diff --git a/Makefile b/Makefile
index 4a1c807..2957229 100644
--- a/Makefile
+++ b/Makefile
@@ -7,7 +7,9 @@ AGENT_BIN      := $(BIN_DIR)/restic-manager-agent
 VERSION        ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 COMMIT         ?= $(shell git rev-parse HEAD 2>/dev/null || echo none)
 DATE           ?= $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
-LDFLAGS        := -s -w -X main.version=$(VERSION) -X main.commit=$(COMMIT) -X main.date=$(DATE)
+VERSION_PKG    := gitea.dcglab.co.uk/steve/restic-manager/internal/version
+LDFLAGS        := -s -w -X main.version=$(VERSION) -X main.commit=$(COMMIT) -X main.date=$(DATE) \
+                  -X $(VERSION_PKG).Version=$(VERSION) -X $(VERSION_PKG).Commit=$(COMMIT)
 GOFLAGS        := -trimpath
 DOCKER_IMAGE   ?= gitea.dcglab.co.uk/steve/restic-manager
 DOCKER_TAG     ?= dev
diff --git a/internal/version/version.go b/internal/version/version.go
new file mode 100644
index 0000000..3a5fb70
--- /dev/null
+++ b/internal/version/version.go
@@ -0,0 +1,16 @@
+// Package version exposes build-time identifying constants. Both the
+// server and agent link this package; their values are set via
+// -ldflags during the build. An unset Version falls back to "dev"
+// so source builds without ldflags still run.
+package version
+
+var (
+	// Version is the human-facing release string, e.g. "v1.2.3" or
+	// "v1.2.3-dirty". Compared byte-for-byte between agent and
+	// server to drive the "out of date" signal.
+	Version = "dev"
+
+	// Commit is the short git SHA. Informational only; surfaced via
+	// /api/version but not used for any comparison.
+	Commit = ""
+)