diff --git a/cmd/itgray-helper/main.go b/cmd/itgray-helper/main.go
index de733a7..f59ab97 100644
--- a/cmd/itgray-helper/main.go
+++ b/cmd/itgray-helper/main.go
@@ -15,12 +15,14 @@ import (
 	"github.com/spf13/cobra"
 )
 
-const (
-	// Version is overridden at build time via -ldflags "-X main.Version=...".
-	Version = "0.0.0-dev"
-	// PipeName is the canonical pipe path the user-side client connects to.
-	PipeName = `\\.\pipe\ITGRay.Helper.v1`
-)
+// Version is overridden at build time via -ldflags "-X main.Version=...".
+// It must stay a var: the linker can only rewrite variables, so declaring it
+// const compiles the placeholder in permanently and every build reports
+// "0.0.0-dev" no matter what the build scripts pass.
+var Version = "0.0.0-dev"
+
+// PipeName is the canonical pipe path the user-side client connects to.
+const PipeName = `\\.\pipe\ITGRay.Helper.v1`
 
 // extraCommands holds platform-specific subcommands registered via init() in
 // build-tagged files (e.g. install/uninstall on Linux). Empty on Windows.
diff --git a/cmd/itgray-helper/version_test.go b/cmd/itgray-helper/version_test.go
new file mode 100644
index 0000000..09cc345
--- /dev/null
+++ b/cmd/itgray-helper/version_test.go
@@ -0,0 +1,41 @@
+package main
+
+import (
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+// Version carries the release tag into `itgray-helper --version`, and the
+// build scripts set it with -ldflags "-X main.Version=...". That only works on
+// a var: the linker cannot rewrite a constant, so declaring it const silently
+// pinned every release to the placeholder.
+func TestVersionIsOverridableByLdflags(t *testing.T) {
+	if _, err := exec.LookPath("go"); err != nil {
+		t.Skip("go toolchain not available")
+	}
+	// Windows needs the .exe suffix: with an explicit -o the toolchain writes
+	// exactly the name given, and exec then refuses to run an extension-less
+	// file.
+	name := "itgray-helper-test"
+	if runtime.GOOS == "windows" {
+		name += ".exe"
+	}
+	bin := filepath.Join(t.TempDir(), name)
+	const want = "v9.9.9-ldflags-probe"
+
+	build := exec.Command("go", "build", "-ldflags", "-X main.Version="+want, "-o", bin, ".")
+	if out, err := build.CombinedOutput(); err != nil {
+		t.Fatalf("go build: %v\n%s", err, out)
+	}
+
+	out, err := exec.Command(bin, "--version").CombinedOutput()
+	if err != nil {
+		t.Fatalf("run --version: %v\n%s", err, out)
+	}
+	if !strings.Contains(string(out), want) {
+		t.Fatalf("--version did not report the linker-supplied version.\ngot:  %s\nwant it to contain: %s", out, want)
+	}
+}
diff --git a/scripts/build-linux.sh b/scripts/build-linux.sh
index f91d6a9..b7a24b0 100755
--- a/scripts/build-linux.sh
+++ b/scripts/build-linux.sh
@@ -35,7 +35,11 @@ ls -la "$OUT" | grep -vE '\.exe|\.dll' || true
 
 # ----- Electron AppImage -----
 echo ">> building itgray-bridge for Linux (Electron bundle)"
-( cd "$ROOT/cmd/itgray-electron" && npm run build:bridge:linux )
+# Pass VERSION through: without it build-bridge.mjs falls back to its own
+# `git describe --dirty`, and a release build is dirty by construction — the
+# workflow stamps package.json before building — so the bridge reported
+# "<tag>+dirty" in the About panel.
+( cd "$ROOT/cmd/itgray-electron" && APP_VERSION="$VERSION" npm run build:bridge:linux )
 
 echo ">> building Electron bundle (main + preload + frontend)"
 ( cd "$ROOT/cmd/itgray-electron" && npm run build:main && npm run build:preload && npm run build:frontend )
diff --git a/scripts/build-windows.sh b/scripts/build-windows.sh
index d317d04..e5d4306 100755
--- a/scripts/build-windows.sh
+++ b/scripts/build-windows.sh
@@ -54,7 +54,9 @@ ls -la "$OUT"
 
 # ----- Electron NSIS installer -----
 echo ">> cross-compiling itgray-bridge for Windows"
-( cd "$ROOT/cmd/itgray-electron" && npm run build:bridge:win )
+# Pass VERSION through — see the note in build-linux.sh: otherwise the bridge
+# derives its own dirty describe string and ships "<tag>+dirty".
+( cd "$ROOT/cmd/itgray-electron" && APP_VERSION="$VERSION" npm run build:bridge:win )
 
 echo ">> building Electron bundle (main + preload + frontend)"
 ( cd "$ROOT/cmd/itgray-electron" && npm run build:main && npm run build:preload && npm run build:frontend )