diff --git a/.changeset/graceful-finches-wake.md b/.changeset/graceful-finches-wake.md
new file mode 100644
index 000000000..0a3643eac
--- /dev/null
+++ b/.changeset/graceful-finches-wake.md
@@ -0,0 +1,5 @@
+---
+type: Fixed
+pr: 4092
+---
+**`gsd-node-runner.sh` no longer triggers a permanent, unclearable "⚠ stale hooks" warning** — it was registered in `MANAGED_HOOKS` but shipped without its `gsd-hook-version` header, so up-to-date installs always flagged it as stale.
diff --git a/hooks/gsd-node-runner.sh b/hooks/gsd-node-runner.sh
index 77910efaa..787fae064 100755
--- a/hooks/gsd-node-runner.sh
+++ b/hooks/gsd-node-runner.sh
@@ -1,4 +1,5 @@
 #!/bin/sh
+# gsd-hook-version: {{GSD_VERSION}}
 # gsd-node-runner.sh — GSD portable node resolver (#3662).
 #
 # Managed JS hook commands under --portable-hooks route through this script:
diff --git a/scripts/build-hooks.js b/scripts/build-hooks.js
index 228d9aab9..59e4a97e3 100644
--- a/scripts/build-hooks.js
+++ b/scripts/build-hooks.js
@@ -71,10 +71,15 @@ const HOOKS_TO_COPY = [
   'gsd-session-state.sh',
   'gsd-validate-commit.sh',
   'gsd-phase-boundary.sh',
-  // Portable node resolver (#3662). Not a registered hook itself: managed JS
-  // hook commands under --portable-hooks route through it (bash <resolver>
-  // <baked-node> <script>) so node resolves at hook-fire time in every
-  // environment sharing the config root. Staged verbatim — no templating.
+  // Portable node resolver (#3662). Managed JS hook commands under
+  // --portable-hooks route through it (bash <resolver> <baked-node>
+  // <script>) so node resolves at hook-fire time in every environment
+  // sharing the config root. It IS registered in MANAGED_HOOKS
+  // (managed-hooks-registry.cjs) for staleness tracking like every other
+  // shipped .sh hook, and install.js stamps its {{GSD_VERSION}} header the
+  // same way (#4076 — the prior comment here claimed the opposite on both
+  // counts, which is why the header was missing and staleness detection was
+  // permanently broken for this file).
   'gsd-node-runner.sh',
   // Graphify auto-update hook (#3347 / PR #3557 / #3579). Opt-in via
   // .planning/config.json graphify.auto_update; off by default.
diff --git a/tests/managed-hooks.test.cjs b/tests/managed-hooks.test.cjs
index 233e781d2..95e0eda83 100644
--- a/tests/managed-hooks.test.cjs
+++ b/tests/managed-hooks.test.cjs
@@ -67,6 +67,57 @@ describe('bug #2136: MANAGED_HOOKS must include all shipped hook files', () => {
   });
 });
 
+/**
+ * Regression test for bug #4076
+ *
+ * gsd-node-runner.sh was registered in MANAGED_HOOKS but shipped without a
+ * "gsd-hook-version" header. gsd-check-update-worker.js treats a hook with
+ * no header as "definitely stale" (there is no way to tell it apart from a
+ * pre-version-tracking file), so every install on an otherwise up-to-date
+ * version showed a permanent, unclearable "⚠ stale hooks — run /gsd-update"
+ * warning naming that one file.
+ *
+ * This is the same *class* as bug #2136 (bash hooks missing the header
+ * entirely) but from the opposite direction: #2136 covered hooks that were
+ * *missing from MANAGED_HOOKS*; this covers a hook that *is* in
+ * MANAGED_HOOKS but never got the header line added to its source. The test
+ * below closes the whole class by iterating every MANAGED_HOOKS entry —
+ * rather than a hardcoded list of hook filenames — so a future hook added to
+ * the registry without a header fails CI instead of shipping silently.
+ */
+describe('bug #4076: every MANAGED_HOOKS entry carries a gsd-hook-version header', () => {
+  // Mirrors the exact regex gsd-check-update-worker.js uses at runtime to
+  // detect the header (both "//" JS-style and "#" bash-style comments).
+  const VERSION_HEADER_RE = /(?:\/\/|#) gsd-hook-version:\s*(.+)/;
+
+  for (const entry of MANAGED_HOOKS) {
+    test(`${entry} has a gsd-hook-version header matching the worker's detection regex`, () => {
+      const hookPath = path.join(HOOKS_DIR, entry);
+      // Note: `entry` is a loop variable, not a literal path, so
+      // local/no-source-grep's static literal-path detector does not flag
+      // this read — no allow-test-rule exemption needed. The header is
+      // still a source-text invariant the stale-hook detector reads via
+      // string matching (not a module export), so a source read is the
+      // correct way to observe it, same rationale as the sibling bug #2136
+      // checks below (folded bug-2136-sh-hook-version.test.cjs).
+      const content = fs.readFileSync(hookPath, 'utf8');
+      const match = content.match(VERSION_HEADER_RE);
+      assert.ok(
+        match,
+        `${entry} is listed in MANAGED_HOOKS but has no "# gsd-hook-version:" / ` +
+        `"// gsd-hook-version:" header — gsd-check-update-worker.js treats a ` +
+        `missing header as "definitely stale", producing a permanent, ` +
+        `unclearable "⚠ stale hooks" warning on every up-to-date install (#4076)`
+      );
+      assert.ok(
+        match[1].trim() === '{{GSD_VERSION}}' || /^\d+\.\d+\.\d+/.test(match[1].trim()),
+        `${entry}'s gsd-hook-version header must be either the unstamped ` +
+        `"{{GSD_VERSION}}" placeholder (source tree) or a concrete semver ` +
+        `string (installed tree) — got "${match[1].trim()}"`
+      );
+    });
+  }
+});
 
 // ────────────────────────────────────────────────────────────────────────
 // Folded from tests/bug-2136-sh-hook-version.test.cjs — consolidation epic #1969 (B6 #1975)