diff --git a/DISCLAIMER-WIP b/DISCLAIMER-WIP
new file mode 100644
index 0000000000..228be31c6e
--- /dev/null
+++ b/DISCLAIMER-WIP
@@ -0,0 +1,22 @@
+Apache Maka is an effort undergoing incubation at The Apache Software Foundation
+(ASF), sponsored by the Apache Incubator PMC. Incubation is required of all
+newly accepted projects until a further review indicates that the
+infrastructure, communications, and decision-making process have stabilized in a
+manner consistent with other successful ASF projects. While incubation status is
+not necessarily a reflection of the completeness or stability of the code, it
+does indicate that the project has yet to be fully endorsed by the ASF.
+
+Some of the incubating project's releases may not be fully compliant with ASF
+policy. For example, releases may have incomplete or un-reviewed licensing
+conditions. What follows is a list of issues the project is currently aware of
+(this list is likely to be incomplete):
+
+ * Source files do not yet carry Apache license headers.
+ * NOTICE has not yet been reworked into ASF form.
+ * The software grant and committer ICLAs are not yet complete.
+
+If you are planning to incorporate this work into your product/project, please
+be aware that you will need to conduct a thorough licensing review to determine
+the overall implications of including this work. For the current status of this
+project through the Apache Incubator, visit:
+https://incubator.apache.org/projects/maka.html
diff --git a/apps/desktop/electron-builder.config.mjs b/apps/desktop/electron-builder.config.mjs
index 18fb1038e9..2cabcd3ed6 100644
--- a/apps/desktop/electron-builder.config.mjs
+++ b/apps/desktop/electron-builder.config.mjs
@@ -66,6 +66,14 @@ export default {
       from: '../../NOTICE',
       to: 'licenses/maka/NOTICE',
     },
+    {
+      // Incubator policy requires every release archive to carry a DISCLAIMER
+      // or DISCLAIMER-WIP. Shipping it beside LICENSE and NOTICE is what makes
+      // the repository-root file reach the DMG, the ZIP and the Windows
+      // installer; `assertPackagedResources` then requires it on both paths.
+      from: '../../DISCLAIMER-WIP',
+      to: 'licenses/maka/DISCLAIMER-WIP',
+    },
     {
       from: '../../node_modules/electron/dist/LICENSE',
       to: 'licenses/electron/LICENSE',
diff --git a/scripts/verify-packaged-app.mjs b/scripts/verify-packaged-app.mjs
index 8b2a4d9187..1292068a66 100644
--- a/scripts/verify-packaged-app.mjs
+++ b/scripts/verify-packaged-app.mjs
@@ -299,6 +299,10 @@ export async function assertPackagedResources(
     requirePath,
     forbidPath = assertMissing,
     requireWindowsSandbox = process.platform === 'win32',
+    // The upgrade-lifecycle check runs this against a previously released
+    // build, which predates the disclaimer being packaged. Requiring it there
+    // would fail a release that was correct when it shipped.
+    requireDisclaimer = true,
   } = {},
 ) {
   const required = [
@@ -310,6 +314,7 @@ export async function assertPackagedResources(
     join('workers', 'filesystem-worker.js'),
     join('licenses', 'maka', 'LICENSE'),
     join('licenses', 'maka', 'NOTICE'),
+    ...(requireDisclaimer ? [join('licenses', 'maka', 'DISCLAIMER-WIP')] : []),
     join('licenses', 'dugite', 'LICENSE'),
     join('licenses', 'git', 'NOTICE.txt'),
     join('licenses', 'electron', 'LICENSE'),
diff --git a/scripts/verify-windows-x64.mjs b/scripts/verify-windows-x64.mjs
index ac6e1b6e0d..07c13dd881 100644
--- a/scripts/verify-windows-x64.mjs
+++ b/scripts/verify-windows-x64.mjs
@@ -97,10 +97,18 @@ export async function verifyPackagedWindowsApp(
   const appAsar = join(resources, 'app.asar');
   const sandboxExecutable = join(resources, 'windows-sandbox', 'maka-windows-sandbox.exe');
   const requireWindowsSandbox = expectedVersion === undefined;
+  // Same reason as the sandbox above: a packaged resource added after the
+  // baseline release cannot be required of that baseline.
+  const requireDisclaimer = expectedVersion === undefined;
 
   step('checking packaged resources');
   await requirePath(executable);
-  await assertPackagedResources(resources, { requirePath, forbidPath, requireWindowsSandbox });
+  await assertPackagedResources(resources, {
+    requirePath,
+    forbidPath,
+    requireWindowsSandbox,
+    requireDisclaimer,
+  });
   await requirePath(join(resources, 'git', 'cmd', 'git.exe'));
 
   step('reading the executable architecture');