diff --git a/agent/pyproject.toml b/agent/pyproject.toml
index 5754900..9e7235b 100644
--- a/agent/pyproject.toml
+++ b/agent/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "gti-fiscal-agent"
-version = "1.1.6"
+version = "1.1.7"
 requires-python = ">=3.10"
 dependencies = ["httpx>=0.27,<1"]
 
diff --git a/agent/scripts/run_agent_service.py b/agent/scripts/run_agent_service.py
index f1419c4..b7e71c8 100644
--- a/agent/scripts/run_agent_service.py
+++ b/agent/scripts/run_agent_service.py
@@ -103,7 +103,7 @@ class Config:
         # (A legacy AGENT_JOBS_ENABLED line in an old agent.env is deliberately ignored.)
         self.agent_jobs_enabled = True
         self.poll_interval_seconds = float(env.get("POLL_INTERVAL_SECONDS", "5"))
-        self.agent_version = env.get("AGENT_VERSION", "1.1.6")
+        self.agent_version = env.get("AGENT_VERSION", "1.1.7")
         self.schema_fingerprint = env.get("SCHEMA_FINGERPRINT", REFERENCE_SCHEMA_V1)
         self.state_db = env.get("AGENT_STATE_DB", str(AGENT_ROOT / "agent_state.sqlite"))
         # Pilot write authorization: both must be explicitly set by the installer for
@@ -240,7 +240,7 @@ def execute_job(job, config, executor, state, env):
             "coverage": coverage,
             "operational": operational,
             "fiscal_mode": getattr(config, "fiscal_mode", None),
-            "release_version": env.get("AGENT_VERSION") or "1.1.6",
+            "release_version": env.get("AGENT_VERSION") or "1.1.7",
             "products_total": len(products),
             "products_changed": len(to_process),
             "products_processed": summary["processed"],
@@ -398,7 +398,7 @@ def run(config, env, *, max_iterations=None, stopper=None):
 def enforce_startup_preflight(env):
     """Full read-only preflight at startup (Hub, auth, Firebird, capabilities, company context, guards). Fail closed."""
     from gti_fiscal_agent.preflight import run_preflight
-    report = run_preflight(env, agent_version=env.get("AGENT_VERSION") or "1.1.6")
+    report = run_preflight(env, agent_version=env.get("AGENT_VERSION") or "1.1.7")
     logger.info("startup preflight: %s", json.dumps({k: report[k] for k in ("PREFLIGHT", "blockers", "fiscal_mode", "effective_firebird_writes")}, ensure_ascii=False))
     print(json.dumps({"PREFLIGHT": report["PREFLIGHT"], "blockers": report["blockers"]}, ensure_ascii=False))
     if report["PREFLIGHT"] != "PASS":
diff --git a/agent/src/gti_fiscal_agent/preflight.py b/agent/src/gti_fiscal_agent/preflight.py
index 52a81d2..e76c3e7 100644
--- a/agent/src/gti_fiscal_agent/preflight.py
+++ b/agent/src/gti_fiscal_agent/preflight.py
@@ -9,7 +9,7 @@ import os
 import sqlite3
 from pathlib import Path
 
-AGENT_VERSION_DEFAULT = "1.1.6"
+AGENT_VERSION_DEFAULT = "1.1.7"
 REQUIRED_ENV = ("GTI_HUB_URL", "AGENT_TOKEN", "FIREBIRD_DATABASE_PATH", "FB_USER", "FB_PASSWORD")
 REQUIRED_CAPABILITIES = ("supports_ncm", "supports_ipi", "supports_cest")
 FISCAL_MODES = ("DRY_RUN", "AUTO_APPLY")
diff --git a/central/app/version.py b/central/app/version.py
index 0917fac..7390433 100644
--- a/central/app/version.py
+++ b/central/app/version.py
@@ -4,5 +4,5 @@ kept identical to this) and what an AgentRelease row's `version` column holds
 once published — never a second, independent version number. Fiscal semantics
 are versioned separately (ENGINE_VERSION/DECISION_VERSION in classification.py,
 DECISION_ENGINE_VERSION etc.) and are NOT changed by a release bump."""
-GTI_FISCAL_VERSION = "1.1.6"
+GTI_FISCAL_VERSION = "1.1.7"
 API_COMPAT_MAJOR_MINOR = "1.0"  # an Agent 1.0.x/1.1.x talks to any Hub 1.0.x
diff --git a/central/pyproject.toml b/central/pyproject.toml
index 30f73a4..8f8f0cc 100644
--- a/central/pyproject.toml
+++ b/central/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "gti-fiscal-hub"
-version = "1.1.6"
+version = "1.1.7"
 requires-python = ">=3.10"
 dependencies = [
   "fastapi>=0.115,<1",
diff --git a/central/tests/test_health.py b/central/tests/test_health.py
index d224cb1..82c96c2 100644
--- a/central/tests/test_health.py
+++ b/central/tests/test_health.py
@@ -17,7 +17,7 @@ def test_health_is_unavailable_when_database_is_down():
 
 def test_version_endpoint_reports_release_and_fiscal_versions():
     body = TestClient(create_app(database_probe=lambda: True)).get("/version").json()
-    assert body["version"] == "1.1.6" and body["api_compat"] == "1.0" and body["engine_version"] and body["decision_version"]
+    assert body["version"] == "1.1.7" and body["api_compat"] == "1.0" and body["engine_version"] and body["decision_version"]
 
 
 def test_production_refuses_the_dev_token(monkeypatch):
diff --git a/deploy/agent-windows/agent.env.template b/deploy/agent-windows/agent.env.template
index 3bbbf03..4ec0bf6 100644
--- a/deploy/agent-windows/agent.env.template
+++ b/deploy/agent-windows/agent.env.template
@@ -19,4 +19,4 @@ FB_PASSWORD=
 FISCAL_MODE=DRY_RUN
 FIREBIRD_WRITES=0
 POLL_INTERVAL_SECONDS=5
-AGENT_VERSION=1.1.6
+AGENT_VERSION=1.1.7
diff --git a/deploy/agent-windows/gti-agent.ps1 b/deploy/agent-windows/gti-agent.ps1
index 9f34dab..7ba5ac6 100644
--- a/deploy/agent-windows/gti-agent.ps1
+++ b/deploy/agent-windows/gti-agent.ps1
@@ -164,7 +164,7 @@ switch ($Command) {
                 "GTI_HUB_URL=$hub", "AGENT_TOKEN=$token", "AGENT_ID=$agentId",
                 "COMPANY_CODE=$code", "COMPANY_CNPJ=$cnpj", "COMPANY_CRT_SOURCE=$crtSource",
                 "FIREBIRD_DATABASE_PATH=$db", "FB_USER=$fbUser", "FB_PASSWORD=$fbPass",
-                'FISCAL_MODE=DRY_RUN', 'FIREBIRD_WRITES=0', 'POLL_INTERVAL_SECONDS=5', 'AGENT_VERSION=1.1.6'
+                'FISCAL_MODE=DRY_RUN', 'FIREBIRD_WRITES=0', 'POLL_INTERVAL_SECONDS=5', 'AGENT_VERSION=1.1.7'
             )
             Set-Content -Path $EnvFile -Value $lines -Encoding UTF8
         }
diff --git a/deploy/agent-windows/pilot-construcao.env.example b/deploy/agent-windows/pilot-construcao.env.example
index f2351a7..d9d05dc 100644
--- a/deploy/agent-windows/pilot-construcao.env.example
+++ b/deploy/agent-windows/pilot-construcao.env.example
@@ -19,4 +19,4 @@ FB_PASSWORD=
 FISCAL_MODE=DRY_RUN
 FIREBIRD_WRITES=0
 POLL_INTERVAL_SECONDS=5
-AGENT_VERSION=1.1.6
+AGENT_VERSION=1.1.7
diff --git a/deploy/agent-windows/profiles/mmmodas.env.example b/deploy/agent-windows/profiles/mmmodas.env.example
index b4c2ad6..1f902bc 100644
--- a/deploy/agent-windows/profiles/mmmodas.env.example
+++ b/deploy/agent-windows/profiles/mmmodas.env.example
@@ -19,4 +19,4 @@ FB_PASSWORD=
 FISCAL_MODE=DRY_RUN
 FIREBIRD_WRITES=0
 POLL_INTERVAL_SECONDS=5
-AGENT_VERSION=1.1.6
+AGENT_VERSION=1.1.7
diff --git a/deploy/agent-windows/profiles/rincao.env.example b/deploy/agent-windows/profiles/rincao.env.example
index d14cad6..66d0552 100644
--- a/deploy/agent-windows/profiles/rincao.env.example
+++ b/deploy/agent-windows/profiles/rincao.env.example
@@ -19,4 +19,4 @@ FB_PASSWORD=
 FISCAL_MODE=DRY_RUN
 FIREBIRD_WRITES=0
 POLL_INTERVAL_SECONDS=5
-AGENT_VERSION=1.1.6
+AGENT_VERSION=1.1.7
diff --git a/deploy/agent-windows/profiles/uniao.env.example b/deploy/agent-windows/profiles/uniao.env.example
index 84a3880..b690afb 100644
--- a/deploy/agent-windows/profiles/uniao.env.example
+++ b/deploy/agent-windows/profiles/uniao.env.example
@@ -19,4 +19,4 @@ FB_PASSWORD=
 FISCAL_MODE=DRY_RUN
 FIREBIRD_WRITES=0
 POLL_INTERVAL_SECONDS=5
-AGENT_VERSION=1.1.6
+AGENT_VERSION=1.1.7
diff --git a/deploy/hub/.env.example b/deploy/hub/.env.example
index 51ab0c0..8426aef 100644
--- a/deploy/hub/.env.example
+++ b/deploy/hub/.env.example
@@ -1,5 +1,5 @@
 # GTI Fiscal Hub — production environment (copy to .env, never commit .env)
-GTI_FISCAL_VERSION=1.1.6
+GTI_FISCAL_VERSION=1.1.7
 
 # REQUIRED. URL-safe secret (used inside a connection URL): openssl rand -hex 24
 POSTGRES_PASSWORD=
diff --git a/deploy/hub/docker-compose.prod.yml b/deploy/hub/docker-compose.prod.yml
index 92cf1a8..a9bb9d2 100644
--- a/deploy/hub/docker-compose.prod.yml
+++ b/deploy/hub/docker-compose.prod.yml
@@ -36,7 +36,7 @@ services:
     build:
       context: ../..
       dockerfile: central/Dockerfile
-    image: gti-fiscal-hub:${GTI_FISCAL_VERSION:-1.1.6}
+    image: gti-fiscal-hub:${GTI_FISCAL_VERSION:-1.1.7}
     restart: unless-stopped
     depends_on:
       postgres:
diff --git a/docs/DEPLOY_HUB.md b/docs/DEPLOY_HUB.md
index fe0eae4..3aee69a 100644
--- a/docs/DEPLOY_HUB.md
+++ b/docs/DEPLOY_HUB.md
@@ -16,7 +16,7 @@ A variável de ambiente `GTI_SSH_PASSWORD`, se existir, tem prioridade. A senha
 ## Deploy
 ```
 powershell -ExecutionPolicy Bypass -File .\scripts\deploy_hub.ps1
-powershell -ExecutionPolicy Bypass -File .\scripts\deploy_hub.ps1 -PublishAgent -Version 1.1.6
+powershell -ExecutionPolicy Bypass -File .\scripts\deploy_hub.ps1 -PublishAgent -Version 1.1.7
 ```
 Parâmetros: `-Version` (padrão `release/VERSION`), `-PublishAgent`, `-SkipTests`, `-DryRun`.
 
diff --git a/installer/install_common.py b/installer/install_common.py
index d0de515..6d6c98b 100644
--- a/installer/install_common.py
+++ b/installer/install_common.py
@@ -201,7 +201,8 @@ def install_service(install_dir_path: Path) -> None:
     exe = Path(install_dir_path) / "GTIFiscalAgentService" / "GTIFiscalAgentService.exe"
     bin_path = f"\"{exe}\""
     result = _sc(["create", SERVICE_NAME, "binPath=", bin_path, "start=", "auto", "DisplayName=", SERVICE_DISPLAY])
-    if result.returncode != 0 and "already exists" not in (result.stdout + result.stderr):
+    # 1073 = ERROR_SERVICE_EXISTS. Match the code, never the message: the text is localized (pt-BR: "já existe").
+    if result.returncode not in (0, 1073) and "already exists" not in (result.stdout + result.stderr):
         raise RuntimeError(f"sc create failed: {result.stdout} {result.stderr}".strip())
     _sc(["config", SERVICE_NAME, "start=", "delayed-auto"])
     _sc(["config", SERVICE_NAME, "obj=", "LocalSystem"])
diff --git a/installer/setup_main.py b/installer/setup_main.py
index a50b739..8c33558 100644
--- a/installer/setup_main.py
+++ b/installer/setup_main.py
@@ -142,10 +142,15 @@ def upgrade_flow(*, install_dir_path: str | None = None, progress: Callable[[str
     progress("Atualizando o Agent (identidade e credenciais preservadas)…")
     if common.service_installed():
         common.ensure_service_stopped()
-    extract_payload(install)
-    common.upgrade_agent_env(install, version)
-    common.install_service(install)
-    common.write_arp_uninstall(install)
+    try:
+        extract_payload(install)
+        common.upgrade_agent_env(install, version)
+        common.install_service(install)
+        common.write_arp_uninstall(install)
+    except Exception as error:  # noqa: BLE001 — never leave the host without a running Agent because an upgrade step failed
+        common.ilog(f"upgrade step failed: {error!r}; restarting the existing service")
+        common.start_and_verify(attempts=2)
+        raise
     os.environ["AGENT_VERSION"] = version
     progress("Iniciando o serviço…")
     common.ilog(f"upgrade to {version} from {existing.get('agent_id')}")
diff --git a/release/RELEASE_MANIFEST.json b/release/RELEASE_MANIFEST.json
index a1523a4..3c01ac6 100644
--- a/release/RELEASE_MANIFEST.json
+++ b/release/RELEASE_MANIFEST.json
@@ -1,14 +1,14 @@
 {
  "artifact": "RELEASE_MANIFEST",
- "GTI_FISCAL_VERSION": "1.1.6",
- "generated_at": "2026-09-24T13:51:44+00:00",
+ "GTI_FISCAL_VERSION": "1.1.7",
+ "generated_at": "2026-09-24T14:13:15+00:00",
  "hub": {
-  "version": "1.1.6",
+  "version": "1.1.7",
   "api_compat": "1.0",
   "engine_version": "0.3.0",
   "decision_version": "mission-04c-ipi-ex-split"
  },
- "agent_version": "1.1.6",
+ "agent_version": "1.1.7",
  "fiscal_engine": {
   "ENGINE_VERSION": "0.3.0",
   "DECISION_VERSION": "mission-04c-ipi-ex-split",
diff --git a/release/VERSION b/release/VERSION
index 0664a8f..2bf1ca5 100644
--- a/release/VERSION
+++ b/release/VERSION
@@ -1 +1 @@
-1.1.6
+1.1.7
diff --git a/tests/test_release_candidate.py b/tests/test_release_candidate.py
index 1ff11af..8d8b69f 100644
--- a/tests/test_release_candidate.py
+++ b/tests/test_release_candidate.py
@@ -14,11 +14,11 @@ sys.path.insert(0, str(ROOT))
 def test_versions_are_coherent_across_hub_agent_and_packages():
     from central.app.version import GTI_FISCAL_VERSION
     v = (ROOT / "release" / "VERSION").read_text(encoding="utf-8").strip()
-    assert v == GTI_FISCAL_VERSION == "1.1.6"
+    assert v == GTI_FISCAL_VERSION == "1.1.7"
     pep = v.replace("-rc", "rc")
     for pp in ("central/pyproject.toml", "agent/pyproject.toml"):
         assert f'version = "{pep}"' in (ROOT / pp).read_text(encoding="utf-8")
-    assert '"AGENT_VERSION", "1.1.6"' in (ROOT / "agent" / "scripts" / "run_agent_service.py").read_text(encoding="utf-8")
+    assert '"AGENT_VERSION", "1.1.7"' in (ROOT / "agent" / "scripts" / "run_agent_service.py").read_text(encoding="utf-8")
     manifest = ROOT / "release" / "RELEASE_MANIFEST.json"
     if manifest.exists():
         m = json.loads(manifest.read_text(encoding="utf-8"))
diff --git a/tests/test_zero_touch_installer.py b/tests/test_zero_touch_installer.py
index c2034b1..a32795e 100644
--- a/tests/test_zero_touch_installer.py
+++ b/tests/test_zero_touch_installer.py
@@ -157,3 +157,36 @@ def test_start_and_verify_reports_failure_after_all_attempts(monkeypatch, tmp_pa
     ok, detail = common.start_and_verify(attempts=2, per_attempt=0.01)
     assert not ok and "1053" in detail
     assert "NÃO iniciou" in setup_main.final_message({"service_running": False, "service_detail": detail, "install_dir": "x"})
+
+
+def test_install_service_tolerates_localized_already_exists(monkeypatch):
+    """pt-BR Windows says 'já existe', not 'already exists': the return code (1073) must decide."""
+    import subprocess
+    seen = []
+
+    def fake_sc(args):
+        seen.append(args[0])
+        if args[0] == "create":
+            return subprocess.CompletedProcess(args, 1073, "[SC] CreateService FALHA 1073: O serviço especificado já existe.", "")
+        if args[0] == "qc":
+            return subprocess.CompletedProcess(args, 0, "START_TYPE : 2 AUTO_START (DELAYED)", "")
+        return subprocess.CompletedProcess(args, 0, "", "")
+
+    monkeypatch.setattr(common, "_sc", fake_sc)
+    common.install_service(Path("C:/x"))
+    assert seen[:3] == ["create", "config", "config"] and "failure" in seen
+
+
+def test_failed_upgrade_step_restarts_the_existing_service(world, monkeypatch):
+    calls, inst = world
+    inst.mkdir(parents=True)
+    (inst / "credentials.bin").write_bytes(b"b")
+    (inst / "agent.env").write_text("AGENT_ID=2\nINSTALLATION_ID=x\nGTI_HUB_URL=https://h\n")
+
+    def boom(d):
+        raise RuntimeError("boom")
+
+    monkeypatch.setattr(common, "install_service", boom)
+    with pytest.raises(RuntimeError, match="boom"):
+        setup_main.upgrade_flow()
+    assert ("start",) in calls  # the Agent was brought back up despite the failure