diff --git a/src/main/java/org/cryptomator/common/settings/Settings.java b/src/main/java/org/cryptomator/common/settings/Settings.java
index 45b6bc032..90aedeeda 100644
--- a/src/main/java/org/cryptomator/common/settings/Settings.java
+++ b/src/main/java/org/cryptomator/common/settings/Settings.java
@@ -77,6 +77,7 @@ public class Settings {
 	public final ObjectProperty<Instant> lastUpdateCheckReminder;
 	public final ObjectProperty<Instant> lastSuccessfulUpdateCheck;
 	public final ObjectProperty<Path> previouslyUsedVaultDirectory;
+	public final StringProperty lastUpdateAttemptedByVersion;
 
 	public static Settings create(SettingsProvider provider, Environment env) {
 		var defaults = new SettingsJson();
@@ -116,6 +117,7 @@ public class Settings {
 		this.lastUpdateCheckReminder = new SimpleObjectProperty<>(this, "lastUpdateCheckReminder", json.lastReminderForUpdateCheck);
 		this.lastSuccessfulUpdateCheck = new SimpleObjectProperty<>(this, "lastSuccessfulUpdateCheck", json.lastSuccessfulUpdateCheck);
 		this.previouslyUsedVaultDirectory = new SimpleObjectProperty<>(this, "previouslyUsedVaultDirectory", json.previouslyUsedVaultDirectory);
+		this.lastUpdateAttemptedByVersion = new SimpleStringProperty(this, "lastUpdateAttemptedByVersion", json.lastUpdateAttemptedByVersion);
 
 		this.directories.addAll(json.directories.stream().map(VaultSettings::new).toList());
 
@@ -146,6 +148,7 @@ public class Settings {
 		lastUpdateCheckReminder.addListener(this::somethingChanged);
 		lastSuccessfulUpdateCheck.addListener(this::somethingChanged);
 		previouslyUsedVaultDirectory.addListener(this::somethingChanged);
+		lastUpdateAttemptedByVersion.addListener(this::somethingChanged);
 	}
 
 	@SuppressWarnings("deprecation")
@@ -208,6 +211,7 @@ public class Settings {
 		json.lastReminderForUpdateCheck = lastUpdateCheckReminder.get();
 		json.lastSuccessfulUpdateCheck = lastSuccessfulUpdateCheck.get();
 		json.previouslyUsedVaultDirectory = previouslyUsedVaultDirectory.get();
+		json.lastUpdateAttemptedByVersion = lastUpdateAttemptedByVersion.get();
 		return json;
 	}
 
diff --git a/src/main/java/org/cryptomator/common/settings/SettingsJson.java b/src/main/java/org/cryptomator/common/settings/SettingsJson.java
index feb8a0bf2..e0cdb7b5e 100644
--- a/src/main/java/org/cryptomator/common/settings/SettingsJson.java
+++ b/src/main/java/org/cryptomator/common/settings/SettingsJson.java
@@ -96,4 +96,7 @@ class SettingsJson {
 
 	@JsonProperty("previouslyUsedVaultDirectory")
 	Path previouslyUsedVaultDirectory;
+
+	@JsonProperty("lastUpdateAttemptedByVersion")
+	String lastUpdateAttemptedByVersion;
 }
diff --git a/src/main/java/org/cryptomator/ui/fxapp/UpdateChecker.java b/src/main/java/org/cryptomator/ui/fxapp/UpdateChecker.java
index b759e9df8..174e67050 100644
--- a/src/main/java/org/cryptomator/ui/fxapp/UpdateChecker.java
+++ b/src/main/java/org/cryptomator/ui/fxapp/UpdateChecker.java
@@ -57,9 +57,17 @@ public class UpdateChecker extends ScheduledService<UpdateInfo<?>> {
 		this.settings = settings;
 		this.lastSuccessfulUpdateCheck = settings.lastSuccessfulUpdateCheck;
 		this.httpClient = httpClient;
-		this.primaryUpdateMechanism = UpdateMechanism.get().orElse(fallbackUpdateMechanism);
 		this.fallbackUpdateMechanism = fallbackUpdateMechanism;
 
+		// Prefer the safer fallback mechanism if the last update attempt was already made by this app version
+		var currentVersion = env.getAppVersionWithBuildNumber();
+		var lastAttemptedBy = settings.lastUpdateAttemptedByVersion.get();
+		if (currentVersion != null && currentVersion.equals(lastAttemptedBy)) {
+			this.primaryUpdateMechanism = fallbackUpdateMechanism; // immediately use fallback mechanism
+		} else {
+			this.primaryUpdateMechanism = UpdateMechanism.get().orElse(fallbackUpdateMechanism);
+		}
+
 		setExecutor(Executors.newVirtualThreadPerTaskExecutor());
 		periodProperty().bind(Bindings.when(settings.checkForUpdates).then(UPDATE_CHECK_INTERVAL).otherwise(DISABLED_UPDATE_CHECK_INTERVAL));
 	}
diff --git a/src/main/java/org/cryptomator/ui/preferences/UpdatesPreferencesController.java b/src/main/java/org/cryptomator/ui/preferences/UpdatesPreferencesController.java
index 11ad41e7b..4684e2624 100644
--- a/src/main/java/org/cryptomator/ui/preferences/UpdatesPreferencesController.java
+++ b/src/main/java/org/cryptomator/ui/preferences/UpdatesPreferencesController.java
@@ -5,7 +5,6 @@ import org.cryptomator.common.settings.Settings;
 import org.cryptomator.integrations.update.UpdateStep;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.fxapp.UpdateChecker;
-import org.cryptomator.updater.FallbackUpdateMechanism;
 import org.cryptomator.updater.UpdateService;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -99,6 +98,7 @@ public class UpdatesPreferencesController implements FxController {
 		if (worker.get().equals(updateChecker)) {
 			updateChecker.checkForUpdatesNow();
 		} else if (worker.get().equals(updateService)) {
+			// TODO: only allow starting if all vaults are locked; show info label beneath button otherwise
 			updateService.start();
 		}
 	}
@@ -107,6 +107,9 @@ public class UpdatesPreferencesController implements FxController {
 		assert workerStateEvent.getSource() == updateService;
 		var lastStep = updateService.getValue();
 		if (lastStep == UpdateStep.EXIT) {
+			// Record that this version attempted an update, so next launch can choose fallback if needed
+			settings.lastUpdateAttemptedByVersion.set(environment.getAppVersionWithBuildNumber());
+			settings.saveNow();
 			LOG.info("Exiting app to update...");
 			Platform.exit();
 		} else if (lastStep == UpdateStep.RETRY) {