diff --git a/scripts/cli/commands/updater/cli_updater_commands.sh b/scripts/cli/commands/updater/cli_updater_commands.sh
index 88bd9f9..ee5a54e 100644
--- a/scripts/cli/commands/updater/cli_updater_commands.sh
+++ b/scripts/cli/commands/updater/cli_updater_commands.sh
@@ -102,7 +102,15 @@ cliHandleUpdaterCommands()
             # latter needs a ladder, a verifier and a snapshot per step.
             if [[ -z "$app" ]]; then isError "Usage: libreportal updater upgrade <app> [version] [--dry-run]"; return 1; fi
             local upgrade_target="$initial_command4" upgrade_mode="$initial_command5"
-            [[ "$upgrade_target" == "--dry-run" ]] && { upgrade_mode="--dry-run"; upgrade_target=""; }
+            # Any flag in the version slot is a flag, not a version. Without
+            # this, `upgrade <app> --detach` treated "--detach" as the target
+            # and refused with "no safe path to --detach" — it failed safe, but
+            # blaming the version for a misplaced flag is a poor way to say
+            # "that flag isn't supported here".
+            case "$upgrade_target" in
+                --dry-run) upgrade_mode="--dry-run"; upgrade_target="" ;;
+                --*)       isError "Unknown option '$upgrade_target'. Usage: libreportal updater upgrade <app> [version] [--dry-run]"; return 1 ;;
+            esac
             for _f in cli_updater_ladder cli_updater_verify cli_updater_upgrade; do
                 declare -F updaterUpgradeApp >/dev/null 2>&1 || \
                     source "$install_scripts_dir/cli/commands/updater/${_f}.sh" 2>/dev/null