diff --git a/cli/src/commands/update.rs b/cli/src/commands/update.rs
index 0d7321a814f..30c918f7e85 100644
--- a/cli/src/commands/update.rs
+++ b/cli/src/commands/update.rs
@@ -23,6 +23,8 @@ pub async fn update(ctx: CommandContext, args: StandaloneUpdateArgs) -> Result<i
 	);
 	let update_service = SelfUpdate::new(&update_service)?;
 
+	let _ = update_service.cleanup_old_update();
+
 	let current_version = update_service.get_current_release().await?;
 	if update_service.is_up_to_date_with(&current_version) {
 		ctx.log.result(format!(
diff --git a/cli/src/self_update.rs b/cli/src/self_update.rs
index 4a878dc5447..bb5d2d2249b 100644
--- a/cli/src/self_update.rs
+++ b/cli/src/self_update.rs
@@ -24,6 +24,8 @@ pub struct SelfUpdate<'a> {
 	update_service: &'a UpdateService,
 }
 
+static OLD_UPDATE_EXTENSION: &str = "Updating CLI";
+
 impl<'a> SelfUpdate<'a> {
 	pub fn new(update_service: &'a UpdateService) -> Result<Self, AnyError> {
 		let commit = VSCODE_CLI_COMMIT
@@ -59,6 +61,18 @@ impl<'a> SelfUpdate<'a> {
 		release.commit == self.commit
 	}
 
+	/// Cleans up old self-updated binaries. Should be called with regularity.
+	/// May fail if old versions are still running.
+	pub fn cleanup_old_update(&self) -> Result<(), std::io::Error> {
+		let current_path = std::env::current_exe()?;
+		let old_path = current_path.with_extension(OLD_UPDATE_EXTENSION);
+		if old_path.exists() {
+			fs::remove_file(old_path)?;
+		}
+
+		Ok(())
+	}
+
 	/// Updates the CLI to the given release.
 	pub async fn do_update(
 		&self,
@@ -89,8 +103,11 @@ impl<'a> SelfUpdate<'a> {
 		// OS later. However, this can fail if the tempdir is on a different drive
 		// than the installation dir. In this case just rename it to ".old".
 		if fs::rename(&target_path, tempdir.path().join("old-code-cli")).is_err() {
-			fs::rename(&target_path, target_path.with_extension(".old"))
-				.map_err(|e| wrap(e, "failed to rename old CLI"))?;
+			fs::rename(
+				&target_path,
+				target_path.with_extension(OLD_UPDATE_EXTENSION),
+			)
+			.map_err(|e| wrap(e, "failed to rename old CLI"))?;
 		}
 
 		fs::rename(&staging_path, &target_path)
diff --git a/cli/src/tunnels/control_server.rs b/cli/src/tunnels/control_server.rs
index af0605bb66d..a344cc5d560 100644
--- a/cli/src/tunnels/control_server.rs
+++ b/cli/src/tunnels/control_server.rs
@@ -777,6 +777,8 @@ async fn handle_update(
 	let latest_release = updater.get_current_release().await?;
 	let up_to_date = updater.is_up_to_date_with(&latest_release);
 
+	let _ = updater.cleanup_old_update();
+
 	if !params.do_update || up_to_date {
 		return Ok(UpdateResult {
 			up_to_date,