diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1a9b060..d0587d2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -6,6 +6,12 @@ on:
   pull_request:
   workflow_dispatch:
 
+# This workflow only builds and uploads an artifact; it makes no repository
+# writes. release.yml needs contents: write for `gh release create` — do not
+# copy this block there.
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -68,10 +74,19 @@ jobs:
           done
           exit $status
 
+      # Extracted per macro rather than with one alternation piped through
+      # `paste`, which silently assumed MAJOR/MINOR/PATCH appear in that order
+      # in the header. An empty component would build a nonsense version like
+      # "1..0", so each is asserted non-empty.
       - name: Verify the version resource matches app_strings.h
         run: |
-          src=$(grep -oP 'APP_VERSION_(MAJOR|MINOR|PATCH)\s+\K\d+' \
-                resources/app_strings.h | paste -sd.)
+          maj=$(grep -oP 'APP_VERSION_MAJOR\s+\K\d+' resources/app_strings.h)
+          min=$(grep -oP 'APP_VERSION_MINOR\s+\K\d+' resources/app_strings.h)
+          pat=$(grep -oP 'APP_VERSION_PATCH\s+\K\d+' resources/app_strings.h)
+          for c in "$maj" "$min" "$pat"; do
+            [ -n "$c" ] || { echo "::error::Could not read APP_VERSION_* from resources/app_strings.h"; exit 1; }
+          done
+          src="$maj.$min.$pat"
           echo "Source version: $src"
           strings -el Primary.exe | grep -qF "$src" || {
             echo "::error::Binary does not report source version $src"; exit 1; }
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4471e74..1b3fa00 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,8 +23,17 @@ jobs:
       - name: Verify the tag matches the source version
         run: |
           tag="${GITHUB_REF_NAME#v}"
-          src=$(grep -oP 'APP_VERSION_(MAJOR|MINOR|PATCH)\s+\K\d+' \
-                resources/app_strings.h | paste -sd.)
+          # Extracted per macro rather than with one alternation piped through
+          # `paste`, which silently assumed MAJOR/MINOR/PATCH appear in that
+          # order in the header. An empty component would build a nonsense
+          # version like "1..0", so each is asserted non-empty.
+          maj=$(grep -oP 'APP_VERSION_MAJOR\s+\K\d+' resources/app_strings.h)
+          min=$(grep -oP 'APP_VERSION_MINOR\s+\K\d+' resources/app_strings.h)
+          pat=$(grep -oP 'APP_VERSION_PATCH\s+\K\d+' resources/app_strings.h)
+          for c in "$maj" "$min" "$pat"; do
+            [ -n "$c" ] || { echo "::error::Could not read APP_VERSION_* from resources/app_strings.h"; exit 1; }
+          done
+          src="$maj.$min.$pat"
           echo "Tag: $tag / source: $src"
           if [ "$tag" != "$src" ]; then
             echo "::error::Tag $tag does not match source version $src. Bump APP_VERSION_* in resources/app_strings.h."
diff --git a/src/primary.cpp b/src/primary.cpp
index 190c010..057d629 100644
--- a/src/primary.cpp
+++ b/src/primary.cpp
@@ -517,7 +517,6 @@ INT_PTR CALLBACK OptionsDialogProc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM
                         // Start or stop monitoring based on setting
                         if (autoSwitchEnabled) {
                             StartAutoSwitchMonitoring(g_hwndMain);
-                            CheckAndApplyAutoSwitch();  // Apply immediately (will detect change and apply)
                         } else {
                             StopAutoSwitchMonitoring(g_hwndMain);
                         }
@@ -529,16 +528,15 @@ INT_PTR CALLBACK OptionsDialogProc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM
                                   L"Failed to update base mouse count. Please check your permissions.",
                                   L"Error",
                                   MB_ICONERROR | MB_OK);
-                    } else {
-                        // Re-check if auto-switch is enabled, to apply new settings immediately
-                        if (autoSwitchEnabled) {
-                            CheckAndApplyAutoSwitch();
-                        }
                     }
 
+                    // Single re-apply point: every setting the check reads —
+                    // direction, auto-switch flag, base device count — is
+                    // persisted by now, so one pass covers them all.
+                    //
                     // Settings may have changed the mapping without the device
                     // state changing, so discard the cached state to force the
-                    // next check to apply the new configuration.
+                    // check to apply the new configuration.
                     if (autoSwitchEnabled && autoSwitchWritten) {
                         g_lastExternalMouseState = EXTERNAL_MOUSE_UNKNOWN;
                         CheckAndApplyAutoSwitch();