diff --git a/.github/workflows/package-openwrt.yml b/.github/workflows/package-openwrt.yml
index 9a8d8ba9..ee26a6ae 100644
--- a/.github/workflows/package-openwrt.yml
+++ b/.github/workflows/package-openwrt.yml
@@ -25,6 +25,7 @@ jobs:
     outputs:
       package_version: ${{ steps.version.outputs.package_version }}
       apk_version: ${{ steps.version.outputs.apk_version }}
+      ipk_version: ${{ steps.version.outputs.ipk_version }}
       release_channel: ${{ steps.channel.outputs.release_channel }}
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
@@ -41,15 +42,28 @@ jobs:
           # in the .apk metadata. apk_version is built directly from the same
           # structured inputs (tag, or commit height) — no reparse of the
           # flattened package_version. See packaging/openwrt-apk/apk-version.sh.
+          #
+          # ipk_version is the .ipk control Version. opkg compares versions as
+          # dpkg does, so it reads a tag's vX.Y.Z-rcN as revision rcN and sorts
+          # it above the release; vX.Y.Z~rcN sorts below it. git refuses '~' in
+          # a ref name, so the tag carries '-' and this maps it. The leading 'v'
+          # stays: every released .ipk carries it, and under opkg 0.5.4 sorts
+          # below v0.5.3. testing/check-package-versions.sh runs this step's text.
           if [[ "$GITHUB_REF" == refs/tags/* ]]; then
             echo "package_version=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
             echo "apk_version=$(sh packaging/openwrt-apk/apk-version.sh tag "${GITHUB_REF_NAME}")" >> "$GITHUB_OUTPUT"
+            IPK_VERSION="${GITHUB_REF_NAME}"
+            if [[ "$GITHUB_REF_NAME" =~ ^(v[0-9]+\.[0-9]+\.[0-9]+)-((alpha|beta|pre|rc)[0-9]*)$ ]]; then
+              IPK_VERSION="${BASH_REMATCH[1]}~${BASH_REMATCH[2]}"
+            fi
+            echo "ipk_version=${IPK_VERSION}" >> "$GITHUB_OUTPUT"
           else
             BRANCH=$(echo "$GITHUB_REF_NAME" | sed 's|/|-|g')
             HEIGHT=$(git rev-list --count HEAD)
             HASH=$(git rev-parse --short HEAD)
             echo "package_version=${BRANCH}.${HEIGHT}.${HASH}" >> "$GITHUB_OUTPUT"
             echo "apk_version=$(sh packaging/openwrt-apk/apk-version.sh dev "${HEIGHT}")" >> "$GITHUB_OUTPUT"
+            echo "ipk_version=${BRANCH}.${HEIGHT}.${HASH}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Determine release channel
@@ -332,6 +346,7 @@ jobs:
       - name: Build .ipk
         env:
           PKG_VERSION: ${{ needs.determine-versioning.outputs.package_version }}
+          IPK_VERSION: ${{ needs.determine-versioning.outputs.ipk_version }}
         run: ./packaging/openwrt-ipk/build-ipk.sh --arch ${{ matrix.build_arch }} --bin-dir "$GITHUB_WORKSPACE/bins"
 
       - name: Install shellcheck (if missing)
diff --git a/packaging/openwrt-ipk/build-ipk.sh b/packaging/openwrt-ipk/build-ipk.sh
index cdd82eec..f960a184 100755
--- a/packaging/openwrt-ipk/build-ipk.sh
+++ b/packaging/openwrt-ipk/build-ipk.sh
@@ -14,7 +14,13 @@
 #   arm       32-bit ARM routers (Cortex-A7)
 #   x86_64    x86 routers / VMs
 #
-# Output: dist/fips_<version>_<openwrt-arch>.ipk
+# Output: dist/fips_<PKG_VERSION>_<openwrt-arch>.ipk
+#
+# Environment:
+#   PKG_VERSION  label for the file name (default: git describe)
+#   IPK_VERSION  control file Version (default: PKG_VERSION). CI passes a
+#                release candidate as vX.Y.Z~rcN, which opkg sorts below the
+#                release, while PKG_VERSION keeps the tag's vX.Y.Z-rcN.
 #
 # Prerequisites:
 #   cargo install cargo-zigbuild
@@ -86,8 +92,13 @@ DIST_DIR="$PROJECT_ROOT/dist"
 
 PKG_NAME="fips"
 PKG_VERSION="${PKG_VERSION:-$(cd "$PROJECT_ROOT" && git describe --tags --always --dirty 2>/dev/null || echo "0.1.0")}"
+IPK_VERSION="${IPK_VERSION:-$PKG_VERSION}"
 
-echo "==> Building $PKG_NAME $PKG_VERSION for $OPENWRT_ARCH ($RUST_TARGET)"
+if [ "$IPK_VERSION" = "$PKG_VERSION" ]; then
+    echo "==> Building $PKG_NAME $PKG_VERSION for $OPENWRT_ARCH ($RUST_TARGET)"
+else
+    echo "==> Building $PKG_NAME $PKG_VERSION (control Version $IPK_VERSION) for $OPENWRT_ARCH ($RUST_TARGET)"
+fi
 
 # ---------------------------------------------------------------------------
 # 1. Obtain binaries
@@ -192,7 +203,7 @@ PKG_SIZE=$(du -sk "$DATA_DIR" | cut -f1)
 
 cat > "$CONTROL_DIR/control" <<EOF
 Package: $PKG_NAME
-Version: $PKG_VERSION
+Version: $IPK_VERSION
 Architecture: $OPENWRT_ARCH
 Maintainer: FIPS Network
 Section: net
diff --git a/testing/check-package-versions.sh b/testing/check-package-versions.sh
index ea069e0c..4f7418cf 100755
--- a/testing/check-package-versions.sh
+++ b/testing/check-package-versions.sh
@@ -23,6 +23,26 @@
 # would leave checksums-linux.txt naming a file the release does not have).
 # Those three are read from the text, not executed.
 #
+# OpenWrt's opkg compares versions with dpkg's algorithm (libopkg/pkg.c
+# verrevcmp in openwrt/opkg-lede, read at 80503d94) and splits a revision at
+# the last '-', so the .ipk has the same defect. package-openwrt.yml's "Derive
+# package version" step maps the tag for the .ipk control Version, keeping the
+# leading 'v' every released .ipk carries: under opkg, 0.5.4 sorts below
+# v0.5.3, so dropping it would stop releases upgrading. dpkg stands in for
+# opkg as the ordering oracle; it warns about the 'v' and still compares.
+#
+# ipk cases:
+#   refs/tags/v0.5.3      package_version and ipk_version v0.5.3
+#   refs/tags/v0.5.3-rc1  ipk_version v0.5.3~rc1, package_version (the file
+#                         label) v0.5.3-rc1, and v0.5.2 < v0.5.3~rc1 < v0.5.3
+#                         < v0.5.4
+#   refs/tags/v0.5.3-beta1  ipk_version v0.5.3~beta1, which sorts between
+#                         v0.5.2 and v0.5.3~rc1
+#   refs/heads/maint      ipk_version equals package_version
+# and the wiring: the job declares ipk_version, and the "Build .ipk" step
+# passes it as IPK_VERSION. build-ipk.sh's use of IPK_VERSION is executed by
+# testing/openwrt/package-test.sh.
+#
 # Exit 0 = clean. Exit 1 = a case or a wiring check failed, including a
 # derivation that ran but did not write a declared output. Exit 2 = the check
 # could not run (no dpkg, no PyYAML, a step not found, the derivation failed,
@@ -200,6 +220,46 @@ expect_text "$WORK/deb.build.sh" \
 expect_text "$WORK/deb.build.sh" "tr '~' '-'" \
     "the .deb build renames a '~' in the package file name"
 
+# ── OpenWrt .ipk, package-openwrt.yml ─────────────────────────────────────
+extract ipk package-openwrt.yml determine-versioning "Derive package version" \
+    build "Build .ipk"
+
+echo "ipk: release tag refs/tags/v0.5.3"
+derive ipk refs/tags/v0.5.3 package_version ipk_version
+expect_eq "package_version" "${OUT[package_version]}" "v0.5.3"
+expect_eq "ipk_version" "${OUT[ipk_version]}" "v0.5.3"
+
+echo "ipk: candidate tag refs/tags/v0.5.3-rc1"
+derive ipk refs/tags/v0.5.3-rc1 package_version ipk_version
+expect_eq "package_version" "${OUT[package_version]}" "v0.5.3-rc1"
+expect_eq "ipk_version" "${OUT[ipk_version]}" "v0.5.3~rc1"
+expect_order "${OUT[ipk_version]}" lt v0.5.3
+expect_order "${OUT[ipk_version]}" gt v0.5.2
+expect_order v0.5.4 gt "${OUT[ipk_version]}"
+RC1_IPK="${OUT[ipk_version]}"
+
+echo "ipk: candidate tag refs/tags/v0.5.3-beta1"
+derive ipk refs/tags/v0.5.3-beta1 package_version ipk_version
+expect_eq "package_version" "${OUT[package_version]}" "v0.5.3-beta1"
+expect_eq "ipk_version" "${OUT[ipk_version]}" "v0.5.3~beta1"
+expect_order "${OUT[ipk_version]}" lt "$RC1_IPK"
+expect_order "${OUT[ipk_version]}" gt v0.5.2
+
+echo "ipk: branch refs/heads/maint"
+derive ipk refs/heads/maint package_version ipk_version
+expect_eq "package_version" "${OUT[package_version]}" "maint.${HEIGHT}.${HASH}"
+expect_eq "ipk_version" "${OUT[ipk_version]}" "${OUT[package_version]}"
+
+echo "ipk: wiring"
+# shellcheck disable=SC2016  # the ${{ }} expressions are workflow text, not shell
+expect_text -x "$WORK/ipk.outputs" \
+    'ipk_version=${{ steps.version.outputs.ipk_version }}' \
+    "determine-versioning declares ipk_version from the derivation step"
+# shellcheck disable=SC2016
+expect_text -x "$WORK/ipk.build.sh" \
+    'IPK_VERSION: ${{ needs.determine-versioning.outputs.ipk_version }}' \
+    "the .ipk build passes ipk_version as IPK_VERSION"
+
 echo
 if [ "$FAILED" -eq 0 ]; then
     echo "check-package-versions: all checks passed"
diff --git a/testing/openwrt/package-test.sh b/testing/openwrt/package-test.sh
index b71f38cd..e40be136 100755
--- a/testing/openwrt/package-test.sh
+++ b/testing/openwrt/package-test.sh
@@ -47,7 +47,7 @@ fi
 PKG_VERSION="pkgtest.$$"
 TMP="$(mktemp -d)" || { echo "package-test: mktemp failed" >&2; exit 2; }
 
-trap 'rm -rf "$TMP"; rm -f "$PROJECT_ROOT/dist/fips_${PKG_VERSION}_"*' EXIT
+trap 'rm -rf "$TMP"; rm -f "$PROJECT_ROOT/dist/fips_${PKG_VERSION}"[_~]*' EXIT
 
 harness_fail() {
     echo "package-test: $*" >&2
@@ -227,7 +227,9 @@ done
 # ── Build the .ipk ──────────────────────────────────────────────────────────
 
 echo "==> build-ipk.sh"
-if ! PKG_VERSION="$PKG_VERSION" \
+# The first build is V1's "IPK_VERSION unset" case, so it must not inherit an
+# IPK_VERSION from the caller's environment.
+if ! env -u IPK_VERSION PKG_VERSION="$PKG_VERSION" \
     bash "$PROJECT_ROOT/packaging/openwrt-ipk/build-ipk.sh" --arch x86_64 --bin-dir "$BINS" \
     > "$TMP/build-ipk.log" 2>&1; then
     cat "$TMP/build-ipk.log" >&2
@@ -240,6 +242,44 @@ tar -xzf "$IPK" -O ./data.tar.gz | tar -tzf - > "$TMP/ipk-data" \
 tar -xzf "$IPK" -O ./control.tar.gz | tar -tzf - > "$TMP/ipk-control" \
     || harness_fail "cannot list control.tar.gz in $IPK"
 
+# Print the Version field of an .ipk's control file.
+ipk_version() {
+    tar -xzf "$1" -O ./control.tar.gz | tar -xzOf - ./control \
+        | sed -n 's/^Version: //p'
+}
+
+# ── V1 and V2. The control Version comes from IPK_VERSION ───────────────────
+# The workflow passes a candidate's opkg-sortable version (vX.Y.Z~rcN) as
+# IPK_VERSION and keeps the tag's form in PKG_VERSION for the file name, since
+# a GitHub release renames an asset with '~' in its name. Unset, IPK_VERSION
+# falls back to PKG_VERSION, as a local build expects.
+got="$(ipk_version "$IPK")" || harness_fail "cannot read the control file in $IPK"
+if [[ "$got" == "$PKG_VERSION" ]]; then
+    ok "V1 with IPK_VERSION unset the control Version is PKG_VERSION ($got)"
+else
+    bad "V1 with IPK_VERSION unset the control Version is '$got', want $PKG_VERSION"
+fi
+# The first build's package is removed so a second build that names its file
+# from anything but PKG_VERSION cannot be passed by reading the stale one.
+RC_VERSION="${PKG_VERSION}~rc1"
+rm -f "$IPK" || harness_fail "cannot remove $IPK before the second build"
+if ! PKG_VERSION="$PKG_VERSION" IPK_VERSION="$RC_VERSION" \
+    bash "$PROJECT_ROOT/packaging/openwrt-ipk/build-ipk.sh" --arch x86_64 --bin-dir "$BINS" \
+    > "$TMP/build-ipk-rc.log" 2>&1; then
+    cat "$TMP/build-ipk-rc.log" >&2
+    harness_fail "build-ipk.sh failed with IPK_VERSION set"
+fi
+if [[ ! -f "$IPK" ]]; then
+    bad "V2 with IPK_VERSION set build-ipk.sh wrote no $IPK; the file name must come from PKG_VERSION"
+else
+    got="$(ipk_version "$IPK")" || harness_fail "cannot read the control file in $IPK"
+    if [[ "$got" == "$RC_VERSION" ]]; then
+        ok "V2 with IPK_VERSION set the control Version is IPK_VERSION ($got), file named from PKG_VERSION"
+    else
+        bad "V2 with IPK_VERSION set the control Version is '$got', want $RC_VERSION"
+    fi
+fi
+
 # ── P1 and P2. Neither package ships the dnsmasq drop-in ────────────────────
 # OpenWrt's dnsmasq builds its config from UCI and reads no directory under
 # /etc, so .fips forwarding comes from the UCI entry 90-fips-setup adds. The