# Download Mullvad VPN

> Mullvad is an open-source commercial virtual private network service based in Sweden.

- Canonical page: https://everyversion.net/mullvad-vpn/
- Publisher: Mullvad VPN
- Latest: Windows 2026.5, macOS 2026.5 (Windows build released 2026-09-14)
- Platforms: Windows, macOS
- License: GPL-3.0 (https://github.com/mullvad/mullvadvpn-app/blob/HEAD/LICENSE.md)
- Price: Free and open source
- Website: https://mullvad.net/
- Support: https://mullvad.net/help

- winget ID: MullvadVPN.MullvadVPN
- Homebrew cask: mullvad-vpn
- Verification: level 1 — Hashes re-computed from the publisher’s download: 3 of 3 installers match the upstream manifest. Checked by Cristian Gonzalez Guasch.
- Source (Windows): winget-pkgs @ daa8e01ceef83af56e6a91c8cb96a24bf9cef073 — https://github.com/microsoft/winget-pkgs/tree/daa8e01ceef83af56e6a91c8cb96a24bf9cef073/manifests/m/MullvadVPN/MullvadVPN
- Source (macOS): Homebrew cask @ 22c8896870af32f439206f991b2b6b9b281dafa6 — https://github.com/Homebrew/homebrew-cask/blob/22c8896870af32f439206f991b2b6b9b281dafa6/Casks/m/mullvad-vpn.rb

## Overview

Mullvad is an open-source commercial virtual private network service based in Sweden.

## Windows

### What the installer does
- Delivered as an NSIS (Nullsoft) setup program (.exe) for x64 and ARM64.
- Installs for all users on the PC, which normally requires administrator rights.
- No custom silent switch is declared; winget falls back to its default for this installer type (`/S`).
- Declared install modes: interactive and silent.
- Shows up in Windows “Installed apps” as “Mullvad VPN 2026.5”.
- Upgrades install over the existing version.

### Versions (newest first)

#### 2026.5 — 2026-09-14

- x64 nullsoft (machine): MullvadVPN-2026.5_x64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2026.5/MullvadVPN-2026.5_x64.exe
  - sha256: 2a3efc4de6a97a2ea1c034ea617c699c5c94b8006d24beece7508d3443b760d5
- arm64 nullsoft (machine): MullvadVPN-2026.5_arm64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2026.5/MullvadVPN-2026.5_arm64.exe
  - sha256: 43d15a32dd7ce6feeb64aa573a4a76b41e818877e25533787e9be04c6b8a3f4a
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2026.4: Added - Add explicit log levels for mullvad log set-level command: off, error, warn, info, debug and trace. Changed - Do not show dialog when rendering the map fails due to disabled GPU acceleration. - Clicking on the tray icon will toggle the window instead of just showing it. - Old mullvad log set-level command has been renamed to mullvad log set-rust-log. Linux - Make all timestamps embedded in .deb and .rpm packages deterministic by deriving them from the git commit being built instead of the time of the build. Required for reproducible builds. - Set the BUILDHOST header of .rpm packages to a fixed value instead of the hostname of the build machine. Required for reproducible builds. - De-couple mullvad-daemon.service "After=" dependencies from systemd.resolved and NetworkManager. - Start mullvad-early-boot-blocking.service before network-pre.target instead of basic.target. Windows - Sign the uninstaller, Electron binaries, and native modules. Some NSIS binaries are still unsigned. - Switch winreg out for windows_registry. - Add timeout to device cleanup tasks during installs. - Increase timeout on flushing DNS cache. Removed Windows - Stop removing leftover Wintun adapters during installation. Wintun dropped support for adapter pools, so this has not been necessary since 2022.5-beta1. Fixed - Reject invalid DAITA fraction limits in tunnel config responses before starting the tunnel. - Ignore DAITA tunnel config responses unless DAITA was requested. - Fix infinite loop of account checks when account ran out of time. - Fix IPv6 obfuscation relay selection when the relay's WireGuard endpoint only has IPv4. - Fix the device sometimes being incorrectly marked as revoked when the API rejects an expired access token. - Fix daemon crashing on startup when migrating settings that contain no WireGuard entry location. Windows - Preserve the app's own theme colors when Windows high contrast (forced-colors) mode is enabled in order to prevent toggle switches and other custom-styled controls from becoming invisible. - Fix the installer UI from looking blurry by making the installer DPI-aware. - Wait for the tunnel routes to become usable, and retry the connection to the tunnel config service if the tunnel is not ready yet. This may help with connection failures that occur immediately after the tunnel is set up, when using quantum-resistant tunnels or DAITA.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2026.5 --exact`

#### 2026.4 — 2026-08-17

- x64 nullsoft (machine): MullvadVPN-2026.4_x64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2026.4/MullvadVPN-2026.4_x64.exe
  - sha256: 69e5aff2ca2e1ce954358a2b2dab2f33d4c29098da853ce9824ccf3aef9073c3
- arm64 nullsoft (machine): MullvadVPN-2026.4_arm64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2026.4/MullvadVPN-2026.4_arm64.exe
  - sha256: 8d2593bac4878fe6ea14e0f8b0b6e04239c36ff9506603e5f847245d27a2d2f2
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2026.3: Added - Add Ukrainian as a new language in the app. - installer-downloader logs are aggregated by mullvad-problem-report. Changed - Update gotatun to 0.8.1. Windows - Update wireguard-nt to version 1.1. This retires the Mullvad fork at https://github.com/mullvad/wireguard-nt. macOS - Use arch-specific installers to deliver updates. This makes updates around 50% smaller. Fixed - Align ciphers for custom shadowsocks API access methods between clients and mullvad-daemon. Any existing, invalid access method is removed with a settings migration. macOS - Fix split tunneling related parse error on macOS 27. Linux - Fix issue where gotatun would fail to start on Linux systems where the IPv6 stack had been disabled. Windows - Fix misleading "split tunneling" error when offline. - Fix unhandled error: "Reached the end of the file. (os error 38)" Security - Linux and macOS: Fix management interface socket being created with less restrictive permissions when using MULLVAD_MANAGEMENT_SOCKET_GROUP. This addresses the advisory GHSA-p9rr-wc9m-qmwg. Linux - Plug hole in Custom DNS firewall rules for LAN resolvers.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2026.4 --exact`

#### 2026.3 — 2026-06-15

- x64 nullsoft (machine): MullvadVPN-2026.3_x64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2026.3/MullvadVPN-2026.3_x64.exe
  - sha256: e335507b948083100b54f8000ef5bb733e3ee959f8df6a573e9404c506cb139a
- arm64 nullsoft (machine): MullvadVPN-2026.3_arm64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2026.3/MullvadVPN-2026.3_arm64.exe
  - sha256: adc84e88313998023ef854cb4c9584d9be0c6771d28a5c5e215261afb77ccee9
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2026.2: Added - Add port setting for LWO obfuscation. - Add list of recent server selections in the select location view. - Add context menu to locations in the select location view. - GotaTun is now used as the userspace WireGuard implementation on all desktop platforms, not just macOS. It replaces wireguard-go. Changed - Optimize LWO performance. This gives a 1.5 to 3 times speedup in our benchmarks. - Change default retry connection attempts. LWO is now the third default constraint. The relative order among the following constraints is preserved. Linux - Switch memory allocator to jemalloc to reduce fragmentation. - mullvad-early-boot-blocking.service now waits for local file system to be mounted (After=local-fs.target). This was assumed before, but not required (and is still not required). - mullvad-daemon now installs the same shutdown handler for SIGHUP as SIGINT and SIGTERM. - mullvad-daemon now exits without tearing down firewall rules on SIGUSR1. This is used to avoid leaking network traffic when restarting systemd service. macOS - Restart the GUI after an update if it was running. - mullvad-daemon now installs the same shutdown handler for SIGHUP as SIGINT and SIGTERM. Fixed - Fix duplicate "Connected"/"Disconnected" desktop notifications caused by the daemon sending multiple consecutive tunnel state events for the same state. - Fix GUI appearing stuck in "Disconnecting" state when daemon transitions directly from error to disconnected. - Fix QUIC obfuscation not always being used if relays only had IPv6 addresses for QUIC. - Fix a bug with Shadowsocks-based API access methods where some ciphers were configurable by Mullvad VPN clients while not being supported by the system service. - Fix IPv6 addresses not being allowed as endpoints for Socks5 and Shadowsocks API access methods. Linux - Fix 'mullvad split-tunnel clear' getting stuck. Windows - Fix potential access violation during cleanup on ARM64. - Fix conflicts caused by some other VPN clients that depend on Mullvad's split tunnel driver. Note that split tunneling still cannot be used simultaneously in different clients. - Fix timeout when loading split tunnel driver during boot. Security - Remove ability for renderer process to execute arbitrary binaries. This is a defence-in-depth measure to ensure that the renderer process does not have any capabilities beyond that of a regular user of the app. Affects platforms with the in-app updates feature, i.e. macOS and Windows. Fixes GHSA-h72f-j6r4-c3jc

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2026.3 --exact`

#### 2026.2 — 2026-04-28

- x64 nullsoft (machine): MullvadVPN-2026.2_x64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2026.2/MullvadVPN-2026.2_x64.exe
  - sha256: 8b6da422b19eaeb55588454092b7065deaae782fef2b0db31c1df57fea3b2222
- arm64 nullsoft (machine): MullvadVPN-2026.2_arm64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2026.2/MullvadVPN-2026.2_arm64.exe
  - sha256: 8cfbfe645abafd384188ec034d451ec5959d8191c599b0aa1cf58b51b367cc9d
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2026.1: Added Linux - Make it possible to build for RISC-V from source. - Add --daemon-only build option for deb and rpm packages for CLI usage. Changed - Location setting no longer defaults to Sweden, instead it uses your current location if it has available relays, and falls back to Sweden otherwise. - mullvad-daemon now defaults to ERROR log level when -v is not specified. mullvad-daemon -vv is used in system services to maintain previous DEBUG log level. - Update GotaTun from version 0.2.0 to 0.5.1. This improves compliance with the WireGuard spec by adding handshake jitter and implementing padding to multiples of 16 bytes, fixes a minor vulnerability when generating peer indices, and fixes another when registering incoming decoy packets for DAITA. - Disable SNI for Mullvad API traffic. This prevents DPI based on domain name when obfuscation is disabled. - Redact other users' home paths in logs. macOS - GotaTun is now used as the WireGuard implementation. It replaces wireguard-go. Fixed Windows - Fix regression in 2026.1 that could cause split tunneling to become unavailable. Security macOS - Mitigate multiple local privilege escalation attacks from admin user to root in the preinstall and postinstall scripts.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2026.2 --exact`

#### 2026.1 — 2026-03-16

- x64 nullsoft (machine): MullvadVPN-2026.1_x64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2026.1/MullvadVPN-2026.1_x64.exe
  - sha256: 37b809fdb44f3823c0981d2a2400a3c0653a50d50d213b08dd667077eea7fcc1
- arm64 nullsoft (machine): MullvadVPN-2026.1_arm64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2026.1/MullvadVPN-2026.1_arm64.exe
  - sha256: 7633f266ce3796dc8af7736821845acf6528203f310a145f63adef3e86a1fd14
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2025.14: Changed - Change WireGuard port to no longer affect the port used for LWO. - Change Mullvad Bridges access method to randomly pick any Mullvad-owned bridge. Previously the access method was constrained to the five bridges closest to the exit relay. - Changed CLI command mullvad obfuscation to mullvad anti-censorship - The tunnel setup will not error out if sending ICMP is prohibited by the operating system. Linux - Change "Go back" keyboard shortcut from Esc to Alt + Left Arrow or Alt + [. - Use Wayland by default on Linux if available, otherwise fall back to X11. macOS - Change "Go back" keyboard shortcut from Esc to Cmd + Left Arrow or Cmd + [. Windows - Change "Go back" keyboard shortcut from Esc to Alt + Left Arrow or Alt + [. - Make Mullvad service run in case the split tunnel driver fails to load. Fixed - Fix "Time left" label in main view not updating when time passes. Windows - Update split tunnel driver to 1.2.5.0. This fixes audit issue MLLVD-CR-24-102, and a BSOD when the driver was improperly unloaded. - Detect and kill processes preventing updates. macOS - Ignore utun interfaces when figuring out default routes. This prevents split tunneling from failing when running some other software. Security Windows - Warn user before clearing firewall rules during failed downgrades. This fix only applies to downgrades to this version and future versions.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2026.1 --exact`

#### 2025.14 — 2025-12-09

- x64 nullsoft (machine): MullvadVPN-2025.14_x64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.14/MullvadVPN-2025.14_x64.exe
  - sha256: 332a1f05bc367a199f0a17fb1e19d3ffcbf79a5024bced619c9e771d31281830
- arm64 nullsoft (machine): MullvadVPN-2025.14_arm64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.14/MullvadVPN-2025.14_arm64.exe
  - sha256: 4e08b1aa64aa9cde1a7290705a337b50b58d3a7cc4c317a979fd9507ee308309
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2025.13: [2025.14] - 2025-12-09 This release is identical to 2025.14-beta3. [2025.14-beta3] - 2025-12-01 Fixed - Fix a regression introduced in 2025.14-beta1 where the WireGuard port selection was not respected. [2025.14-beta2] - 2025-11-26 Added - Add port 443 to list of valid UDP2TCP ports. Fixed - Fix issues where the in-app updates view is not in sync with the daemon after system is supended or daemon is restarted. [2025.14-beta1] - 2025-11-11 Changed - Change mullvad reconnect to print an error message and exit with a non-zero exit code if issued in the disconnected state. - Move settings in WireGuard settings view into the VPN settings view. - Rename Enable IpV6 setting to In-tunnel IPv6. - Rename IP version setting to Device IP version. - Merge Obfuscation settings and WireGuard port setting into new Anti-censorship view. Removed - Remove OpenVPN support from the app. - See blog post for more info: https://mullvad.net/en/blog/removing-openvpn-15th-january-2026 - Remove "Automatic" as a setting for the "Quantum-resistant tunnel" option.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2025.14 --exact`

#### 2025.13 — 2025-11-10

- x64 nullsoft (machine): MullvadVPN-2025.13_x64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.13/MullvadVPN-2025.13_x64.exe
  - sha256: b7fe9b230b00486adde57bb94953c8370b01bdd65d8a5ec4b68e8bf79134c5a9
- arm64 nullsoft (machine): MullvadVPN-2025.13_arm64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.13/MullvadVPN-2025.13_arm64.exe
  - sha256: 000fc3122bdbdb0c0e31d9e4f7a56ceb9b883905f2e55ae58a0a933e2ecde610
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2025.12: Added - Add settings reset command to the CLI ('mullvad reset-settings'). - Make feature indicators in connection panel navigate to the relevant setting when clicked. - Add Lightweight WireGuard Obfuscation method (LWO). This is a cheap obfuscation method that prevents packets from being identified as standard WireGuard packets. - Add possibility to manage devices from account view. Changed - Add validation for API access methods to only allow unique names. Access methods with duplicated names will be renamed. - Change how externally triggered navigation is handled in the UI. This could potentially reduce issues where users get stuck in the out-of-time view. - Update Electron from 36.5.0 to 37.6.0. - Run version check hourly and when interacting with the app instead of once per day. - Add support for gradual rollouts of new app releases Fixed - Fix bug introduced in 2025.13-beta1 with translations sometimes not being formatted correctly. macOS - Fix high CPU usage on macOS 26 by updating Electron. This affected the app when it was visible. Linux - Install AppArmor profile on all Linux distributions that support AppArmor abi 4.0.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2025.13 --exact`

#### 2025.12 — 2025-10-20

- x64 nullsoft (machine): MullvadVPN-2025.12_x64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.12/MullvadVPN-2025.12_x64.exe
  - sha256: dc97425252f71d83a9ebcd9f4123ffe53469e4bfadc9ea8c17448796b587a41b
- arm64 nullsoft (machine): MullvadVPN-2025.12_arm64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.12/MullvadVPN-2025.12_arm64.exe
  - sha256: cf4f5fa4e4405fc2ac12fbedb24996751242964ddcd7663d6a6671d012a1d28a
Release notes: This release is for Windows only. This release is based on 2025.10 with the addition of a fix for a BSOD that some users experienced. Here is a list of all changes since last stable release 2025.11: Added - Add helpful warnings when clearing account history. This helps users not lose their account numbers. Windows - Add additional logging for tunnel devices and split tunneling to problem reports. - Log WFP sessions when transaction lock timeout occurs. Changed - Move placement of login button from inside the account number input to under account number. Windows - Implement UDP GSO for QUIC on client socket. This improves download speeds slightly. Fixed - Fix version being labeled unsupported unexpectedly. So far, this only an issue when using development builds. - QUIC obfuscation only using one in-address when connecting. It will now randomly select one of the available in-addresses for each connection attempt. - quinn_udp crate flooding mullvad-daemon.log with warnings. Windows - Mitigate BSOD caused by split tunnel driver during boot. macOS - Fix apps attempting to use IPv6 with in-tunnel IPv6 disabled. - Re-add missing loopback alias if removed. This fixes some issues with DNS resolution. Security Windows - Block traffic to exit node from non-Mullvad processes. This fixes a leak where traffic could be encrypted once, but leave the entry node unencrypted, if and only if the destination were the exit node. E.g., this might occur if a browser tries to open a TCP connection to the exit node IP.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2025.12 --exact`

#### 2025.11 — 2025-10-13

- x64 nullsoft (machine): MullvadVPN-2025.11_x64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.11/MullvadVPN-2025.11_x64.exe
  - sha256: 67574ec4da45fcd5fdab247c49c9d52ad5d97cfeda3b5aa1e928887075150d8f
- arm64 nullsoft (machine): MullvadVPN-2025.11_arm64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.11/MullvadVPN-2025.11_arm64.exe
  - sha256: d233255fd9bbaf21fe54249db2d357e86520f107bebaab159516939b2b5d030e
Release notes: This release is for desktop only. Here are the changes since last stable release 2025.10: This release is for Windows only. This release reverts all functionality to how the app worked in version 2025.9 to fix a BSOD (boot loop) bug. Only a few users experienced the issue, but we deemed it critical enough to revert everything until we have a better understanding of the problem.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2025.11 --exact`

#### 2025.10 — 2025-10-09

- x64 nullsoft (machine): MullvadVPN-2025.10_x64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.10/MullvadVPN-2025.10_x64.exe
  - sha256: 8ff38df303446fd5a27ef30bd31444a358dbdd505f0f564437877ddbb29f5427
- arm64 nullsoft (machine): MullvadVPN-2025.10_arm64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.10/MullvadVPN-2025.10_arm64.exe
  - sha256: 874a8ca06cf8410de55c79aed645b67249751fe16ec2fea6cda291a18dbb9679
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2025.9: Added - Add helpful warnings when clearing account history. This helps users not lose their account numbers. Windows - Add additional logging for tunnel devices and split tunneling to problem reports. - Log WFP sessions when transaction lock timeout occurs. Changed - Move placement of login button from inside the account number input to under account number. Windows - Implement UDP GSO for QUIC on client socket. This improves download speeds slightly. Fixed - Fix version being labeled unsupported unexpectedly. So far, this only an issue when using development builds. - QUIC obfuscation only using one in-address when connecting. It will now randomly select one of the available in-addresses for each connection attempt. - quinn_udp crate flooding mullvad-daemon.log with warnings. macOS - Fix apps attempting to use IPv6 with in-tunnel IPv6 disabled. - Re-add missing loopback alias if removed. This fixes some issues with DNS resolution. Security Windows - Block traffic to exit node from non-Mullvad processes. This fixes a leak where traffic could be encrypted once, but leave the entry node unencrypted, if and only if the destination were the exit node. E.g., this might occur if a browser tries to open a TCP connection to the exit node IP.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2025.10 --exact`

#### 2025.9 — 2025-09-05

- x64 nullsoft (machine): MullvadVPN-2025.9_x64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.9/MullvadVPN-2025.9_x64.exe
  - sha256: fefa3b6337954746aa692f911bb768e771f3757a32e0196c75608efb835359b6
- arm64 nullsoft (machine): MullvadVPN-2025.9_arm64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.9/MullvadVPN-2025.9_arm64.exe
  - sha256: 183c6290e11c8c6879c7796247d0a9b3a0f99ccf5a75bdd2fd8034d6592ebf42
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2025.8: Added - Add QUIC obfuscation (WireGuard only). It will be used automatically when connecting fails with other methods. Fixed macOS - Add support for parsing eslogger output version 10. This fixes split tunneling on macOS 26. - Avoid interpreting negative numbers from eslogger as PIDs.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2025.9 --exact`

#### 2025.8 — 2025-08-14

- x64 nullsoft (machine): MullvadVPN-2025.8_x64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.8/MullvadVPN-2025.8_x64.exe
  - sha256: 4bafa476fe149a642e59811d034ac2fc1cc39b01f650b7774b2cbb81086feb10
- arm64 nullsoft (machine): MullvadVPN-2025.8_arm64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.8/MullvadVPN-2025.8_arm64.exe
  - sha256: d31187b581564be16e6552fda584126a7c410e3f6809d4ded7b807f685c8a20b
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2025.7: Added - Add in-app updates to Windows and macOS. This new feature lets you download, verify, and install new versions from within the app. Linux - Make it possible to run the app with cgroups v1 fully disabled. Note that split tunneling is currently unavailable when this is the case. Windows - Add a button to start the Mullvad VPN system service if it's unavailable at launch Changed macOS - Use a local DNS resolver on the 127.0.0.0/8 network, regardless of macOS version. Windows - Make firewall rules applied while upgrading the app not persist on reboot, unless "Lockdown mode" or "Auto-connect along with "Launch app on start-up" is enabled. This serves as a safety fallback if the update fails and the user is left with blocking firewall rules and no app. Fixed macOS - Add grace period when best default route goes away to reduce frequency of random reconnects. Security - Prevent unprivileged users from impersonating the gRPC server. This was relatively harmless previously but is required due to in-app updates. Windows - Enable control flow integrity checks (CFG) for some C++ code. This excludes wintun, wireguard-nt, and OpenVPN. This addresses MLLVD-CR-24-101 to the extent that we found it valuable.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2025.8 --exact`

#### 2025.7 — 2025-06-24

- x64 nullsoft (machine): MullvadVPN-2025.7_x64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.7/MullvadVPN-2025.7_x64.exe
  - sha256: 5a54a0fb4ff81263c68c3f3a7d16d7b6403481bbdf80ce9e3b7db3ef350be51c
- arm64 nullsoft (machine): MullvadVPN-2025.7_arm64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.7/MullvadVPN-2025.7_arm64.exe
  - sha256: e67932f4dfb7862568294a3d2aadb14340052faf3cec6508c0cbb86281a625ba
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2025.6: Added - Add notification that shows when the user is connected to WireGuard with a port that is not supported. Linux - The deb package repositores now have static codenames on top of the existing distro version specific codenames. The stable repository always have the "stable" codename, and the beta repository has the "beta" codename. Changed - Replace Classic McEliece with HQC as one of the post-quantum safe key exchange mechanisms used for the quantum-resistant tunnels. The main benefits here are that HQC uses a lot less CPU to compute the keypair, and the public key sent to the server is drastically smaller. Fixed - Automatically connect when IP version becomes available. Linux - Fix syntax error in Apparmor profile. - Fix issue where settings were lost after an upgrade if mullvad-daemon was not restarted before mullvad-early-boot-blocking.service. That is, before a reboot. Windows - Fix issue where daemon got stuck trying to connect only over IPv4 (or only IPv6). macOS - Fully uninstall the app when it is removed by being dropped in the bin. Security macOS - Fix potential local privilege escalation when app was incorrectly removed by being dropped in the bin but still leaving behind a launch daemon. This fixes CVE-2025-46351 reported by Egor Filatov (Positive Technologies).

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2025.7 --exact`

#### 2025.6 — 2025-05-19

- x64 nullsoft (machine): MullvadVPN-2025.6_x64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.6/MullvadVPN-2025.6_x64.exe
  - sha256: 3f7a160bfb26a4f20c17c933c031cc9fb363159788abab2738d45bf88b1e8ab6
- arm64 nullsoft (machine): MullvadVPN-2025.6_arm64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.6/MullvadVPN-2025.6_arm64.exe
  - sha256: c4d4b6405ddc19f0a27fb43718224d2fba25399fc212bf9f71a7a2db937b32cc
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2025.5: Added - Add a notification for notifying users about the sunsetting of OpenVPN. Changed Windows - Rename win-shortcuts native module to windows-utils. Removed - Remove "Automatic" option for tunnel protocol. The default is now WireGuard. Fixed - Fix mullvad-cli panicking if it tried to write to a closed pipe on Linux and macOS. - Fix bug where new users are not forwarded to the main view after payment. - Will no longer try to connect over IPv4 if IPv4 is not available. Windows - Fix error setting up tunnel when MTU was incorrectly set to a value below 1280 for IPv6. - Fix node native module being unpacked to a temporary folder. - Fix BSOD caused by routing loop in wireguard-nt. macOS - Fix bug in parsing of network services from SCDynamicStore.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2025.6 --exact`

#### 2025.5 — 2025-03-26

- x64 nullsoft (machine): MullvadVPN-2025.5_x64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.5/MullvadVPN-2025.5_x64.exe
  - sha256: 50b7715223397942c16636bf2c0bb17dd6b030e80b9540b14a207283a3f1a441
- arm64 nullsoft (machine): MullvadVPN-2025.5_arm64.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.5/MullvadVPN-2025.5_arm64.exe
  - sha256: fa4c9e96cfe7ad09fa13ac417c48723eef67ca0666d048edf2a597e3d654cbae
Release notes: This release is for desktop only. This release is identical to 2025.5-beta1: Here is a list of all changes since last stable release 2025.4: Added Windows - Add support for DAITA V2. - Add back wireguard-go (userspace WireGuard) support. Removed - Stop bundling https://github.com/mullvad/apisocks5 as a standalone binary. Fixed macOS - Fix daemon ending up in blocked state if the user toggled split tunneling without having granted Full Disk Access to mullvad-daemon. This could only ever be accomplished from the CLI. - Fix routing issue caused by upgrading tun. Removed - Remove Google's resolvers from encrypted DNS proxy.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2025.5 --exact`

#### 2025.4 — 2025-02-13

- x64 nullsoft (machine): MullvadVPN-2025.4.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.4/MullvadVPN-2025.4.exe
  - sha256: 050b09be6733c7c48a30e245e634ba0cdc41625488188ffce90d167379e8a400
Release notes: This release is for desktop only. This release is identical to 2025.4-beta1. Here is a list of all changes since last stable release 2025.3. Fixed Windows - Fix GUI crashing at launch on some systems.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2025.4 --exact`

#### 2025.3 — 2025-02-07

- x64 nullsoft (machine): MullvadVPN-2025.3.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.3/MullvadVPN-2025.3.exe
  - sha256: 1eae931e3016de17839c04c95d9398ab0571f8748e61800e053d92d9c519259b
Release notes: This is a desktop only release. Here is a list of all changes since last stable release 2025.2. Added Windows - Add support for Windows ARM64. Changed - (Linux and macOS only) Update to DAITA v2. The main difference is that many different machines are provided by relays instead of a bundled list. The bundled `maybenot_machines` file was removed. - Move changelog from a dialog to a separate view. - Reduce the setup time of PQ tunnels by pre-computing McEliece keys. - Change order of items in settings view to show DAITA and multihop at the top. - Update Electron from 30.0.4 to 33.4.0. Fixed - (macOS and Windows only) Add the correct route when using obfuscation with Wireguard.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2025.3 --exact`

#### 2025.2 — 2025-01-08

- x64 nullsoft (machine): MullvadVPN-2025.2.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.2/MullvadVPN-2025.2.exe
  - sha256: f4b25713d13f2819a300f2ffa94d967463aaeea0d357fbd7479a281154ba0460
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2025.1. Fixed - Fix crash when Wireguard tunnel setup timed out.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2025.2 --exact`

#### 2025.1 — 2025-01-02

- x64 nullsoft (machine): MullvadVPN-2025.1.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2025.1/MullvadVPN-2025.1.exe
  - sha256: 0afc854ac421f174ff9696e8e1665b4e4bf0fd53de97b9c116ac65d90ab08ff9
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2024.8. Added - Add a new access method: Encrypted DNS Proxy. Encrypted DNS proxy is a way to reach the API via proxies. The access method is enabled by default. macOS - Detect whether full disk access is enabled in the split tunneling view. - Add button to restart system service in split tunneling view. This can help mitigate edge-case issues when enabling full disk access. Changed - Replace the draft key encapsulation mechanism Kyber (round 3) with the standardized ML-KEM (FIPS 203) dito in the handshake for Quantum-resistant tunnels. - Make Smart Routing override multihop if both are enabled. To manually set the entry relay, explicitly enable the "Direct only" option in the DAITA settings. - Update maybenot from 1.1.3 to 2.0.1. Windows - Enable quantum-resistant tunnels by default (when set to `auto`). Fixed - Handle network switching better when using WG over Shadowsocks. - Fix multihop entry location list sometimes being shown when multihop is disabled. macOS - Fix GUI getting stuck when opening the split tunneling view. - Fix packets being duplicated on LAN when split tunneling is enabled. - Fix DNS issues caused by forcibly using a local DNS resolver in all states. Note that this fix is not present on macOS versions between 14.6 and 15.1. Security Windows - Block WSL/Hyper-V traffic in secured states (except the connected state). The normal firewall (WFP) filters normally do not apply for VMs. This mitigates the issue by ensuring that it does not leak (as easily) when the VPN tunnel is up. Previously, WSL would leak while in the blocked or connecting state, or while lockdown mode was active.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2025.1 --exact`

#### 2024.8 — 2024-12-04

- x64 nullsoft (machine): MullvadVPN-2024.8.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2024.8/MullvadVPN-2024.8.exe
  - sha256: 15ea8cbbec3b24f6422610af288d0f5972ea37224b415ad6a160cdec1bf2eb1a
Release notes: This release is for desktop only.This release addresses issues identified in a recent audit. Here is a list of all changes since last stable release 2024.7.Security - Remove invalidly set up alternative stack for fault signal handlers on unix based systems. This prevents potential stack overflow and heap memory corruption. Fixes audit issue MLLVD-CR-24-01. - Remove/disable not signal safe code from fault signal handler on unix based systems. Fixes audit issue MLLVD-CR-24-02. Windows - Fix issue where the installer would allow any executable named taskkill.exe in the working directory to run as admin. This fixes audit issue MLLVD-CR-24-06. Linux - Prevent attackers able to send ARP requests to the device running Mullvad from figuring out the in-tunnel IP. Fixes 2024 audit issue MLLVD-CR-24-03.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2024.8 --exact`

#### 2024.7 — 2024-10-30

- x64 nullsoft (machine): MullvadVPN-2024.7.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2024.7/MullvadVPN-2024.7.exe
  - sha256: e719430f68e1e9c0e755f9babd0f070b41a3887acc0ea81f259a8d29b2832452
Release notes: This release is for desktop only. This release is identical to 2024.7-beta1. Here is a list of all changes since last stable release 2024.6. Fixed macOS - Fix DNS not working due to broken PF redirect.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2024.7 --exact`

#### 2024.6 — 2024-10-09

- x64 nullsoft (machine): MullvadVPN-2024.6.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2024.6/MullvadVPN-2024.6.exe
  - sha256: 594793308de26031dc79e56275f73ea31cb46e68d033a1a67cd44702cf080b61
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2024.5. Added - Add WireGuard over Shadowsocks obfuscation. It can be enabled in "WireGuard settings". This will also be used automatically when connecting fails with other methods. - Add feature indicators to the main view along with redesigning the connection details. - Add "Smart Routing" feature which simplifies connecting to DAITA-enabled relays. Changed - Never use OpenVPN as a fallback protocol when any of the following features is enabled: multihop, quantum-resistant tunnels, or DAITA. - Improved output format of mullvad status command, which now also prints feature indicators. - Move DAITA and multihop to the root settings view along with moving multihop into a dedicated view with more information. macOS - Disable split tunnel interface when disconnected. This prevents traffic from being sent through the daemon when the VPN is disconnected. - Enable IPv6 by default. This fixes DNS and routing being broken on some systems. - Proxy DNS queries through a local resolver. Fixed Linux - Set tunnel name to `wg0-mullvad` for userspace WireGuard. macOS - Exclude programs when executed using a relative path from a shell. - Reduce packet loss when using split tunneling. - Don't block fragmented packets in the PF firewall. Fixes various issues relating to connecting (and general instability) when IP fragmentation is present. - Fix Apple services not working by forcing stray connections out through the VPN tunnel. This fix only applies to Wireguard, OpenVPN is still affected. - Disable DNS redirect when custom DNS is set to localhost.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2024.6 --exact`

#### 2024.5 — 2024-09-03

- x64 nullsoft (machine): MullvadVPN-2024.5.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2024.5/MullvadVPN-2024.5.exe
  - sha256: 5411fef047adadb03e49ab2b9f5b5efd0b1ab4f8c544dd4842582444895462c8
Release notes: This release is for desktop only. Here is a list of all changes since last stable release 2024.4. Added - Add DAITA (Defence against AI-guided Traffic Analysis) setting for Linux and macOS. - Add --json flag to mullvad status CLI. Changed - Ignore obfuscation protocol constraints when the obfuscation mode is set to auto. macOS - Enable quantum resistant tunnels by default (when set to auto). Fixed - Fix mullvad cli bug causing mullvad status listen command to miss events if they occurred too quickly. - Fix bug causing app to enter blocked state when toggling DAITA on and off. - macOS and Linux: Fix potential crash when disconnecting with DAITA enabled. macOS - Fix intermittent failures to connect with PQ enabled.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2024.5 --exact`

#### 2024.4 — 2024-07-25

- x64 nullsoft (machine): MullvadVPN-2024.4.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2024.4/MullvadVPN-2024.4.exe
  - sha256: 40b6c1d8cb9259d944c737d9e3cdb483bf425335069fd2685cf13629334cc938
Release notes: This release is for desktop only. This release is identical to 2024.4-beta1. Here is a list of all changes since last stable release 2024.3. Added - Add custom bridge settings in GUI. A custom bridge server can be used to cirvunment censorship when regular Mullvad bridge servers don't work - Bundle https://github.com/mullvad/apisocks5 as a standalone binary. macOS - Add support for split tunneling. Changed - Update Electron from 28.1.3 to 30.0.4. Fixed Windows - Fix a race condition which could cause a BSOD when DAITA was enabled during disconnects.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2024.4 --exact`

#### 2024.3 — 2024-05-15

- x64 nullsoft (machine): MullvadVPN-2024.3.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2024.3/MullvadVPN-2024.3.exe
  - sha256: 58019eafc12f0a922577f511c489d3412c2857475789c407e08a2c8e71194dd7
Release notes: This release is for desktop only. This release is identical to 2024.3-beta1. Here is a list of all changes since last stable release 2024.2. Added Windows - Add DAITA (Defence against AI-guided Traffic Analysis) setting. On supported servers, this makes website fingerprinting more difficult by sending random padding packets along with padding all packets to the same size. Changed - Don't fail to start daemon when the offline monitor fails to be initialized. Fixed Linux - Fix GUI not working on Ubuntu 24.04 by adding an AppArmor profile. - Service failed to start when IPv6 was disabled in the kernel.

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2024.3 --exact`

#### 2024.2.0

- x64 nullsoft (machine): MullvadVPN-2024.2.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2024.2/MullvadVPN-2024.2.exe
  - sha256: d17b57268c3776c9e72dc5d1cb56d1eaf5e07003270c4b696b53ba70a8668bf6

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2024.2.0 --exact`

#### 2024.1.0

- x64 nullsoft (machine): MullvadVPN-2024.1.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2024.1/MullvadVPN-2024.1.exe
  - sha256: 49ee14871a1efab88921c1338349d40a732d4fb8c370eaa5047676ac5906768f

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2024.1.0 --exact`

#### 2023.6.0 — 2023-12-06

- x64 nullsoft (machine): MullvadVPN-2023.6.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2023.6/MullvadVPN-2023.6.exe
  - sha256: 1a212857d3edcfe44cfdf0ac50db27a1fb325721f7fd9aa9a1e8fcc8b4bda64c
Release notes: Added - Add customizable relay lists to the CLI on desktop. Custom lists can be managed through - Add custom lists to location selector in desktop app. - Add custom API access methods to the CLI on desktop. Custom API access methods allow the user to - Add social media content blocker. - Add ability to override server IPs to the CLI. Changed - Update Electron from 25.2.0 to 26.3.0. - Update OpenVPN to 2.6.8 from 2.6.0. Linux - Don't block forwarding of traffic when the split tunnel mark (ct mark) is set. Removed Windows - Remove wireguard-go (userspace WireGuard) support. Fixed - Show correct endpoint in CLI for custom relays. - Lower risk of being rate limited. - Fix error dialog when failing to write to console by handling the thrown error. - Fix error dialog displayed when the daemon was killed. - Fix desktop app freezing when navigations occur in very quick succession. Windows - Correctly detect whether OS is Windows Server (primarily for logging in daemon.log). Security - Update OpenVPN to 2.6.8 to fix CVE-2023-46850, which could cause freed memory to be sent to the peer. Windows - Fix possible privilege escalation by setting stricter permissions on mullvad directories such as

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2023.6.0 --exact`

#### 2023.5.0

- x64 nullsoft (machine): MullvadVPN-2023.5.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2023.5/MullvadVPN-2023.5.exe
  - sha256: 60589fcbeb1c26ec028be1ee1f1d8ee105b0262f5ec9daa841cb016c1980283d

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2023.5.0 --exact`

#### 2023.4.0

- x64 nullsoft (machine): MullvadVPN-2023.4.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2023.4/MullvadVPN-2023.4.exe
  - sha256: a3dfb832cc4d29a5e2ea70956819d4d6e6b28acf2cce4e7c40d96ad46a53c8a7

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2023.4.0 --exact`

#### 2023.3.0 — 2023-04-05

- x64 nullsoft (machine): MullvadVPN-2023.3.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2023.3/MullvadVPN-2023.3.exe
  - sha256: c05b4e02395ab29f7b8231bf251b0607d536d3f335db0e7c8cc0bf350c9e1505
Release notes: https://github.com/mullvad/mullvadvpn-app/releases/tag/2023.3

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2023.3.0 --exact`

#### 2023.2.0 — 2023-03-07

- x64 nullsoft (machine): MullvadVPN-2023.2.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2023.2/MullvadVPN-2023.2.exe
  - sha256: 78372ded0f058ea252192fd7298c38f1133a4a15e5b4736bfd8df52b6efc1b07
Release notes: https://github.com/mullvad/mullvadvpn-app/releases/tag/2023.2

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2023.2.0 --exact`

#### 2023.1.0 — 2023-02-20

- x64 nullsoft (machine): MullvadVPN-2023.1.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2023.1/MullvadVPN-2023.1.exe
  - sha256: f3a9ff35d371c58820c9dd587943caa016f936f278c8bb36cc0297663cfd6c1a
Release notes: https://github.com/mullvad/mullvadvpn-app/releases/tag/2023.1

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2023.1.0 --exact`

#### 2022.5.0 — 2022-10-14

- x64 nullsoft (machine): MullvadVPN-2022.5.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2022.5/MullvadVPN-2022.5.exe
  - sha256: ff5813895e951467e761e24d12d74f49f0b81573961b8388c305afc28c50e7c6
Release notes: https://github.com/mullvad/mullvadvpn-app/releases/tag/2022.5

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2022.5.0 --exact`

#### 2022.4.0 — 2022-08-19

- x64 nullsoft (machine): MullvadVPN-2022.4.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2022.4/MullvadVPN-2022.4.exe
  - sha256: d1e6ee73d0e5e0dc37aaddf9241f95562462886a248c714747b1dcdde3f88859
Release notes: https://github.com/mullvad/mullvadvpn-app/releases/tag/2022.4

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2022.4.0 --exact`

#### 2022.3.0

- x64 nullsoft (machine): MullvadVPN-2022.3.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2022.3/MullvadVPN-2022.3.exe
  - sha256: 5e8b760e600e05bdd0a8209c9cd687b5a11160d80b4f50fee605818d5938f983

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2022.3.0 --exact`

#### 2022.2.0 — 2022-06-13

- x64 nullsoft (machine): MullvadVPN-2022.2.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2022.2/MullvadVPN-2022.2.exe
  - sha256: cec224a4288323a54a1c12d88389c83c1ffa3cc5f604981ce396ed0e174ebd8a
Release notes: https://github.com/mullvad/mullvadvpn-app/releases/tag/2022.2

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2022.2.0 --exact`

#### 2022.1 — 2022-03-01

- x64 nullsoft (machine): MullvadVPN-2022.1.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2022.1/MullvadVPN-2022.1.exe
  - sha256: e636c12b09b5273017cf081517c069c49bad504d8f309f65c2c8a11e11293b75
Release notes: 'Here is a list of all changes since last stable release 2021.6. Added • Add information about the always on kill switch in the desktop app. • Add WireGuard multihop setting and entry location selection to desktop app. • Add malware blocking to the desktop app. Implemented via DNS on the relays. • Add changes dialog which will include the most notable changes in each new version. • Show warning message when blocking internet while logged out, and make it possible to unblock the • connection from the login view. Changed • Keep unspecified constraints unchanged in the CLI when providing specific tunnel constraints • instead of setting them to default values. • Obscure account number in account view and add button for copying instead of copying when text is • pressed. • Disable logging of translation errors in production. This will among other things prevent error • messages from translating the country in the disconnected state. • Update Electron from 15.0.0 to 16.0.4. • Gradually increase the WireGuard connectivity check timeout, lowering the timeout for the first • few attempts. • Stop preferring OpenVPN when bridge mode is enabled. • CLI command for setting a specific server by hostname is no longer case sensitive. • Example: mullvad relay set hostname SE9-WIREGUARD should now work. • Update the default Shadowsocks password to mullvad and cipher to aes-256-gcm in the CLI • when using it to configure a custom Shadowsocks bridge. The Mullvad bridges recently changed • these parameters on port 443 (which is the default port). Windows • Update wireguard-nt to 0.10.1. • Make wireguard-nt the default driver for WireGuard. This is used instead of wireguard-go and • Wintun. • Increase firewall transaction timeout from 2 to 5 seconds to lower the chance of errors when • setting the firewall policy. • Update split tunnel driver to 1.2.0.0. Notably, this driver release allows firewall filters • added by other software to block excluded apps. Removed Windows • Drop support for pre-Windows 10 systems. Fixed • Always kill sslocal if the tunnel monitor fails to start when using bridges. • Show relay location constraint correctly in the CLI when it is set to any. • Prevent gRPC from trying to run the app-daemon IPC communication through a HTTP proxy when the • environment variable http_proxy is set. This caused the app to fail to connect to the daemon. • Disable built-in DNS resolver in Electron. Prevents Electron from establishing connections to • DNS servers set in system network preferences. • Fix tray context menu showing or executing wrong actions, using wrong language or in other • ways not update properly. • Prevent settings file being truncated before being read. This caused the daemon to read an empty • settings file, restore to default settings and log out. • Improve performance for automatically scrolling text in desktop app. • Increase availability of the API by allowing to issue requests to the API when connecting to the • relay even if account data might be invalid. macOS • Resolve issues with the app blocking internet connectivity after sleep or when connecting to new • wireless networks. • Fix issue where the app would get stuck in offline state after a reboot or a reinstall by using • route monitor instead of relying on SCNetworkReachability API to infer whether the host is • offline. Windows • Fix app size after changing display scale. • Fix daemon not starting if all excluded app paths reside on non-existent/unmounted volumes. • Remove tray icon of current running app version when upgrading. • Allow Mullvad wireguard-nt tunnels to work simultaneously with other wg-nt tunnels. • Fix notifications on Windows not showing if window is unpinned and hidden. • Wait for IP interfaces to arrive before trying to configure them when using wireguard-nt. • Fix panic that occurs in the split tunnel monitor when a path consisting only of a prefix, • such as "C:", is excluded using the CLI. Linux • Remove auto-launch file, GUI settings and other files created by the app in user directories, when • uninstalling/purging. Security • Restrict which applications are allowed to communicate with the API while in a blocking state. • This prevents malicious scripts on websites from trying to do so. On Windows, only • mullvad-problem-report.exe and mullvad-daemon.exe executables are allowed to reach the API, • whereas on Linux and macOS only root processes are able to reach the API. • Enable "Always require VPN" by default if the settings cannot be parsed. This reduces the number • of errors that lead to the daemon unexpectedly starting into non-blocking mode.'

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2022.1 --exact`

#### 2021.6

- x64 nullsoft (machine): MullvadVPN-2021.6.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2021.6/MullvadVPN-2021.6.exe
  - sha256: 33a7b4fc689f2a5e9c8e9ab5eb663d86092b32d1303a615ae8c1afb106aaf99a

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2021.6 --exact`

#### 2021.5.0

- x64 nullsoft (machine): MullvadVPN-2021.5.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2021.5/MullvadVPN-2021.5.exe
  - sha256: c8de346e401df64db66d7a0b18f1ac3960461ea18840a13106d679ccb3ce3ddd

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2021.5.0 --exact`

#### 2021.4.0

- x64 nullsoft (machine): MullvadVPN-2021.4.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2021.4/MullvadVPN-2021.4.exe
  - sha256: 282e922e18599b4ae4e2eff38830345847bb01d9f1824d4e4f4c71123c23a875

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2021.4.0 --exact`

#### 2021.3.0

- x64 nullsoft (machine): MullvadVPN-2021.3.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2021.3/MullvadVPN-2021.3.exe
  - sha256: c34580a8179141ea5fa9c1502b0c0784a40e93280cdcff8912f8b3190c196a17

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2021.3.0 --exact`

#### 2021.2.0

- x64 nullsoft (machine): MullvadVPN-2021.2.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2021.2/MullvadVPN-2021.2.exe
  - sha256: a96483eecbc58da8a8dc696946300a5d6c4e8fe05f4d38ea264b41db711a77dc

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2021.2.0 --exact`

#### 2021.1.0

- x64 nullsoft (machine): MullvadVPN-2021.1.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2021.1/MullvadVPN-2021.1.exe
  - sha256: bed42a7cb009ebd027194f20940b2b9856037a0e581a9bdfaf9b325b8d2f6af3

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2021.1.0 --exact`

#### 2020.7.0

- x64 nullsoft (machine): MullvadVPN-2020.7.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2020.7/MullvadVPN-2020.7.exe
  - sha256: cb6901742cb3ad88e20b79fca1fdf569ed619ce3afa9b9709ebfb5a7eb189ad4

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2020.7.0 --exact`

#### 2020.6.0

- x64 nullsoft (machine): MullvadVPN-2020.6.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2020.6/MullvadVPN-2020.6.exe
  - sha256: 678a560487e0ab5ea7fe6459b86be1bce266fa98c438cd16a300adfb1909e374

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2020.6.0 --exact`

#### 2020.5.0

- x64 nullsoft (machine): MullvadVPN-2020.5.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2020.5/MullvadVPN-2020.5.exe
  - sha256: 13c92c77184b2a7724df55be7e4afdfa9b807c64f8c36399fc016b93b5a346bf

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2020.5.0 --exact`

#### 2020.4.0 — 2020-05-12

- x64 nullsoft (machine): MullvadVPN-2020.4.exe
  - url: https://github.com/mullvad/mullvadvpn-app/releases/download/2020.4/MullvadVPN-2020.4.exe
  - sha256: 52ecef8bab5252de60559fd02b3ce0622428607c93bc91ccf74cea5eba5c406f
Release notes: https://github.com/mullvad/mullvadvpn-app/releases/tag/2020.4

Pin: `winget install --id MullvadVPN.MullvadVPN --version 2020.4.0 --exact`

## macOS

### What the installer does
- Delivered as a macOS installer package (.pkg) for Apple silicon and Intel.
- Runs the installer package `MullvadVPN-2026.5.pkg`; package installers usually ask for an administrator password and can place files anywhere on the system.
- Requires macOS 12 or later.
- The app updates itself, so it may be newer than the version Homebrew lists.
- On uninstall, Homebrew asks the app to quit, stops background services, forgets installer package receipts, and deletes 8 extra files.
- A full “zap” removal also deletes up to 6 support, cache and preference locations in your home folder.

### Versions (newest first) — Homebrew lists only the current release

#### 2026.5

- universal pkg: MullvadVPN-2026.5.pkg
  - url: https://cdn.mullvad.net/app/desktop/releases/2026.5/MullvadVPN-2026.5.pkg
  - sha256: 7c68dd93ae01c1b56ce29c48b293a6ecb29ad61769ee90619887fa71a7dd867b

Install: `brew install --cask mullvad-vpn`