diff --git a/.github/workflows/cachix.yml b/.github/workflows/cachix.yml
index 34f7198821..7b54d5f2e7 100644
--- a/.github/workflows/cachix.yml
+++ b/.github/workflows/cachix.yml
@@ -11,7 +11,7 @@ on:
 
 jobs:
   # Build and push only the package the tag names. The tag prefix
-  # (e.g. moq-relay) maps 1:1 to a flake attribute.
+  # (e.g. moq-relay) is the flake attribute, except moq-cli ships as moq.
   release:
     name: Release (${{ matrix.os }})
     runs-on: ${{ matrix.runs-on }}
@@ -48,7 +48,9 @@ jobs:
             echo "Tag format not recognized: $REF_NAME" >&2
             exit 1
           fi
-          echo "name=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
+          name="${BASH_REMATCH[1]}"
+          [[ "$name" == moq-cli ]] && name=moq
+          echo "name=${name}" >> "$GITHUB_OUTPUT"
 
       - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
         with:
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 2a3c3df447..fc6748864b 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -11,13 +11,13 @@ on:
   workflow_call:
     inputs:
       package:
-        description: "Flake package to build (moq-relay, moq-cli)"
+        description: "Crate to build (moq-relay, moq-cli)"
         required: true
         type: string
   workflow_dispatch:
     inputs:
       package:
-        description: "Flake package to build (moq-relay, moq-cli)"
+        description: "Crate to build (moq-relay, moq-cli)"
         required: true
         type: string
         default: moq-relay
@@ -32,7 +32,7 @@ jobs:
     permissions:
       contents: read
     outputs:
-      target: ${{ steps.parse.outputs.target }}
+      package: ${{ steps.parse.outputs.package }}
       version: ${{ steps.parse.outputs.version }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -41,19 +41,24 @@ jobs:
 
       - id: parse
         env:
-          PACKAGE: ${{ inputs.package }}
+          CRATE: ${{ inputs.package }}
         run: |
           ref=${GITHUB_REF#refs/tags/}
-          if [[ -n "$PACKAGE" ]]; then
-            target="$PACKAGE"
+          if [[ -n "$CRATE" ]]; then
+            crate="$CRATE"
           elif [[ "$ref" =~ ^([a-z-]+)-v[0-9.]+$ ]]; then
-            target="${BASH_REMATCH[1]}"
+            crate="${BASH_REMATCH[1]}"
           else
             echo "Tag format not recognized." >&2
             exit 1
           fi
-          echo "target=${target}" >> "$GITHUB_OUTPUT"
-          .github/scripts/release.sh parse-version "$target"
+          # The flake package and image are named after the executable.
+          case "$crate" in
+            moq-cli) package=moq ;;
+            *) package="$crate" ;;
+          esac
+          echo "package=${package}" >> "$GITHUB_OUTPUT"
+          .github/scripts/release.sh parse-version "$crate"
 
   build:
     name: Build ${{ matrix.platform }}
@@ -89,8 +94,8 @@ jobs:
           context: .
           platforms: ${{ matrix.platform }}
           build-args: |
-            package=${{ needs.parse.outputs.target }}
-          outputs: type=image,name=${{ env.REGISTRY }}/${{ needs.parse.outputs.target }},push-by-digest=true,name-canonical=true,push=${{ github.ref_type == 'tag' }}
+            package=${{ needs.parse.outputs.package }}
+          outputs: type=image,name=${{ env.REGISTRY }}/${{ needs.parse.outputs.package }},push-by-digest=true,name-canonical=true,push=${{ github.ref_type == 'tag' }}
 
       - name: Export digest
         if: github.ref_type == 'tag'
@@ -132,6 +137,18 @@ jobs:
         run: |
           # shellcheck disable=SC2046  # intentional word-splitting: one arg per digest
           docker buildx imagetools create \
-            -t ${{ env.REGISTRY }}/${{ needs.parse.outputs.target }}:${{ needs.parse.outputs.version }} \
-            -t ${{ env.REGISTRY }}/${{ needs.parse.outputs.target }}:latest \
-            $(printf "${{ env.REGISTRY }}/${{ needs.parse.outputs.target }}@sha256:%s " *)
+            -t ${{ env.REGISTRY }}/${{ needs.parse.outputs.package }}:${{ needs.parse.outputs.version }} \
+            -t ${{ env.REGISTRY }}/${{ needs.parse.outputs.package }}:latest \
+            $(printf "${{ env.REGISTRY }}/${{ needs.parse.outputs.package }}@sha256:%s " *)
+
+      # The image was moqdev/moq-cli through 0.12.2. Point `latest` there at a
+      # refusal naming the new image, so a user tracking it breaks instead of
+      # silently staying on 0.12.2. Pinned versions keep working.
+      - name: Refuse the old image name
+        if: needs.parse.outputs.package == 'moq'
+        run: |
+          docker buildx build --platform linux/amd64,linux/arm64 --push \
+            -t ${{ env.REGISTRY }}/moq-cli:latest - <<'DOCKERFILE'
+          FROM busybox:stable
+          ENTRYPOINT ["sh", "-c", "echo 'error: moqdev/moq-cli is now moqdev/moq' >&2; exit 1"]
+          DOCKERFILE
diff --git a/.github/workflows/release-winget.yml b/.github/workflows/release-winget.yml
index 4b0e62aba6..7e069b78d8 100644
--- a/.github/workflows/release-winget.yml
+++ b/.github/workflows/release-winget.yml
@@ -86,7 +86,7 @@ jobs:
           crate="${BASH_REMATCH[1]}"
           version="${BASH_REMATCH[2]}"
           case "$crate" in
-            moq-cli)       identifier="moq-dev.moq-cli" ;;
+            moq-cli)       identifier="moq-dev.moq" ;;
             moq-relay)     identifier="moq-dev.moq-relay" ;;
             *)
               echo "No winget identifier mapped for crate: $crate" >&2
diff --git a/Dockerfile b/Dockerfile
index c77df07b7a..e7626dbdfd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -29,9 +29,8 @@ RUN --mount=type=cache,target=/root/.cache --mount=type=cache,target=/nix,from=n
 ARG package="sh"
 
 # Create entry.sh script that knows which binary to run. Derive it from the
-# single binary the package produced (so a crate whose `[[bin]]` name differs
-# from its package name, e.g. `moq-cli` shipping as `moq`, just works); fall
-# back to the package name when there's no binary (the `sh` default).
+# single binary the package produced, so a package need not share its binary's
+# name; fall back to the package name when there's no binary (the `sh` default).
 RUN binary="$(ls /output/result/bin 2>/dev/null | head -n1)"; \
 	[ -n "$binary" ] || binary="${package}"; \
 	printf '#!/bin/sh\nexec /bin/%s "$@"\n' "${binary}" > /output/entry.sh && \
diff --git a/doc/setup/install.md b/doc/setup/install.md
index 7402b3fa6e..175687d6ef 100644
--- a/doc/setup/install.md
+++ b/doc/setup/install.md
@@ -14,10 +14,12 @@ Two binaries and two plugins ship prebuilt:
 | GStreamer plugin | `moqsink`, `moqsrc` | [GStreamer](/bin/gstreamer) elements |
 | OBS plugin | | [OBS Studio](/bin/obs) output and source |
 
-Homebrew and Linux package names match the executables. Cargo crates and
-Windows package IDs retain `moq-cli`. Existing Homebrew
+Package names match the executables everywhere except crates.io, where the
+crate is `moq-cli`. Existing Homebrew
 installs migrate through formula renames; apt upgrades use transitional
-packages, and dnf replaces the old packages.
+packages, and dnf replaces the old packages. The `moqdev/moq-cli` Docker image
+and the `#moq-cli` flake package stop at 0.12.2 and now exit with an error
+naming `moqdev/moq` and `#moq`.
 
 Use `moq auth` for keys and tokens; installing `moq` includes it.
 
@@ -32,11 +34,11 @@ brew install moq-dev/tap/moq-relay moq-dev/tap/moq
 
 # Nix (pin a release tag to use the binary cache)
 nix run github:moq-dev/moq#moq-relay -- relay.toml
-nix run github:moq-dev/moq#moq-cli -- --help
+nix run github:moq-dev/moq#moq -- --help
 
 # Docker (linux/amd64 and linux/arm64)
 docker run -p 4443:4443/udp -p 4443:4443/tcp -v "$PWD/relay.toml:/app/relay.toml:ro" moqdev/moq-relay /app/relay.toml
-docker run -i moqdev/moq-cli --help
+docker run -i moqdev/moq --help
 ```
 
 Static binaries for Linux (x86\_64, aarch64), macOS (Apple Silicon), and Windows
@@ -87,7 +89,7 @@ works without root, and config edits survive upgrades.
 
 ```powershell
 winget install moq-dev.moq-relay
-winget install moq-dev.moq-cli
+winget install moq-dev.moq
 ```
 
 The OBS plugin ships as a zip for Windows x64 and macOS arm64 on the
diff --git a/flake.nix b/flake.nix
index 48971bef39..9cee6d70e4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -419,14 +419,24 @@
             name = "moq-all";
             paths = [
               moq-relay
-              moq-cli
+              moq
             ];
           };
 
+          # Named after the executable. The overlay keeps `moq-cli` because
+          # nixpkgs already has an unrelated `moq`.
+          moq = overlayPkgs.moq-cli;
+
+          # The package was `moq-cli` through 0.12.2. Refuse with the new name
+          # so `nix run` and `nix profile upgrade` break instead of going stale.
+          moq-cli = pkgs.writeShellScriptBin "moq" ''
+            echo "error: the moq-cli package is now moq: nix run github:moq-dev/moq#moq" >&2
+            exit 1
+          '';
+
           # Inherit packages from the overlay
           inherit (overlayPkgs)
             moq-relay
-            moq-cli
             moq-bench
             moq-boy
             libmoq
diff --git a/rs/moq-cli/README.md b/rs/moq-cli/README.md
index fa30ae44de..de0241a778 100644
--- a/rs/moq-cli/README.md
+++ b/rs/moq-cli/README.md
@@ -12,10 +12,10 @@ cargo install moq-cli
 ### Docker
 
 ```bash
-docker pull moqdev/moq-cli
+docker pull moqdev/moq
 ```
 
-Multi-arch images (`linux/amd64` and `linux/arm64`) are published to [Docker Hub](https://hub.docker.com/r/moqdev/moq-cli).
+Multi-arch images (`linux/amd64` and `linux/arm64`) are published to [Docker Hub](https://hub.docker.com/r/moqdev/moq).
 
 ## Usage