diff --git a/.git_archival.txt b/.git_archival.txt
new file mode 100644
index 0000000000..95cb3eea4e
--- /dev/null
+++ b/.git_archival.txt
@@ -0,0 +1 @@
+ref-names: $Format:%D$
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000000..a94cb2f8c2
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+.git_archival.txt export-subst
diff --git a/.github/workflows/patch-release.yaml b/.github/workflows/patch-release.yaml
index a418500c10..d06a5087b3 100644
--- a/.github/workflows/patch-release.yaml
+++ b/.github/workflows/patch-release.yaml
@@ -84,22 +84,28 @@ jobs:
               continue
             fi
 
-            # Find the latest tag on this branch
-            last_tag=$(git describe --tags --abbrev=0 --match 'v*' "$ref" 2>/dev/null || echo "")
-            if [ -z "$last_tag" ]; then
-              echo "::notice::Branch ${branch} has no tags — skipping (initial release handled by branch creation)"
+            # Latest release tag contained in this branch.
+            last_tag=$(git describe --tags --abbrev=0 --match "v${major}.${minor}.*" "$ref" 2>/dev/null || echo "")
+            if [[ ! "$last_tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              echo "::notice::Branch ${branch} has no release tag — skipping"
               continue
             fi
 
-            # Count commits since last tag
             new_commits=$(git rev-list "${last_tag}..${ref}" --count)
             if [ "$new_commits" -eq 0 ]; then
               echo "::notice::Branch ${branch} has no new commits since ${last_tag}"
               continue
             fi
 
-            # Calculate next patch version: v0.44.0 → v0.44.1
-            next_version=$(echo "$last_tag" | awk -F. '{printf "%s.%s.%d", $1, $2, $3+1}')
+            # Next patch is one above the highest vX.Y.Z tag for this line.
+            # Tags that were pushed but never merged are invisible to describe,
+            # so v0.45.2 still advances to v0.45.3.
+            highest_tag=$(git tag -l "v${major}.${minor}.*" --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -1)
+            release_tag="$last_tag"
+            if [[ "$highest_tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              release_tag=$(printf '%s\n%s\n' "$last_tag" "$highest_tag" | sort -V | tail -1)
+            fi
+            next_version=$(echo "$release_tag" | awk -F. '{printf "%s.%s.%d", $1, $2, $3+1}')
 
             # Read tool versions from the branch
             go_version=$(git show "${ref}:go.mod" | grep "^go " | awk '{ print $2 }')
@@ -143,16 +149,11 @@ jobs:
         env:
           RELEASE_VERSION: ${{ matrix.release.version }}
         run: |
-          # Write version to VERSION file (goreleaser reads from git tag,
-          # but the Makefile uses this file)
-          echo "${RELEASE_VERSION#v}" > VERSION
           git config user.name "tekton-robot"
           git config user.email "tekton-robot@tektoncd.com"
-          git add VERSION
-          git commit -sm "New version ${RELEASE_VERSION}" || echo "No VERSION changes"
           git tag -a "${RELEASE_VERSION}" -m "Release ${RELEASE_VERSION}"
           git push origin "${RELEASE_VERSION}"
-          git push origin "HEAD:${{ matrix.release.branch }}"
+          git push origin "HEAD:release-${RELEASE_VERSION}"
 
       - name: Trigger PAC incoming webhook
         env:
@@ -218,18 +219,13 @@ jobs:
 
       - name: Create and push version tag
         env:
-          INPUT_VERSION: ${{ inputs.version }}
-          INPUT_BRANCH: ${{ inputs.branch }}
+          RELEASE_VERSION: ${{ inputs.version }}
         run: |
-          # Write version to VERSION file
-          echo "${INPUT_VERSION#v}" > VERSION
           git config user.name "tekton-robot"
           git config user.email "tekton-robot@tektoncd.com"
-          git add VERSION
-          git commit -sm "New version ${INPUT_VERSION}" || echo "No VERSION changes"
-          git tag -a "${INPUT_VERSION}" -m "Release ${INPUT_VERSION}"
-          git push origin "${INPUT_VERSION}"
-          git push origin "HEAD:${INPUT_BRANCH}"
+          git tag -a "${RELEASE_VERSION}" -m "Release ${RELEASE_VERSION}"
+          git push origin "${RELEASE_VERSION}"
+          git push origin "HEAD:release-${RELEASE_VERSION}"
 
       - name: Trigger PAC incoming webhook
         env:
diff --git a/Makefile b/Makefile
index 31d7044d5b..0aeb28eb29 100644
--- a/Makefile
+++ b/Makefile
@@ -25,8 +25,26 @@ ifneq ($(SKIP_CHECK_FLAG),)
 	SKIPLDFLAG := -X github.com/tektoncd/cli/pkg/cmd/version.skipCheckFlag=$(SKIP_CHECK_FLAG)
 endif
 
-ifneq (,$(wildcard ./VERSION))
-	VERSIONLDFLAG := -X github.com/tektoncd/cli/pkg/cmd/version.clientVersion=`cat VERSION`
+# clientVersion is injected with -X. Prefer the git tag (exact tag on HEAD,
+# or the latest vX.Y.* tag on release-vX.Y.x), falling back to .git_archival.txt
+# (for release source archives), then VERSION file. RELEASE_VERSION overrides all.
+GIT_VERSION := $(shell tag=$$(git describe --tags --exact-match --match 'v[0-9]*.[0-9]*.[0-9]*' 2>/dev/null); \
+	if [ -z "$$tag" ]; then \
+		line=$$(git rev-parse --abbrev-ref HEAD 2>/dev/null | sed -n 's/^release-v\([0-9][0-9]*\.[0-9][0-9]*\)\.x$$/\1/p'); \
+		if [ -n "$$line" ]; then tag=$$(git describe --tags --abbrev=0 --match "v$$line.*" HEAD 2>/dev/null); fi; \
+	fi; printf '%s' "$$tag" | sed 's/^v//')
+
+# Extract version from .git_archival.txt (populated by git-archive export-subst)
+ARCHIVE_VERSION := $(shell if [ -f .git_archival.txt ]; then \
+	sed -n 's/^ref-names:.*tag: v\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\).*/\1/p' .git_archival.txt | head -n1; \
+fi)
+
+ifneq ($(GIT_VERSION),)
+	VERSIONLDFLAG := -X github.com/tektoncd/cli/pkg/cmd/version.clientVersion=$(GIT_VERSION)
+else ifneq ($(ARCHIVE_VERSION),)
+	VERSIONLDFLAG := -X github.com/tektoncd/cli/pkg/cmd/version.clientVersion=$(ARCHIVE_VERSION)
+else ifneq (,$(wildcard ./VERSION))
+	VERSIONLDFLAG := -X github.com/tektoncd/cli/pkg/cmd/version.clientVersion=$(shell cat VERSION)
 endif
 
 ifneq ($(RELEASE_VERSION),)
diff --git a/tekton/release.sh b/tekton/release.sh
index ab0392eaf9..1ff33ec362 100755
--- a/tekton/release.sh
+++ b/tekton/release.sh
@@ -103,10 +103,6 @@ done
 
 echo "${changelog}"
 
-# Add our VERSION so Makefile will pick it up when compiling
-echo ${RELEASE_VERSION#v} > VERSION
-git add VERSION
-git commit -sm "New version ${RELEASE_VERSION}" -m "${changelog}" VERSION
 git tag --sign -m \
     "New version ${RELEASE_VERSION}" \
     -m "${changelog}" --force ${RELEASE_VERSION}