vanilla."
+        type: string
+        default: "cst"
 
 env:
   RUST_VERSION: "1.75"
@@ -12,7 +17,11 @@ env:
   VCPKG_COMMIT_ID: "120deac3062162151622ca4860575a33844ba10b"
   CARGO_EXPAND_VERSION: "1.0.95"
   FLUTTER_RUST_BRIDGE_VERSION: "1.80.1"
-  VERSION: "1.4.6"
+  # Numeric base, must match Cargo.toml's <major>.<minor>.<patch>.
+  # MSI ProductVersion is forced to this (Windows Installer rejects non-numeric).
+  VERSION_BASE: "1.4.6"
+  # Default suffix on push events. workflow_dispatch can override per-run.
+  VERSION_SUFFIX: ${{ inputs.version_suffix || 'cst' }}
 
 jobs:
   build-x64:
@@ -49,6 +58,29 @@ jobs:
           }
           Write-Host "VCPKG_ROOT  $env:VCPKG_ROOT"
 
+      - name: Compute version strings
+        shell: pwsh
+        run: |
+          $base   = "${env:VERSION_BASE}"
+          $suffix = "${env:VERSION_SUFFIX}"
+          if ($base -notmatch '^\d+\.\d+\.\d+$') {
+            Write-Error "VERSION_BASE '$base' must be major.minor.patch numeric"
+            exit 1
+          }
+          if ($suffix) { $display = "$base-$suffix" } else { $display = $base }
+          Write-Host ("Base    : {0}  (used for MSI ProductVersion)" -f $base)
+          Write-Host ("Suffix  : {0}" -f $suffix)
+          Write-Host ("Display : {0}  (used for exe filename + Cargo.toml)" -f $display)
+          "VERSION_DISPLAY=$display" | Out-File -FilePath $env:GITHUB_ENV -Append
+
+      - name: Patch Cargo.toml with display version
+        shell: bash
+        run: |
+          # Cargo accepts SemVer-style suffix with a hyphen (e.g. 1.4.6-cst).
+          sed -i -E "0,/^version[[:space:]]*=/{s/^version[[:space:]]*=[[:space:]]*\"${VERSION_BASE}\"/version = \"${VERSION_DISPLAY}\"/}" Cargo.toml
+          echo "--- Cargo.toml [package] ---"
+          awk '/^\[package\]/{f=1} f; /^\[/&&!/^\[package\]/{f=0}' Cargo.toml | head -10
+
       - name: Install flutter_rust_bridge codegen tools
         shell: bash
         run: |
@@ -138,13 +170,16 @@ jobs:
           python ./generate.py -f ../../rustdesk/ -o . -e ../../rustdesk/rustdesk.exe
           popd
           mkdir -p ./SignOutput
-          mv ./target/release/rustdesk-portable-packer.exe "./SignOutput/rustdesk-${VERSION}-x86_64.exe"
+          mv ./target/release/rustdesk-portable-packer.exe "./SignOutput/rustdesk-${VERSION_DISPLAY}-x86_64.exe"
 
       - name: Build MSI installer
         shell: pwsh
         run: |
           Push-Location .\res\msi
-          python preprocess.py --arp -d ..\..\rustdesk
+          # Pass numeric VERSION_BASE explicitly: MSI ProductVersion must be numeric,
+          # so we cannot let preprocess.py auto-detect from rustdesk.exe (which now
+          # carries the suffixed VERSION_DISPLAY).
+          python preprocess.py --arp -d ..\..\rustdesk -v "${env:VERSION_BASE}"
 
           # Resolve MSBuild from the installed VS Build Tools.
           $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
@@ -162,7 +197,7 @@ jobs:
           & $msbuild msi.sln -p:Configuration=Release -p:Platform=x64 /p:TargetVersion=Windows10
           if ($LASTEXITCODE -ne 0) { throw "MSBuild build failed ($LASTEXITCODE)" }
 
-          Move-Item -Force .\Package\bin\x64\Release\en-us\Package.msi "..\..\SignOutput\rustdesk-${env:VERSION}-x86_64.msi"
+          Move-Item -Force .\Package\bin\x64\Release\en-us\Package.msi "..\..\SignOutput\rustdesk-${env:VERSION_DISPLAY}-x86_64.msi"
           Pop-Location
 
       - name: Report signing status of build artifacts