diff --git a/changes/windows-open-query-drop-multiword-guess b/changes/windows-open-query-drop-multiword-guess
new file mode 100644
index 00000000000..157fda8b078
--- /dev/null
+++ b/changes/windows-open-query-drop-multiword-guess
@@ -0,0 +1 @@
+- Fixed Fleet-maintained apps on Windows generating an "app open" pre-install check that could never match: multi-word app names without a known process name (e.g. "Mozilla Firefox", "Microsoft Visual C++ 2015-2022 Redistributable (x64)") no longer produce a guessed `<name>.exe` process check. Apps with a curated process-name mapping keep their check.
diff --git a/ee/maintained-apps/maintained_apps.go b/ee/maintained-apps/maintained_apps.go
index 18a49684080..646448d23fd 100644
--- a/ee/maintained-apps/maintained_apps.go
+++ b/ee/maintained-apps/maintained_apps.go
@@ -19,7 +19,7 @@ const OutputPath = "ee/maintained-apps/outputs"
 type FMAQueries struct {
 	Exists  string `json:"exists"`
 	Patched string `json:"patched"`
-	Open    string `json:"open"`
+	Open    string `json:"open,omitempty"`
 }
 
 type FMAManifestApp struct {
diff --git a/pkg/patch_policy/patch_policy.go b/pkg/patch_policy/patch_policy.go
index fa76966ba19..8806cf44319 100644
--- a/pkg/patch_policy/patch_policy.go
+++ b/pkg/patch_policy/patch_policy.go
@@ -179,6 +179,17 @@ func defaultWindowsOpenQuery(softwareTitle string) string {
 		return fmt.Sprintf(windowsOpenQueryPrefix, query)
 	}
 
+	// Multi-word catalog names ("Mozilla Firefox", "XnSoft XnConvert", "Microsoft
+	// Visual C++ 2015-2022 Redistributable (x64)") almost never equal the process
+	// image name — vendor prefixes, editions, and version suffixes produce a query
+	// that can never match, which silently defeats the app-open gate. Runtime,
+	// driver, and redistributable packages have no user-facing process at all.
+	// Emit no open query rather than a wrong one; add a windowsOpenQueryOverrides
+	// entry when the real binary name is known.
+	if strings.Contains(softwareTitle, " ") {
+		return ""
+	}
+
 	// Match a process named "<title>.exe"
 	// alternatives considered:
 	// - join programs.install_location with processes.path - install_location is unreliable (especially for MSI installers)
diff --git a/pkg/patch_policy/patch_policy_test.go b/pkg/patch_policy/patch_policy_test.go
index 2052e15de22..ca453418709 100644
--- a/pkg/patch_policy/patch_policy_test.go
+++ b/pkg/patch_policy/patch_policy_test.go
@@ -99,6 +99,12 @@ func TestGenerateOpenQuery(t *testing.T) {
 	got = patch_policy.GenerateOpenQuery("windows", "", "Microsoft Teams")
 	require.Equal(t, "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) IN ('teams.exe','ms-teams.exe'));", got)
 
+	// A multi-word title without an override yields no query: the derived
+	// "<title>.exe" ("xnsoft xnconvert.exe") would never match a real process,
+	// silently defeating the app-open gate.
+	require.Empty(t, patch_policy.GenerateOpenQuery("windows", "", "XnSoft XnConvert"))
+	require.Empty(t, patch_policy.GenerateOpenQuery("windows", "", "Microsoft Visual C++ 2015-2022 Redistributable (x64)"))
+
 	// Unknown platform yields no query.
 	require.Empty(t, patch_policy.GenerateOpenQuery("linux", "com.example.foo", ""))
 }