diff --git a/Gopkg.lock b/Gopkg.lock
index 478ded07..2c6a4c07 100644
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -83,6 +83,14 @@
   revision = "f0e32980c006571efd537032e5f9cd8c1a92819e"
   version = "v0.1.0"
 
+[[projects]]
+  digest = "1:88e0b0baeb9072f0a4afbcf12dda615fc8be001d1802357538591155998da21b"
+  name = "github.com/hashicorp/go-version"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "ac23dc3fea5d1a983c43f6a0f6e2c13f0195d8bd"
+  version = "v1.2.0"
+
 [[projects]]
   digest = "1:870d441fe217b8e689d7949fef6e43efbc787e50f200cb1e70dbca9204a1d6be"
   name = "github.com/inconshreveable/mousetrap"
@@ -239,6 +247,7 @@
     "github.com/google/gopacket/layers",
     "github.com/google/gopacket/tcpassembly",
     "github.com/google/renameio",
+    "github.com/hashicorp/go-version",
     "github.com/miekg/dns",
     "github.com/oschwald/maxminddb-golang",
     "github.com/satori/go.uuid",
diff --git a/Gopkg.toml b/Gopkg.toml
index 6ada84bf..0fe7f61a 100644
--- a/Gopkg.toml
+++ b/Gopkg.toml
@@ -97,3 +97,7 @@ ignored = ["github.com/safing/portbase/*"]
 [prune]
   go-tests = true
   unused-packages = true
+
+[[constraint]]
+  name = "github.com/hashicorp/go-version"
+  version = "1.2.0"
diff --git a/updates/latest.go b/updates/latest.go
index 1e32f85c..91251359 100644
--- a/updates/latest.go
+++ b/updates/latest.go
@@ -11,6 +11,8 @@ import (
 	"sync"
 
 	"github.com/safing/portbase/log"
+
+	semver "github.com/hashicorp/go-version"
 )
 
 var (
@@ -70,11 +72,11 @@ func ScanForLatest(baseDir string, hardFail bool) (latest map[string]string, las
 	filepath.Walk(baseDir, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
 			if !os.IsNotExist(err) {
-				lastError = err
+				lastError = fmt.Errorf("updates: could not read %s: %s", path, err)
 				if hardFail {
-					return err
+					return lastError
 				}
-				log.Warningf("updates: could not read %s", path)
+				log.Warning(lastError.Error())
 			}
 			return nil
 		}
@@ -95,9 +97,24 @@ func ScanForLatest(baseDir string, hardFail bool) (latest map[string]string, las
 		// add/update index
 		storedVersion, ok := latest[identifierPath]
 		if ok {
-			// FIXME: this will fail on multi-digit version segments!
-			// FIXME: use https://github.com/hashicorp/go-version
-			if version > storedVersion {
+			parsedVersion, err := semver.NewVersion(version)
+			if err != nil {
+				lastError = fmt.Errorf("updates: could not parse version of %s: %s", path, err)
+				if hardFail {
+					return lastError
+				}
+				log.Warning(lastError.Error())
+			}
+			parsedStoredVersion, err := semver.NewVersion(storedVersion)
+			if err != nil {
+				lastError = fmt.Errorf("updates: could not parse version of %s: %s", path, err)
+				if hardFail {
+					return lastError
+				}
+				log.Warning(lastError.Error())
+			}
+			// compare
+			if parsedVersion.GreaterThan(parsedStoredVersion) {
 				latest[identifierPath] = version
 			}
 		} else {