diff --git a/.github/workflows/d2e-demosetup-release.yml b/.github/workflows/d2e-demosetup-release.yml
index 595e163d4b..cff62731b5 100644
--- a/.github/workflows/d2e-demosetup-release.yml
+++ b/.github/workflows/d2e-demosetup-release.yml
@@ -6,13 +6,13 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        default: "0.17.0-beta"
+        default: "0.18.0-beta"
         description: Enter version to use
         required: true
         type: string
 
 env:
-  DEFAULT_VERSION: "0.17.0-beta"
+  DEFAULT_VERSION: "0.18.0-beta"
 
 jobs:
   demosetup:
diff --git a/docs/website/docs/2-admin_guide/5-setup/0-system-setup/cli.md b/docs/website/docs/2-admin_guide/5-setup/0-system-setup/cli.md
index 40c59cc550..dce7357b56 100644
--- a/docs/website/docs/2-admin_guide/5-setup/0-system-setup/cli.md
+++ b/docs/website/docs/2-admin_guide/5-setup/0-system-setup/cli.md
@@ -94,7 +94,7 @@ Download the updated binary for your operating system and architecture using the
 In the d2e directory, open the `.env` file and make these changes:
 - Set `DOCKER_TAG_NAME` to the docker image tag for the new version.
   - Example: For version `0.12.0`, set `DOCKER_TAG_NAME=0.12.0-beta`. The format is `DOCKER_TAG_NAME=<version>-beta`.
-- Add `PLUGINS_SEED_UPDATE=true` to trigger a plugin upgrade on the next startup.
+- Additional step for upgrades from versions earlier than v0.18: add `PLUGINS_SEED_UPDATE=true` to trigger a plugin upgrade on the next startup.
 
 - Verify the new version is active:
 
diff --git a/package.json b/package.json
index 73bb633406..5eada6086e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@ohdsi/d2e",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Data2Evidence Installer",
   "license": "Apache-2.0",
   "homepage": "https://d2e.sg",
diff --git a/scripts/cli.ts b/scripts/cli.ts
index c24e018196..06cd871c9a 100644
--- a/scripts/cli.ts
+++ b/scripts/cli.ts
@@ -40,8 +40,8 @@ interface CliOptions {
 
 class D2ECli {
   version: string;
-  LATEST_DOCKER_TAG_NAME: string = "0.17.0-beta"; // Update this as needed
-  default_version: string = "0.17.0"; // Update this as needed default/base version
+  LATEST_DOCKER_TAG_NAME: string = "0.18.2-beta"; // Update this as needed
+  default_version: string = "0.18.0"; // Update this as needed default/base version
   CADDY__CONFIG: string;
   ENV_TYPE: string;
   DOCKER_LOG_LEVEL: string;
@@ -87,26 +87,10 @@ class D2ECli {
     // `./services/atlas-db-init:/usr/src/atlas-db-init` bind mount resolves.
     // These live at repo root but aren't present where the distributed CLI
     // runs, so we write the embedded copies here.
-    const atlasDbInitDir = path.join(
-      this.compose_dir,
-      "services",
-      "atlas-db-init"
+    this.stage_sql_dir(
+      path.join(this.compose_dir, "services", "atlas-db-init"),
+      atlasDbInitScripts
     );
-    try {
-      fs.mkdirSync(atlasDbInitDir, { recursive: true });
-    } catch (err: any) {
-      if (err?.code === "EACCES" || err?.code === "EPERM") {
-        console.warn(
-          `Warning: could not create ${atlasDbInitDir} (permission denied). ` +
-            `Skipping atlas-db-init staging; continuing with existing files.`
-        );
-        return;
-      }
-      throw err;
-    }
-    for (const [name, content] of Object.entries(atlasDbInitScripts)) {
-      this.write_embedded_file(path.join(atlasDbInitDir, name), content);
-    }
     this.stage_embedded_tree(
       path.join(this.compose_dir, "services", "trex", "migrations", "notebook"),
       notebookSchemaFiles
@@ -136,6 +120,48 @@ class D2ECli {
       this.write_embedded_file(dest, content);
     }
   }
+
+  // Drop the .sql files this CLI no longer ships before writing the current
+  // set. The bind mount hands trex the whole directory rather than a manifest,
+  // so a script a previous CLI version staged would still be applied after an
+  // upgrade -- and one that no longer applies fails the seeding.
+  //
+  // Only individual .sql files are removed, never the directory: compose_dir is
+  // the repo root when the CLI runs from a checkout (and is the user's cwd
+  // entirely under the Bun build), where services/atlas-db-init holds the real
+  // git-tracked service sources. The prune is skipped in a checkout for the
+  // same reason -- there the embedded set is regenerated by `npm run build:ts`,
+  // which `npm start` does not run, so a script added but not yet re-embedded
+  // would look stale and be deleted.
+  private stage_sql_dir(dir: string, scripts: Record<string, string>): void {
+    const from_checkout = fs.existsSync(path.join(this.compose_dir, ".git"));
+    try {
+      fs.mkdirSync(dir, { recursive: true });
+      if (!from_checkout) {
+        for (const f of fs.readdirSync(dir)) {
+          if (
+            f.endsWith(".sql") &&
+            !Object.prototype.hasOwnProperty.call(scripts, f)
+          ) {
+            fs.rmSync(path.join(dir, f));
+          }
+        }
+      }
+    } catch (err: any) {
+      if (err?.code === "EACCES" || err?.code === "EPERM") {
+        console.warn(
+          `Warning: could not stage ${dir} (permission denied). ` +
+            `It looks owned by another user (e.g. root from a release download). ` +
+            `Continuing with the existing files.`
+        );
+        return;
+      }
+      throw err;
+    }
+    for (const [name, content] of Object.entries(scripts)) {
+      this.write_embedded_file(path.join(dir, name), content);
+    }
+  }
   private write_embedded_file(dest: string, content: string): void {
     try {
       if (fs.existsSync(dest) && fs.readFileSync(dest, "utf8") === content) {