diff --git a/packs/kirocrew/install.sh b/packs/kirocrew/install.sh
index 335773b..5d58a4a 100755
--- a/packs/kirocrew/install.sh
+++ b/packs/kirocrew/install.sh
@@ -29,7 +29,7 @@ PACK_ARG_REGION="$(pack_config_get region "us-east-1")"
 PACK_ARG_FROM_SECRET="$(pack_config_get from-secret "")"
 PACK_ARG_API_KEY="$(pack_config_get kiro-api-key "")"
 PACK_ARG_CHANNEL="$(pack_config_get channel "stable")"
-PACK_ARG_KIROCREW_VERSION="$(pack_config_get kirocrew-version "0.3.0")"
+PACK_ARG_KIROCREW_VERSION="$(pack_config_get kirocrew-version "0.4.1rc1")"
 PACK_ARG_EXTRAS="$(pack_config_get extras "aws,voice")"
 PACK_ARG_GATEWAY_PORT="$(pack_config_get gateway-port "5476")"
 PACK_ARG_START_GATEWAY="$(pack_config_get start-gateway "true")"
@@ -53,12 +53,15 @@ Options:
   --from-secret        Secrets Manager id/arn for Kiro API key      [default: ""]
   --channel            KiroCrew release channel                     [default: stable]
                        (stable | nightly | insider)
-  --kirocrew-version   Pin KiroCrew version                         [default: 0.3.0]
+  --kirocrew-version   Pin KiroCrew version                         [default: 0.4.1rc1]
                        Channel and version BOTH form the download path
                        (cli/<channel>/<version>/cli-manifest.json), so they
-                       must be compatible. 0.3.0 was cut on the stable lane
-                       only: changing --channel without also passing a version
-                       that exists on that lane 403s and fails the install.
+                       must be compatible. This is the published ARTIFACT
+                       version, not the GitHub release tag: upstream tag
+                       v0.4.1 ships the CLI as 0.4.1rc1, so pinning "0.4.1"
+                       404s/403s even on stable. Confirm a pin resolves on
+                       its lane before changing either value; the stable lane
+                       publishes feed/stable/latest-cli.json naming it.
   --extras             Comma-separated pip extras (aws,voice)       [default: aws,voice]
   --gateway-port       KiroCrew gateway port                        [default: 5476]
   --start-gateway      Enable systemd service (true|false)          [default: true]
diff --git a/packs/kirocrew/manifest.yaml b/packs/kirocrew/manifest.yaml
index 26081f5..518571e 100644
--- a/packs/kirocrew/manifest.yaml
+++ b/packs/kirocrew/manifest.yaml
@@ -25,8 +25,8 @@ params:
     description: "KiroCrew release channel (stable | nightly | insider)"
     default: "stable"
   - name: kirocrew-version
-    description: "KiroCrew version passed to the upstream installer as --version. Pinned by default; an empty value does NOT float to the channel's latest, because pack_config_get falls back to the pinned default whenever the configured value is empty. Must be compatible with the channel: both values form the manifest path cli/<channel>/<version>/cli-manifest.json, and an unmatched pair (e.g. insider/0.3.0) returns 403 and fails the install."
-    default: "0.3.0"
+    description: "KiroCrew version passed to the upstream installer as --version. Pinned by default; an empty value does NOT float to the channel's latest, because pack_config_get falls back to the pinned default whenever the configured value is empty. This is the published ARTIFACT version, not the GitHub release tag: upstream tag v0.4.1 ships the CLI wheel as 0.4.1rc1. Must be compatible with the channel: both values form the manifest path cli/<channel>/<version>/cli-manifest.json, and a pair that was never published there (e.g. stable/0.4.1, or insider/0.4.1rc1) returns 403 and fails the install."
+    default: "0.4.1rc1"
   - name: extras
     description: "Comma-separated pip extras to install after wheel (voice, aws)"
     default: "aws,voice"
diff --git a/packs/kirocrew/test.sh b/packs/kirocrew/test.sh
index a210912..3a744a6 100755
--- a/packs/kirocrew/test.sh
+++ b/packs/kirocrew/test.sh
@@ -186,6 +186,35 @@ else
   fail "install.sh --help does not exit 0"
 fi
 
+# ── version pin consistency ──────────────────────────────────────────────────
+# The pinned KiroCrew version is stated in three independent places. They drift
+# silently on a version bump, and a stale help/manifest value misleads operators
+# into passing a channel/version pair that was never published (403 install).
+header "version pin consistency"
+
+PIN_MANIFEST="$(python3 -c "
+import yaml
+d = yaml.safe_load(open('${MANIFEST}'))
+print(next(p['default'] for p in d.get('params', []) if p['name'] == 'kirocrew-version'))
+" 2>/dev/null || true)"
+
+PIN_CODE="$(sed -n 's/.*pack_config_get kirocrew-version "\([^"]*\)".*/\1/p' "${INSTALL}" | head -1)"
+
+PIN_HELP="$(bash "${INSTALL}" --help 2>/dev/null \
+  | sed -n 's/.*--kirocrew-version .*\[default: \([^]]*\)\].*/\1/p' | head -1)"
+
+if [[ -n "${PIN_MANIFEST}" && -n "${PIN_CODE}" && -n "${PIN_HELP}" ]]; then
+  pass "pinned version is discoverable in manifest, code, and help"
+else
+  fail "could not extract pin (manifest='${PIN_MANIFEST}' code='${PIN_CODE}' help='${PIN_HELP}')"
+fi
+
+if [[ "${PIN_MANIFEST}" == "${PIN_CODE}" && "${PIN_CODE}" == "${PIN_HELP}" ]]; then
+  pass "pin agrees across manifest, code fallback, and help (${PIN_CODE})"
+else
+  fail "pin disagrees: manifest='${PIN_MANIFEST}' code='${PIN_CODE}' help='${PIN_HELP}'"
+fi
+
 # ── arg parser exit codes ────────────────────────────────────────────────────
 header "arg parser exit codes"