diff --git a/Dockerfile b/Dockerfile
index a954e94..bd0af5b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,15 +1,24 @@
 FROM golang:1.27-alpine AS builder
 
+ARG VERSION=dev # maintained in build.sh
+ARG GIT_SHA=0
+
 WORKDIR /build
 
 COPY go.mod ./
 
 COPY index.html.tmpl main.go ./
 
-RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o beam .
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags "-X main.version=${VERSION}-${GIT_SHA}" -a -installsuffix cgo -o beam .
 
 FROM alpine:latest
 
+ARG VERSION=0.1.0
+ARG GIT_SHA=dev
+
+LABEL org.opencontainers.image.version="${VERSION}"
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+
 RUN apk add mailcap \
     && adduser -D -u 1000 beam \
     && mkdir /uploads \
diff --git a/README.md b/README.md
index 622cbe4..df2dfe8 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,23 @@
 # beam
 
-File transfer service via http
\ No newline at end of file
+File transfer service via http.
+
+## Versioning
+
+The Dockerfile owns the base application version with the `VERSION` build argument. Docker builds append the current git short hash with `GIT_SHA` so the homepage can display the exact image version near the bottom-left edge.
+
+```sh
+./build.sh
+```
+
+To push `docker.sdal.tech/beam:latest` after building:
+
+```sh
+./build.sh push
+```
+
+Local non-Docker builds display `vdev` unless a version is injected manually:
+
+```sh
+go build -ldflags "-X main.version=0.1.0-dev" -o beam .
+```
diff --git a/build.sh b/build.sh
new file mode 100755
index 0000000..ad69bc2
--- /dev/null
+++ b/build.sh
@@ -0,0 +1,27 @@
+#!/bin/sh
+set -eu
+
+VERSION=1.0.0
+GIT_SHA=$(git rev-parse --short HEAD)
+IMAGE="docker.sdal.tech/beam:$VERSION-$GIT_SHA"
+IMAGE_LATEST="docker.sdal.tech/beam:latest"
+case "${1:-}" in
+    ""|push)
+        ;;
+    *)
+        echo "usage: $0 [push]" >&2
+        exit 2
+        ;;
+esac
+
+echo "Building $IMAGE with VERSION=$VERSION GIT_SHA=$GIT_SHA"
+docker build --build-arg GIT_SHA="$GIT_SHA" -build-arg VERSION="$VERSION" -t "$IMAGE:$VERSION-$GIT_SHA" -t "$IMAGE_LATEST .
+
+case "${1:-}" in
+    push)
+        echo "Pushing $IMAGE"
+        docker push "$IMAGE"
+        echo "Pushing $IMAGE"
+        docker push "$IMAGE_LATEST"
+        ;;
+esac
diff --git a/index.html.tmpl b/index.html.tmpl
index 38d70e4..b933560 100644
--- a/index.html.tmpl
+++ b/index.html.tmpl
@@ -84,6 +84,13 @@
         .result-item a {
             color: #0066cc;
         }
+        .version {
+            position: fixed;
+            left: 8px;
+            bottom: 6px;
+            color: #999;
+            font-size: 0.75em;
+        }
     </style>
 </head>
 <body>
@@ -116,6 +123,8 @@
         <div class="results" id="results"></div>
     </div>
 
+    <div class="version">v{{ .Version }}</div>
+
     <script>
         const uploadArea = document.getElementById('uploadArea');
         const fileInput = document.getElementById('fileInput');
diff --git a/main.go b/main.go
index a6f73f2..eaa50cf 100644
--- a/main.go
+++ b/main.go
@@ -36,6 +36,7 @@ const maxMultipartMemory int64 = 32 << 20 // 32MB
 
 var indexHTML *template.Template
 var maxUploadSize int64 = defaultMaxUploadSize
+var version = "dev"
 
 func main() {
 	uploadDir = os.Getenv("UPLOAD_DIR")
@@ -74,6 +75,7 @@ func main() {
 	http.HandleFunc("/", handleRequest)
 
 	log.Printf("Starting server on port %s, upload directory: %s", port, uploadDir)
+	log.Printf("Version: %s", version)
 	log.Printf("Files expires after: %v (DRYRUN_CLEAN=%v)", fileExpires, dryRun)
 	log.Printf("Max upload size: %d bytes", maxUploadSize)
 	if fileExpires != 0 {
@@ -446,6 +448,7 @@ func serveFrontpage(w http.ResponseWriter, r *http.Request) {
 		"Proto":         proto,
 		"Host":          host,
 		"MaxUploadSize": maxUploadSize,
+		"Version":       version,
 	}
 
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")