diff --git a/image-recipe/build-auto-installer-iso.sh b/image-recipe/build-auto-installer-iso.sh
index 777fafff..6ed53534 100755
--- a/image-recipe/build-auto-installer-iso.sh
+++ b/image-recipe/build-auto-installer-iso.sh
@@ -1024,17 +1024,18 @@ echo "   Expected backend version (from Cargo.toml): $EXPECTED_VERSION"
 
 verify_backend_version() {
     local bin="$1"
-    local embedded
-    # CARGO_PKG_VERSION is compiled into the binary as a string literal;
-    # the easiest way to recover it without running the daemon is to grep
-    # the binary for an anchored version string. This is cheap and safe.
-    embedded=$(strings "$bin" 2>/dev/null | grep -E "^${EXPECTED_VERSION}$" | head -1)
-    if [ -z "$embedded" ]; then
-        echo "   ⚠️  Captured binary does NOT contain expected version $EXPECTED_VERSION — it is stale"
-        return 1
+    # CARGO_PKG_VERSION is compiled into the binary as a string literal.
+    # `strings` output concatenates adjacent printable bytes, so the
+    # version rarely sits on its own line — a fixed-string substring
+    # match is the right tool. The version is specific enough (e.g.
+    # "1.5.0-alpha") that accidental collisions with unrelated data
+    # are vanishingly unlikely.
+    if strings "$bin" 2>/dev/null | grep -qF "$EXPECTED_VERSION"; then
+        echo "   ✅ Version match: binary contains $EXPECTED_VERSION"
+        return 0
     fi
-    echo "   ✅ Version match: binary contains $EXPECTED_VERSION"
-    return 0
+    echo "   ⚠️  Captured binary does NOT contain expected version $EXPECTED_VERSION — it is stale"
+    return 1
 }
 
 # Check for local release binary first (works for both BUILD_FROM_SOURCE and normal mode)