diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8dc5f00..2d6a1c2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,26 @@
 # Changelog
 
+## 2.12.4 — fix: the updater used the wrong compose project name
+
+The updater mounts the project at `/project`, and Compose derives the project name
+from the directory name — so it inferred `project` while the running stack was
+`waxflow`. A different project name means Compose tries to CREATE rather than
+RECREATE, so every apply died instantly with:
+
+    Conflict. The container name "/waxflow-api" is already in use
+
+**Auto-update would have failed on every single run.**
+
+Found by forcing an apply of the current version rather than waiting for a real
+release to expose it. The failure was safe — the stack stayed up and healthy on
+2.12.3 and `.update-result` correctly recorded `failed`, which is the fail-safe
+behaving as designed — but nothing would ever have updated.
+
+The project name is now detected from the running container's own
+`com.docker.compose.project` label, so it is correct wherever the project lives on
+disk. `WAXFLOW_PROJECT_NAME` overrides it.
+
+
 ## 2.12.3 — build release images on native runners, not QEMU
 
 The first version of `release-images.yml` cross-built arm64 through
diff --git a/VERSION b/VERSION
index ccc99d0..56beced 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.12.3
+2.12.4
diff --git a/scripts/waxflow-updater.sh b/scripts/waxflow-updater.sh
index 621a77b..3d11643 100644
--- a/scripts/waxflow-updater.sh
+++ b/scripts/waxflow-updater.sh
@@ -62,7 +62,27 @@ except Exception:
 " >/dev/null 2>&1
 }
 
-compose() { docker compose --project-directory "$PROJECT_DIR" "$@"; }
+# COMPOSE PROJECT NAME — must match the running stack.
+#
+# Compose derives the project name from the directory name, and this container
+# mounts the project at /project, so it inferred "project" while the real stack
+# was "waxflow". Different project name means compose tries to CREATE rather than
+# RECREATE, and immediately hits:
+#
+#   Conflict. The container name "/waxflow-api" is already in use
+#
+# Detect it from the running container's own compose label so this is
+# self-configuring regardless of where the project lives on disk.
+detect_project() {
+    docker inspect waxflow-api \
+        --format '{{index .Config.Labels "com.docker.compose.project"}}' 2>/dev/null
+}
+PROJECT_NAME="${WAXFLOW_PROJECT_NAME:-$(detect_project)}"
+[ -z "$PROJECT_NAME" ] && PROJECT_NAME="waxflow"
+
+compose() {
+    docker compose --project-name "$PROJECT_NAME" --project-directory "$PROJECT_DIR" "$@"
+}
 
 apply_tag() {   # tag -> pull + recreate the three services on that tag
     tag="$1"
@@ -72,7 +92,7 @@ apply_tag() {   # tag -> pull + recreate the three services on that tag
     return 0
 }
 
-log "updater started (poll=${POLL}s, services='$SERVICES')"
+log "updater started (poll=${POLL}s, project='$PROJECT_NAME', services='$SERVICES')"
 if ! docker version >/dev/null 2>&1; then
     log "FATAL: cannot reach the Docker socket — is /var/run/docker.sock mounted?"
     exit 1