diff --git a/orbit/changes/40200-auto-update-panic b/orbit/changes/40200-auto-update-panic
new file mode 100644
index 0000000000..a93e5ed488
--- /dev/null
+++ b/orbit/changes/40200-auto-update-panic
@@ -0,0 +1 @@
+* Fix orbit panic when auto-updates disabled
diff --git a/orbit/cmd/orbit/orbit.go b/orbit/cmd/orbit/orbit.go
index e075c8f024..a0902c6648 100644
--- a/orbit/cmd/orbit/orbit.go
+++ b/orbit/cmd/orbit/orbit.go
@@ -604,6 +604,7 @@ func main() {
 		// it fetches osqueryd once as part of initialization.
 		var updater *update.Updater
 		var updateRunner *update.Runner
+		var osqueryVersion string
 		if !c.Bool("disable-updates") || c.Bool("dev-mode") {
 			updater, err := update.NewUpdater(opt)
 			if err != nil {
@@ -645,6 +646,7 @@ func main() {
 				if err == nil && version != "" {
 					log.Info().Msgf("Found osquery version: %s", version)
 					updateRunner.OsqueryVersion = version
+					osqueryVersion = version
 				}
 			}
 
@@ -694,6 +696,10 @@ func main() {
 			if err != nil {
 				log.Fatal().Err(err).Msgf("locate %s", constant.OsqueryTUFTargetName)
 			}
+			if v, err := update.GetVersion(osquerydPath); err == nil && v != "" {
+				log.Info().Msgf("Found osquery version: %s", v)
+				osqueryVersion = v
+			}
 			if c.Bool("fleet-desktop") {
 				if runtime.GOOS == "darwin" {
 					desktopPath, err = updater.DirLocalPath(constant.DesktopTUFTargetName)
@@ -924,7 +930,7 @@ func main() {
 			}
 
 			options = append(options,
-				osquery.WithFlags(osquery.FleetFlags(updateRunner.OsqueryVersion, parsedURL)),
+				osquery.WithFlags(osquery.FleetFlags(osqueryVersion, parsedURL)),
 				osquery.WithFlags([]string{"--tls_server_certs", certPath}),
 			)
 		} else if fleetURL != "https://" {
@@ -938,7 +944,7 @@ func main() {
 			}
 
 			options = append(options,
-				osquery.WithFlags(osquery.FleetFlags(updateRunner.OsqueryVersion, parsedURL)),
+				osquery.WithFlags(osquery.FleetFlags(osqueryVersion, parsedURL)),
 			)
 
 			if certPath = c.String("fleet-certificate"); certPath != "" {
@@ -1090,7 +1096,7 @@ func main() {
 			hostIdentityCertificatePath = hostIdentityCredentials.CertificatePath
 
 			options = append(options,
-				osquery.WithFlags(osquery.FleetFlags(updateRunner.OsqueryVersion, proxy.ParsedURL)),
+				osquery.WithFlags(osquery.FleetFlags(osqueryVersion, proxy.ParsedURL)),
 
 				// This is overriding the previous set of --tls_server_certs in osquery.FleetFlags above.
 				osquery.WithFlags([]string{"--tls_server_certs", proxy.CertificatePath}),