diff --git a/.gitignore b/.gitignore
index 9a4b611..965e470 100644
--- a/.gitignore
+++ b/.gitignore
@@ -32,5 +32,10 @@ tmp/
 # the skill). Canonical source is the workspace-root skills/.
 packages/cli/skills/
 
+# Generated by the cli's `prebuild` step (scripts/sync-version.mjs) so
+# the CLI's --version output stays in lockstep with package.json. Only
+# writer is the generator script; do not commit.
+packages/cli/src/version.ts
+
 # npm pack artifacts (regenerated each publish via cli's prepack script)
 *.tgz
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 3e3a290..91bff41 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -31,11 +31,15 @@
     "skills"
   ],
   "scripts": {
+    "sync:version": "node scripts/sync-version.mjs",
+    "prestart": "npm run sync:version",
     "start": "tsx src/index.ts",
+    "pretypecheck": "npm run sync:version",
     "typecheck": "tsc --noEmit",
     "lint": "eslint .",
     "test": "vitest run",
     "test:cli-contract": "vitest run __tests__/contract.test.ts",
+    "prebuild": "npm run sync:version",
     "build": "tsc --noEmit && esbuild src/index.ts --bundle --platform=node --format=esm --external:commander --external:yaml --external:zod --external:@openhop/server --external:@openhop/web --external:fastify --external:@fastify/static --external:@fastify/http-proxy --outfile=dist/index.js --banner:js='#!/usr/bin/env node'",
     "prepack": "npm run build && rm -rf skills && cp -r ../../skills ./skills"
   },
diff --git a/packages/cli/scripts/sync-version.mjs b/packages/cli/scripts/sync-version.mjs
new file mode 100644
index 0000000..16e4d8d
--- /dev/null
+++ b/packages/cli/scripts/sync-version.mjs
@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+// Regenerates src/version.ts from package.json so the CLI's --version
+// output can never drift from the published package version. Run as
+// prebuild — see packages/cli/package.json scripts.build.
+//
+// src/version.ts is gitignored; this script is the only writer.
+
+import { readFileSync, writeFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const pkgPath = resolve(here, '..', 'package.json')
+const outPath = resolve(here, '..', 'src', 'version.ts')
+
+const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'))
+const banner = '// Auto-generated by scripts/sync-version.mjs from package.json. Do not edit.\n'
+writeFileSync(outPath, `${banner}export const VERSION = ${JSON.stringify(pkg.version)}\n`)
diff --git a/packages/cli/src/index.ts b/packages/cli/src/index.ts
index f742915..6b816a0 100644
--- a/packages/cli/src/index.ts
+++ b/packages/cli/src/index.ts
@@ -16,6 +16,7 @@ import {
   logStderr,
 } from './utils.js'
 import { ExitCode } from './exit-codes.js'
+import { VERSION } from './version.js'
 import { registerGet } from './get.js'
 import { registerValidate } from './validate.js'
 import { registerHelpJson } from './help-json.js'
@@ -50,7 +51,7 @@ if (process.argv.includes('--api-version')) {
 
 const program = new Command()
 
-program.name('openhop').description('OpenHop — Data Flow Visualization CLI').version('0.2.0')
+program.name('openhop').description('OpenHop — Data Flow Visualization CLI').version(VERSION)
 
 // --- serve ---
 //