diff --git a/electron/preload.js b/electron/preload.js
index 133119513..4835dd294 100644
--- a/electron/preload.js
+++ b/electron/preload.js
@@ -83,7 +83,7 @@ contextBridge.exposeInMainWorld("electronAPI", {
 
   externalBrowserLogin: (authUrl, callbackPort) =>
     ipcRenderer.invoke("external-browser-login", authUrl, callbackPort),
-  // 2.8 name, read by older server login pages. Remove in 3.0.0.
+  // 2.8 name, read by older server login pages. Remove in 26.10.0.
   oidcSystemBrowserAuth: (authUrl, callbackPort) =>
     ipcRenderer.invoke("external-browser-login", authUrl, callbackPort),
 
diff --git a/package-lock.json b/package-lock.json
index e6f1bb7f1..cc237dbf9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "termix",
-  "version": "2.9.0",
+  "version": "26.10.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "termix",
-      "version": "2.9.0",
+      "version": "26.10.0",
       "hasInstallScript": true,
       "workspaces": [
         "packages/*",
diff --git a/package.json b/package.json
index 4544a4f90..10fd4263e 100644
--- a/package.json
+++ b/package.json
@@ -5,7 +5,7 @@
     "packages/*",
     "plugins/*"
   ],
-  "version": "2.9.0",
+  "version": "26.10.0",
   "description": "Self-hosted SSH and remote desktop management.",
   "author": "Karmaa",
   "main": "electron/main.cjs",
diff --git a/packages/plugin-sdk/FINISH-LIST.md b/packages/plugin-sdk/FINISH-LIST.md
index 4f60a8754..1b6d36347 100644
--- a/packages/plugin-sdk/FINISH-LIST.md
+++ b/packages/plugin-sdk/FINISH-LIST.md
@@ -202,7 +202,7 @@ with a real install, a real device or a repo outside this one.
 
 ## Left for later
 
-- 3.0.0: drop the migrated 2.8 settings rows (`guac_url`, `step_ca_url`,
+- 26.10.0: drop the migrated 2.8 settings rows (`guac_url`, `step_ca_url`,
   `global_metrics_interval` and the rest). The upgrade moves leave them in
   place so a downgrade to 2.8 still works; nothing reads them in 2.9.
 - Plugin repo split: knip still reports about 150 unused exports inside
@@ -225,4 +225,4 @@ with a real install, a real device or a repo outside this one.
   SSH password for an RDP login (2.8 behaviour, behind `credentials:read`);
   a remote desktop display token can be replayed within its five minute TTL
   (strict single use would break the touch mode switch and reconnect, which
-  reuse it). Revisit with signing and the install UI in 3.0.0.
+  reuse it). Revisit with signing and the install UI in 26.10.0.
diff --git a/packages/plugin-sdk/src/manifest.ts b/packages/plugin-sdk/src/manifest.ts
index 73c6e114a..a632346ab 100644
--- a/packages/plugin-sdk/src/manifest.ts
+++ b/packages/plugin-sdk/src/manifest.ts
@@ -277,7 +277,7 @@ export interface PluginSettingsField {
   component?: string;
   /**
    * Deprecated and ignored: host defaults cover every host field now. Still
-   * accepted so an older manifest loads. Removed in 3.0.0.
+   * accepted so an older manifest loads. Removed in 26.10.0.
    */
   defaultFrom?: string;
   /**
diff --git a/scripts/latest-dev-branch.test.ts b/scripts/latest-dev-branch.test.ts
index 926b86e11..7a6080506 100644
--- a/scripts/latest-dev-branch.test.ts
+++ b/scripts/latest-dev-branch.test.ts
@@ -15,6 +15,13 @@ describe("latestDevBranch", () => {
     expect(latestDevBranch(["dev-2.10.0", "dev-2.9.0"])).toBe("dev-2.10.0");
   });
 
+  it("ranks calendar versions above the old semver ones", () => {
+    expect(
+      latestDevBranch(["dev-2.9.1", "dev-26.10.0", "dev-26.9.0", "dev-3.0.0"]),
+    ).toBe("dev-26.10.0");
+    expect(latestDevBranch(["dev-26.12.0", "dev-27.1.0"])).toBe("dev-27.1.0");
+  });
+
   it("ignores main and non-dev branches", () => {
     expect(latestDevBranch(["main", "feature/x", "dev-1.0.0"])).toBe(
       "dev-1.0.0",
diff --git a/src/backend/auth/external-account.ts b/src/backend/auth/external-account.ts
index 0795e0618..e92c515a7 100644
--- a/src/backend/auth/external-account.ts
+++ b/src/backend/auth/external-account.ts
@@ -1,7 +1,7 @@
 /**
  * Whether a user signs in through an external login (SSO, LDAP or any login
  * plugin) rather than only a password. Read from the is_oidc column, which
- * keeps its 2.8 name until 3.0.0 replaces it with user_external_identities.
+ * keeps its 2.8 name until 26.10.0 replaces it with user_external_identities.
  */
 export function isExternalAccount(user: {
   isOidc?: boolean | number | null;
diff --git a/src/backend/auth/session-issuer.ts b/src/backend/auth/session-issuer.ts
index be0b8fda9..f8b978bba 100644
--- a/src/backend/auth/session-issuer.ts
+++ b/src/backend/auth/session-issuer.ts
@@ -141,7 +141,7 @@ export async function issueSession(
       username: user.username,
       userId: user.id,
       is_external: isExternalAccount(user),
-      // 2.8 name, kept until 3.0.0.
+      // 2.8 name, kept until 26.10.0.
       is_oidc: !!user.isOidc,
       // Any second factor; the name is what 2.8 clients read.
       totp_enabled: await createCurrentUserAuthRepository().hasSecondFactor(
diff --git a/src/backend/database/routes/host-terminal-fields.ts b/src/backend/database/routes/host-terminal-fields.ts
index 97d71eb36..e65330ca4 100644
--- a/src/backend/database/routes/host-terminal-fields.ts
+++ b/src/backend/database/routes/host-terminal-fields.ts
@@ -30,7 +30,7 @@ export function parseTerminalConfig(
  * terminal_config is merged into what is stored rather than replaced. The
  * 2.8 keys the editor no longer sends (the terminal's look, which the
  * ssh-terminal plugin copies into its host settings, and a sudo password 2.8
- * editors kept there) stay until 3.0.0 drops the column. A shared editor
+ * editors kept there) stay until 26.10.0 drops the column. A shared editor
  * never changes the owner's private keys in either JSON. Returns an error
  * for a terminalConfig that cannot be read.
  */
diff --git a/src/backend/database/routes/user-external-account-routes.ts b/src/backend/database/routes/user-external-account-routes.ts
index 40e6c17f8..08da6beb7 100644
--- a/src/backend/database/routes/user-external-account-routes.ts
+++ b/src/backend/database/routes/user-external-account-routes.ts
@@ -279,7 +279,7 @@ export function registerUserExternalAccountRoutes(
 
   router.post("/link-external-to-password", authenticateJWT, link);
   router.post("/unlink-external-from-password", authenticateJWT, unlink);
-  // 2.8 paths, kept until 3.0.0.
+  // 2.8 paths, kept until 26.10.0.
   router.post("/link-oidc-to-password", authenticateJWT, link);
   router.post("/unlink-oidc-from-password", authenticateJWT, unlink);
 }
diff --git a/src/backend/database/routes/users.ts b/src/backend/database/routes/users.ts
index 939a0add9..415fa6820 100644
--- a/src/backend/database/routes/users.ts
+++ b/src/backend/database/routes/users.ts
@@ -613,7 +613,7 @@ router.get("/me", authenticateJWT, async (req: Request, res: Response) => {
       username: user.username,
       is_admin: !!user.isAdmin,
       is_external: isExternalAccount(user),
-      // 2.8 name, kept until 3.0.0.
+      // 2.8 name, kept until 26.10.0.
       is_oidc: !!user.isOidc,
       is_dual_auth: isDualAuth,
       // Any second factor; the name is what 2.8 clients read.
@@ -1022,7 +1022,7 @@ router.patch(
   authenticateJWT,
   setExternalAutoProvision,
 );
-// 2.8 paths, kept until 3.0.0.
+// 2.8 paths, kept until 26.10.0.
 router.get("/oidc-auto-provision", getExternalAutoProvision);
 router.patch("/oidc-auto-provision", authenticateJWT, setExternalAutoProvision);
 
diff --git a/src/backend/sync/entities.ts b/src/backend/sync/entities.ts
index acf5e1a54..650a43cce 100644
--- a/src/backend/sync/entities.ts
+++ b/src/backend/sync/entities.ts
@@ -66,7 +66,7 @@ const HOST_LOCAL_FIELDS = [
 ];
 
 /**
- * Columns kept until 3.0.0 that nothing reads any more: their values moved
+ * Columns kept until 26.10.0 that nothing reads any more: their values moved
  * into plugin host settings, which sync with the host's pluginSettings. They
  * stay off the wire so a stale local id never reaches the other side.
  */
diff --git a/src/backend/tests/plugins/manifest.test.ts b/src/backend/tests/plugins/manifest.test.ts
index 2f295b82a..6c58f7f5f 100644
--- a/src/backend/tests/plugins/manifest.test.ts
+++ b/src/backend/tests/plugins/manifest.test.ts
@@ -119,8 +119,8 @@ describe("manifest v2 validation", () => {
   it("checks engine.termix against the core version", () => {
     expect(isTermixCompatible(">=2.9.0", "2.9.0")).toBe(true);
     expect(isTermixCompatible(">=2.9.0", "2.9.0-beta.3")).toBe(true);
-    expect(isTermixCompatible(">=3.0.0", "2.9.1")).toBe(false);
-    expect(isTermixCompatible(">=3.0.0", null)).toBe(true);
+    expect(isTermixCompatible(">=26.10.0", "2.9.1")).toBe(false);
+    expect(isTermixCompatible(">=26.10.0", null)).toBe(true);
   });
 
   it("fills in the entry point defaults", () => {
diff --git a/src/backend/tests/updates/desktop-update-check.test.ts b/src/backend/tests/updates/desktop-update-check.test.ts
index 517cb3419..c531c1b2b 100644
--- a/src/backend/tests/updates/desktop-update-check.test.ts
+++ b/src/backend/tests/updates/desktop-update-check.test.ts
@@ -53,7 +53,7 @@ describe("desktop update check", () => {
   it("stays quiet when up to date, ahead, or turned off", async () => {
     version.value = "2.9.1";
     await checkForDesktopUpdate();
-    version.value = "3.0.0";
+    version.value = "26.10.0";
     await checkForDesktopUpdate();
     version.value = "2.9.0";
     disabled.value = true;
diff --git a/src/backend/upgrade/host-defaults-migration.ts b/src/backend/upgrade/host-defaults-migration.ts
index 645b6d2da..ed38a57b4 100644
--- a/src/backend/upgrade/host-defaults-migration.ts
+++ b/src/backend/upgrade/host-defaults-migration.ts
@@ -21,7 +21,7 @@
  * The classify pass that follows compares those against the new levels, so
  * nothing a user sees changes.
  *
- * The old rows stay in place for a downgrade until 3.0.0.
+ * The old rows stay in place for a downgrade until 26.10.0.
  */
 
 import type { PluginManifest } from "@termix/plugin-sdk/manifest";
diff --git a/src/backend/upgrade/notification-channel-migration.ts b/src/backend/upgrade/notification-channel-migration.ts
index 8ee605234..42b3862f2 100644
--- a/src/backend/upgrade/notification-channel-migration.ts
+++ b/src/backend/upgrade/notification-channel-migration.ts
@@ -12,7 +12,7 @@
  * login for a 2.8 key only the password unwraps. Until then the channel shows
  * as needing to be saved again.
  *
- * The old table stays until 3.0.0, like the old columns. Idempotent.
+ * The old table stays until 26.10.0, like the old columns. Idempotent.
  */
 
 import { sql } from "drizzle-orm";
diff --git a/src/backend/upgrade/protocol-auth-migration.ts b/src/backend/upgrade/protocol-auth-migration.ts
index bad66b03e..19e27d75b 100644
--- a/src/backend/upgrade/protocol-auth-migration.ts
+++ b/src/backend/upgrade/protocol-auth-migration.ts
@@ -3,7 +3,7 @@
  * columns into host_protocol_auth, re-encrypted with the owner's data key
  * under the new table's context.
  *
- * The columns stay in the database, unused, until 3.0.0. A user's hosts are
+ * The columns stay in the database, unused, until 26.10.0. A user's hosts are
  * copied once their data key opens (at boot for a system-wrapped key, at the
  * next password login for a 2.8 key that only the password opens), and a
  * per-user marker then stops a later boot from bringing back a login the
diff --git a/src/backend/upgrade/snippets-settings-migration.ts b/src/backend/upgrade/snippets-settings-migration.ts
index 9de681745..c9a694a4f 100644
--- a/src/backend/upgrade/snippets-settings-migration.ts
+++ b/src/backend/upgrade/snippets-settings-migration.ts
@@ -6,7 +6,7 @@
  * user_preferences.confirm_snippet_execution and folders_collapsed become the
  * confirmExecution and foldersCollapsed user settings.
  *
- * The columns keep their values until 3.0.0 drops them.
+ * The columns keep their values until 26.10.0 drops them.
  *
  * Idempotent: a host that already has either host setting, and a user key
  * already set, are skipped, so this is safe on every boot.
diff --git a/src/backend/upgrade/ssh-terminal-look-migration.ts b/src/backend/upgrade/ssh-terminal-look-migration.ts
index 7b3ff1651..2a5b34701 100644
--- a/src/backend/upgrade/ssh-terminal-look-migration.ts
+++ b/src/backend/upgrade/ssh-terminal-look-migration.ts
@@ -15,7 +15,7 @@
  * Per user, user_preferences.terminal_defaults, custom_themes and
  * command_autocomplete become user settings.
  *
- * The columns keep their values until 3.0.0 drops them.
+ * The columns keep their values until 26.10.0 drops them.
  *
  * Idempotent: a host that already has any of these rows, and a user key that
  * is already set, are skipped, so this is safe on every boot.
diff --git a/src/backend/upgrade/ssh-terminal-macros-migration.ts b/src/backend/upgrade/ssh-terminal-macros-migration.ts
index 4f59b1ca7..933e7d1e3 100644
--- a/src/backend/upgrade/ssh-terminal-macros-migration.ts
+++ b/src/backend/upgrade/ssh-terminal-macros-migration.ts
@@ -3,7 +3,7 @@
  * macros user setting. Macros a browser kept on its own (storage mode
  * "local") are moved by the plugin's frontend the first time the panel opens.
  *
- * The column keeps its value until 3.0.0 drops it.
+ * The column keeps its value until 26.10.0 drops it.
  *
  * Idempotent: a user whose macros setting is already set is skipped.
  */
diff --git a/src/backend/upgrade/telemetry-settings-migration.ts b/src/backend/upgrade/telemetry-settings-migration.ts
index 833791680..c35c02459 100644
--- a/src/backend/upgrade/telemetry-settings-migration.ts
+++ b/src/backend/upgrade/telemetry-settings-migration.ts
@@ -5,7 +5,7 @@
  * instance keeps reporting under the same id.
  *
  * Idempotent: nothing is written where the plugin already has a row. The
- * legacy settings rows stay in place until 3.0.0. The plugin waits a few
+ * legacy settings rows stay in place until 26.10.0. The plugin waits a few
  * minutes before its first send, so this lands first.
  */
 
diff --git a/src/backend/upgrade/totp-migration.ts b/src/backend/upgrade/totp-migration.ts
index 6251149fb..f23c62458 100644
--- a/src/backend/upgrade/totp-migration.ts
+++ b/src/backend/upgrade/totp-migration.ts
@@ -11,7 +11,7 @@
  *    there sealed with the installation key (what ctx.secrets.seal writes),
  *    then the users columns are cleared.
  *
- * The columns stay in the database until 3.0.0, since core's drizzle
+ * The columns stay in the database until 26.10.0, since core's drizzle
  * migrations run before this does. A user whose data key cannot be opened
  * at boot is skipped and tried again on the next one. Idempotent.
  */