diff --git a/fluxer-bin/.SRCINFO b/fluxer-bin/.SRCINFO
index 1ae5579..d18be0c 100644
--- a/fluxer-bin/.SRCINFO
+++ b/fluxer-bin/.SRCINFO
@@ -1,7 +1,7 @@
 pkgbase = fluxer-bin
 	pkgdesc = Fluxer Desktop Application
-	pkgver = 0.0.8
-	pkgrel = 2
+	pkgver = 2026.920.41303
+	pkgrel = 1
 	url = https://fluxer.app
 	arch = x86_64
 	arch = aarch64
@@ -14,9 +14,9 @@ pkgbase = fluxer-bin
 	options = !strip
 	source = fluxer.desktop
 	sha256sums = 981daa8015b823fef254bb8e79fe6b28f77dda02cdc374796443bd64f5041de1
-	source_x86_64 = fluxer-0.0.8-x64.tar.gz::https://api.fluxer.app/dl/desktop/stable/linux/x64/0.0.8/tar_gz
-	sha256sums_x86_64 = acf6398fa6810720fed85b06c011b324e7db4fec6bf2fc7ad93c2446c3600f2d
-	source_aarch64 = fluxer-0.0.8-arm64.tar.gz::https://api.fluxer.app/dl/desktop/stable/linux/arm64/0.0.8/tar_gz
-	sha256sums_aarch64 = 77b874a98caf48de5bc4ccf03119f45262fe26fd7be085b57d7b40b1505d0ec8
+	source_x86_64 = fluxer-2026.920.41303-x64.tar.gz::https://api.fluxer.app/dl/desktop/stable/linux/x64/2026.920.41303/tar_gz
+	sha256sums_x86_64 = e56b839eed12e0fdaccbd02bf8c5bfd92308929c43eb08d9e270c5ed8122aa08
+	source_aarch64 = fluxer-2026.920.41303-arm64.tar.gz::https://api.fluxer.app/dl/desktop/stable/linux/arm64/2026.920.41303/tar_gz
+	sha256sums_aarch64 = fac0f1e76063377a4111a653c690528820c9fb6ea1694ae334321c7d35cd6d7e
 
 pkgname = fluxer-bin
diff --git a/fluxer-bin/PKGBUILD b/fluxer-bin/PKGBUILD
index 56b8a18..fac40f0 100644
--- a/fluxer-bin/PKGBUILD
+++ b/fluxer-bin/PKGBUILD
@@ -4,14 +4,17 @@
 # https://github.com/Felitendo/PKGBUILDS
 
 pkgname=fluxer-bin
-pkgver=0.0.8
-pkgrel=2
+# Upstream versions are date-based: this is the build of 2026-09-20 at
+# 04:13:03 UTC. They sort above the 0.0.x scheme the package used before.
+pkgver=2026.920.41303
+pkgrel=1
 pkgdesc="Fluxer Desktop Application"
 arch=('x86_64' 'aarch64')
 url="https://fluxer.app"
 license=('AGPL-3.0-only')
 depends=('gtk3' 'nss' 'alsa-lib')
-# the AUR also carries fluxer-git, which installs the same /usr/bin/fluxer:
+# /usr/bin/fluxer is also installed by fluxer-git on the AUR and by the
+# "fluxer" package in upstream's own pacman repository:
 # provides/conflicts makes that an either/or instead of a file conflict
 provides=('fluxer')
 conflicts=('fluxer')
@@ -21,16 +24,16 @@ source=("fluxer.desktop")
 sha256sums=('981daa8015b823fef254bb8e79fe6b28f77dda02cdc374796443bd64f5041de1')
 
 source_x86_64=("fluxer-${pkgver}-x64.tar.gz::https://api.fluxer.app/dl/desktop/stable/linux/x64/${pkgver}/tar_gz")
-sha256sums_x86_64=('acf6398fa6810720fed85b06c011b324e7db4fec6bf2fc7ad93c2446c3600f2d')
+sha256sums_x86_64=('e56b839eed12e0fdaccbd02bf8c5bfd92308929c43eb08d9e270c5ed8122aa08')
 
 source_aarch64=("fluxer-${pkgver}-arm64.tar.gz::https://api.fluxer.app/dl/desktop/stable/linux/arm64/${pkgver}/tar_gz")
-sha256sums_aarch64=('77b874a98caf48de5bc4ccf03119f45262fe26fd7be085b57d7b40b1505d0ec8')
+sha256sums_aarch64=('fac0f1e76063377a4111a653c690528820c9fb6ea1694ae334321c7d35cd6d7e')
 
 package() {
     local _dir
     case "$CARCH" in
-        x86_64)  _dir="fluxer-stable-${pkgver}-x64" ;;
-        aarch64) _dir="fluxer-stable-${pkgver}-arm64" ;;
+        x86_64)  _dir="Fluxer-${pkgver}-linux-x64" ;;
+        aarch64) _dir="Fluxer-${pkgver}-linux-arm64" ;;
     esac
     # upstream has changed the archive layout before - fall back to a glob
     if [ ! -d "$srcdir/$_dir" ]; then
@@ -51,8 +54,22 @@ package() {
 
     install -Dm644 "$srcdir/fluxer.desktop" "$pkgdir/usr/share/applications/fluxer.desktop"
 
-    if [ -f "$pkgdir/opt/$pkgname/resources/512x512.png" ]; then
-        install -Dm644 "$pkgdir/opt/$pkgname/resources/512x512.png" \
-            "$pkgdir/usr/share/icons/hicolor/512x512/apps/fluxer.png"
+    # The bundle carries a full icon set, named after the size it holds.
+    # The glob takes those and leaves icon.png and the tray templates, which
+    # carry no size, alone.
+    local _icon _size _found=0
+    for _icon in "$srcdir/$_dir"/resources/icons/[0-9]*x[0-9]*.png; do
+        [ -f "$_icon" ] || continue
+        _size="$(basename "$_icon" .png)"
+        install -Dm644 "$_icon" \
+            "$pkgdir/usr/share/icons/hicolor/$_size/apps/fluxer.png"
+        _found=1
+    done
+    # the .desktop entry points at this icon, so a silent miss would ship a
+    # window with no icon at all
+    if [ "$_found" -eq 0 ]; then
+        echo "Error: no icons in $_dir/resources/icons" >&2
+        ls -la "$srcdir/$_dir/resources" >&2
+        return 1
     fi
 }
diff --git a/fluxer-bin/pkg.sh b/fluxer-bin/pkg.sh
index 54c5695..c5f8553 100644
--- a/fluxer-bin/pkg.sh
+++ b/fluxer-bin/pkg.sh
@@ -4,47 +4,65 @@
 # build_artifact() here: on a new version only pkgver and the checksums
 # are refreshed and the result is pushed to the AUR.
 #
+# Versions are date-based: 2026.920.41303 is the build published at
+# 2026-09-20 04:13:03 UTC, the last field being the time of day without
+# leading zeros. vercmp orders those correctly both within a day and across
+# days, and every one of them outranks the 0.0.x versions this package
+# carried until upstream changed schemes.
+#
 # The download API has one URL shape per channel, and this package follows
-# "stable". Its /latest currently 302s into the canary channel - upstream has
-# published nothing to stable since 0.0.8, and the pointer falls through to
-# the channel that is moving. A canary build is a nightly, not what a package
-# called fluxer-bin ships, so latest_version() recognises the fall-through
-# and reports EX_TEMPFAIL instead of a version; see below.
+# "stable". Every build publishes a JSON manifest and a .sha256 next to its
+# artifacts, so neither the version check nor the checksum refresh has to
+# pull the ~130 MB tarballs to look at them.
+#
+# Upstream keeps only its last few builds per channel - everything under the
+# old scheme is already gone, which is how a pinned 0.0.8 turned into a 404
+# for anyone installing from the AUR. The version named here stays fetchable
+# only while this repository keeps pace with the channel.
 
 DL_BASE="https://api.fluxer.app/dl/desktop/stable/linux"
 
 latest_version() {
-  local name ver
+  local json ver url
 
-  # the download API exposes the current version in the attachment filename,
-  # e.g. content-disposition: attachment; filename="fluxer-stable-0.0.8-x64.tar.gz"
-  #
-  # -L, and the last filename of the chain: when the stable channel has no
-  # current build the request is redirected to another channel, and the
-  # filename it answers with is how that becomes visible here.
-  name="$(curl -sfIL "$DL_BASE/x64/latest/tar_gz" \
-    | grep -oiP 'filename="\K[^"]+' | tail -n1)"
+  # the channel's manifest for whatever it currently considers current
+  json="$(curl -sfL "$DL_BASE/x64/latest")" || return 1
+  ver="$(jq -r '.version // empty' <<< "$json")"
+  url="$(jq -r '.files.tar_gz.url // empty' <<< "$json")"
 
-  ver="$(grep -oiP '^fluxer-(stable-)?\K[0-9][^"]*(?=-x64\.tar\.gz$)' <<< "$name" \
-    || true)"
-  if [[ -z "$ver" ]]; then
-    # e.g. Fluxer-Canary-2026.904.135113-linux-x64.tar.gz - the canary channel
-    echo "the stable channel's latest download is \"$name\", which is not a" \
-         "stable build - nothing to update to" >&2
+  # When stable has no current build the API falls through to another
+  # channel, and the artifact URL is where that becomes visible. A canary
+  # build is a nightly, not what a package called fluxer-bin ships, so that
+  # is EX_TEMPFAIL rather than a version - see scripts/update-package.sh.
+  # The version is shape-checked along with it: pkgver takes no hyphens, and
+  # a channel name in there would be one.
+  if [[ -z "$ver" || "$url" != */desktop/stable/linux/* || ! "$ver" =~ ^[0-9][0-9.]*$ ]]; then
+    echo "the stable channel's current download is \"${url:-<none>}\" at" \
+         "version \"${ver:-<none>}\", which is not a stable build -" \
+         "nothing to update to" >&2
     return 75
   fi
 
   printf '%s\n' "$ver"
 }
 
+# _artifact_sha <arch> <version> - upstream's own checksum for that tarball,
+# published as a sha256sum-format sidecar next to the download itself
+_artifact_sha() {
+  local sha
+  sha="$(curl -sfL "$DL_BASE/$1/$2/tar_gz.sha256" | grep -ioEm1 '^[0-9a-f]{64}')"
+  [[ -n "$sha" ]] || { echo "upstream publishes no checksum for $1 $2" >&2; return 1; }
+  printf '%s\n' "$sha"
+}
+
 # refresh_checksums <version> <pkgbuild-path>
 refresh_checksums() {
   local ver="$1" pkgbuild="$2"
   local sha_desktop sha_x64 sha_arm64
 
   sha_desktop="$(sha256sum "$(dirname "$pkgbuild")/fluxer.desktop" | cut -d' ' -f1)"
-  sha_x64="$(curl -sfL "$DL_BASE/x64/$ver/tar_gz" | sha256sum | cut -d' ' -f1)"
-  sha_arm64="$(curl -sfL "$DL_BASE/arm64/$ver/tar_gz" | sha256sum | cut -d' ' -f1)"
+  sha_x64="$(_artifact_sha x64 "$ver")" || return 1
+  sha_arm64="$(_artifact_sha arm64 "$ver")" || return 1
 
   sed -i \
     -e "s|^sha256sums=.*|sha256sums=('$sha_desktop')|" \
diff --git a/scripts/update-package.sh b/scripts/update-package.sh
index c455329..6ee7085 100644
--- a/scripts/update-package.sh
+++ b/scripts/update-package.sh
@@ -46,8 +46,8 @@ oldrel="$(grep -Po '^pkgrel=\K.*' "$pkg/PKGBUILD")"
 # It carries on with the version the PKGBUILD already has instead of stopping:
 # everything below is about the packaging, not the version, and a package
 # cannot be fixed at all if a stalled upstream channel also blocks the AUR
-# sync - which is exactly what happened to fluxer-bin, whose stable channel
-# has been serving canary builds since 0.0.8.
+# sync - which is exactly what happened to fluxer-bin during the stretch when
+# its stable channel served canary builds instead of releases.
 rc=0
 ver="$(latest_version)" || rc=$?
 if [[ "$rc" -eq 75 ]]; then