diff --git a/src/index.ts b/src/index.ts
index 83550fd..a2695e3 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,11 +1,12 @@
 import { defineCommand, runMain } from "citty";
 import { CliError } from "./lib/errors.js";
+import { VERSION } from "./lib/client.js";
 import { stderr } from "./lib/output.js";
 
 const main = defineCommand({
   meta: {
     name: "pixelvault",
-    version: "0.2.0",
+    version: VERSION,
     description: "CLI for PixelVault — agent-first image hosting",
   },
   subCommands: {
diff --git a/src/lib/client.ts b/src/lib/client.ts
index 8ec1c0f..cf4d9d5 100644
--- a/src/lib/client.ts
+++ b/src/lib/client.ts
@@ -16,8 +16,9 @@ interface ApiError {
 // Identifies the CLI to the API so signups made through it can be attributed to
 // this channel (server reads X-PixelVault-Client at register/device-login — see
 // pixelvault docs/specs/lead-attribution.md). Keep the version in sync with
-// package.json on release.
-const CLIENT_ID = "pixelvault-cli/0.6.0";
+// package.json on release (tests/lib/version.test.ts fails if they drift).
+export const VERSION = "0.6.0";
+const CLIENT_ID = `pixelvault-cli/${VERSION}`;
 
 /** CliError carrying the API's machine-readable error details. */
 export class ApiRequestError extends CliError {
diff --git a/tests/lib/version.test.ts b/tests/lib/version.test.ts
new file mode 100644
index 0000000..43a9dc8
--- /dev/null
+++ b/tests/lib/version.test.ts
@@ -0,0 +1,10 @@
+import { readFileSync } from "node:fs";
+import { describe, it, expect } from "vitest";
+import { VERSION } from "../../src/lib/client.js";
+
+describe("version", () => {
+  it("matches package.json, so --version and the X-PixelVault-Client header never go stale", () => {
+    const pkg = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
+    expect(VERSION).toBe(pkg.version);
+  });
+});