diff --git a/changes/38356-fix-pkg-metadata-extraction b/changes/38356-fix-pkg-metadata-extraction
new file mode 100644
index 0000000000..09d9f2a30f
--- /dev/null
+++ b/changes/38356-fix-pkg-metadata-extraction
@@ -0,0 +1,2 @@
+- Fixed the metadata extraction for `.pkg` macOS installers, which was introduced in `4.77.0` and could prevent updating some installers that were added in a previous Fleet version.
+    * **NOTE**: the fix may cause some installers that were added in Fleet `4.77.0` and later to fail to update with the message "The selected package is for different software". In this case, you will have to delete and re-add the installer. This will not only make it possible to update it successfully later, it will also create it with the correct metadata (name, version, bundle identifier).
diff --git a/pkg/file/xar.go b/pkg/file/xar.go
index 7a8c167cfc..b76a285b78 100644
--- a/pkg/file/xar.go
+++ b/pkg/file/xar.go
@@ -639,7 +639,10 @@ func isValidAppFilePath(input string) (string, bool) {
 		return file, true
 	}
 
-	if strings.HasSuffix(file, ".app") {
+	// ignore nested .app files, we want to make sure the .app file is
+	// in the Applications directory and not nested somewhere else
+	// See https://github.com/fleetdm/fleet/issues/38356#issuecomment-3935530961
+	if strings.HasSuffix(file, ".app") && !strings.Contains(dir, ".app/") {
 		if strings.HasPrefix(dir, "Applications/") && strings.HasSuffix(dir, "/") {
 			return file, true
 		}
diff --git a/pkg/file/xar_test.go b/pkg/file/xar_test.go
index e9e5715b04..64490595ff 100644
--- a/pkg/file/xar_test.go
+++ b/pkg/file/xar_test.go
@@ -340,6 +340,8 @@ func TestIsValidAppFilePath(t *testing.T) {
 		{"Applications/Foo with spaces.app", true},
 		{"Applications/foo", false},
 		{"foo", true},
+		{"Applications/foo.app/bar.app", false},
+		{"Applications/foo.app/Helpers/bar.app", false},
 	}
 
 	for _, test := range tests {