diff --git a/.github/workflows/bundle.yml b/.github/workflows/bundle.yml
index f014143..1fc7a7b 100644
--- a/.github/workflows/bundle.yml
+++ b/.github/workflows/bundle.yml
@@ -1,8 +1,10 @@
 # Builds the single-file wizard (.github/tools/bundle.sh) and publishes it as a
 # release per version: tag v$VERSION (VERSION in setup-gamescope-boot.sh),
 # with that version's CHANGELOG.md section as notes. A released version is
-# never overwritten; the newest one is marked latest, so this always gets it:
+# never overwritten; the newest one is marked latest, and the "latest" tag and
+# release are moved to it, so both of these always get the newest version:
 #   curl -fsSL https://github.com/theupriser/cachyos-gamescope-boot/releases/latest/download/setup-gamescope-boot.sh | bash
+#   curl -fsSL https://github.com/theupriser/cachyos-gamescope-boot/releases/download/latest/setup-gamescope-boot.sh | bash
 # Pull requests only build and check it, and warn when VERSION is already released.
 name: Single-file build
 
@@ -72,3 +74,15 @@ jobs:
           $changes"
           gh release create "v$VERSION" dist/setup-gamescope-boot.sh \
               --target "$GITHUB_SHA" --title "v$VERSION" --notes "$notes" --latest
+
+          # "latest" follows the newest version tag, for the older install URL
+          # (.../releases/download/latest/...). Only moved when a new version
+          # is released, never for a push without a VERSION bump.
+          git tag -f latest "$GITHUB_SHA" && git push -f origin latest
+          latest_notes="Always the newest version, currently v$VERSION (see its release for the changes)."
+          if gh release view latest >/dev/null 2>&1; then
+            gh release edit latest --title "Latest (v$VERSION)" --notes "$latest_notes" --latest=false
+          else
+            gh release create latest --title "Latest (v$VERSION)" --notes "$latest_notes" --latest=false
+          fi
+          gh release upload latest dist/setup-gamescope-boot.sh --clobber
diff --git a/AGENTS.md b/AGENTS.md
index 5719eb1..80da0f5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -70,9 +70,10 @@ gamescope and the Plasma desktop. Primary target: the Valve Steam Machine
     changelog section) and marks it latest. An existing version is never
     overwritten: without a bump nothing is released, and pull requests show
     a warning.
-  - Users install through `releases/latest/download/setup-gamescope-boot.sh`,
-    which always resolves to the newest release. The old rolling `latest` tag
-    and release are from before 0.7.0 and are no longer updated.
+  - Users install through `releases/latest/download/setup-gamescope-boot.sh`
+    (GitHub's newest release). The `latest` tag and release follow the newest
+    version tag too (moved, asset replaced, when a new version is released),
+    so the older URL `releases/download/latest/...` keeps working.
 
 ## Non-obvious behaviour to preserve
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4805eee..39bb60e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -51,7 +51,11 @@ Machine LED driver works on every installed kernel and survives kernel updates.
     get a warning when `VERSION` wasn't bumped).
   - Install with `.../releases/latest/download/setup-gamescope-boot.sh`, which
     always points to the newest release.
-- **docs: Versioning and release rules in AGENTS.md**
+- `1604ed1` **docs: Versioning and release rules in AGENTS.md**
+- **ci: The latest tag follows the newest version tag**
+  - When a new version is released, the `latest` tag and release move to it
+    (bundle replaced), so the older `.../releases/download/latest/...` URL
+    also always gives the newest version.
 
 ## 0.6.2 - 2026-09-23
 
diff --git a/README.md b/README.md
index 9955aa8..215d969 100644
--- a/README.md
+++ b/README.md
@@ -335,7 +335,8 @@ gamescope-session, ...) stay installed.
 The single-file version is generated: on every push to `main`, GitHub
 Actions runs `.github/tools/bundle.sh`, checks the result with `bash -n` and
 shellcheck, and publishes it as a release per version (tag `v<VERSION>`,
-never overwritten; the newest is marked latest). It inlines
+never overwritten; the newest is marked latest, and the `latest` tag follows
+it). It inlines
 `lib/*.sh` and wraps the entry point in `main()`, so bash has read the whole
 file before anything runs; when stdin is a pipe (`curl | bash`) it reattaches
 the terminal for the menu (set `WIZARD_KEEP_STDIN=1` to keep piped input).