diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0682e315..add030a9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -237,6 +237,11 @@ jobs:
             type=semver,pattern={{major}},value=${{ needs.release.outputs.new_release_version }}
             type=raw,value=latest
 
+      # Same timestamp format as the release binaries' BUILD_DATE above.
+      - name: Compute build date
+        id: build_date
+        run: echo "date=$(date -u +"%Y-%m-%dT%H:%M:%SZ")" >> "$GITHUB_OUTPUT"
+
       - name: Build and push
         id: push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
@@ -246,6 +251,13 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          # Stamp version metadata into the binary (Dockerfile ARGs feeding
+          # -X ldflags on cmd/version.go); without these the image reports
+          # "plumber version dev" (getplumber/plumber#425).
+          build-args: |
+            VERSION=${{ needs.release.outputs.new_release_version }}
+            COMMIT=${{ github.sha }}
+            BUILD_DATE=${{ steps.build_date.outputs.date }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
           # Always rebuild the `runtime` stage so `apk upgrade` re-runs and pulls
diff --git a/Dockerfile b/Dockerfile
index f284fd54..a04286a6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,8 +23,18 @@ RUN go mod download
 # Copy source code
 COPY . .
 
+# Version metadata stamped into the binary (cmd/version.go). The release
+# workflow passes these as build args so `plumber version` in the published
+# image reports the release, matching the ldflags used for the release
+# binaries in release.yml. Plain `docker build` (ci.yml, local) keeps the
+# dev defaults. Declared here, after the cacheable dependency layers, so a
+# changing BUILD_DATE never invalidates `go mod download`.
+ARG VERSION=dev
+ARG COMMIT=none
+ARG BUILD_DATE=unknown
+
 # Build static binary
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o plumber .
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/getplumber/plumber/cmd.Version=${VERSION} -X github.com/getplumber/plumber/cmd.Commit=${COMMIT} -X github.com/getplumber/plumber/cmd.BuildDate=${BUILD_DATE}" -o plumber .
 
 # Final stage - Alpine (small, has shell for CI compatibility)
 # Named `runtime` so CI can target it with build-push-action's `no-cache-filter: