diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a4e24d2..915632c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,11 +38,16 @@ jobs:
       # folder once, so the download unzips straight to the folder Chrome loads
       # (uploading a .zip would hand people a zip inside a zip).
       - name: Stage extension (unpacked folder)
+        env:
+          # on a pull request, the PR's own head (github.sha there is a temporary merge commit)
+          BUILD_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
         run: |
           mkdir -p dist/podkey
           # vendor/ holds the sidestr engine the spend window imports (MV3 forbids remote code)
           cp -r manifest.json src popup vendor $([ -d icons ] && echo icons) LICENSE PRIVACY.md dist/podkey/
           find dist/podkey -name '*.test.js' -delete
+          # the commit this package was built from, shown beside the version in the popup
+          printf '{"commit":"%s","built":"%s"}\n' "$BUILD_COMMIT" "$(date -u +%Y-%m-%dT%H:%MZ)" > dist/podkey/build.json
 
       - name: Check the folder holds every file the extension loads
         run: |
diff --git a/.gitignore b/.gitignore
index 5afa9ee..b996138 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,4 @@ dist/
 .idea/
 src/background.bundle.js
 popup/popup.bundle.js
+build.json
diff --git a/popup/popup.css b/popup/popup.css
index 299d032..6c9de6b 100644
--- a/popup/popup.css
+++ b/popup/popup.css
@@ -702,6 +702,20 @@ input:focus-visible + .slider {
   color: var(--text-faint);
 }
 
+/* ---- Version: quiet, on every screen ---- */
+.version {
+  text-align: center;
+  padding: 6px 0 2px;
+  font-family: var(--mono);
+  font-size: 10.5px;
+  color: var(--text-faint);
+  user-select: text;
+}
+
+.version:empty {
+  display: none;
+}
+
 /* ---- Scrollbars ---- */
 .trusted-list::-webkit-scrollbar,
 .event-preview::-webkit-scrollbar {
diff --git a/popup/popup.html b/popup/popup.html
index 11da8f4..f4c2b89 100644
--- a/popup/popup.html
+++ b/popup/popup.html
@@ -314,6 +314,9 @@ <h1>Podkey</h1>
       </div>
     </div>
 
+    <!-- Version, on every screen. CI stamps build.json with the commit it built. -->
+    <div class="version" id="version" aria-label="Podkey version"></div>
+
     <script src="popup.bundle.js"></script>
   </body>
 </html>
diff --git a/popup/popup.js b/popup/popup.js
index 898175f..6f50061 100644
--- a/popup/popup.js
+++ b/popup/popup.js
@@ -26,8 +26,33 @@ let currentScreen = 'setup';
 // (cancel or closing the window) leaves no partial state anywhere.
 let pendingDerivedIdentity = null;
 
+/**
+ * Show the version quietly at the foot of every screen: the manifest's version,
+ * plus the commit CI built it from when the package carries build.json (a
+ * source build has none and shows the version alone). Every CI build of main
+ * shares a version, so the commit is what tells two downloads apart.
+ */
+async function showVersion () {
+  const el = document.getElementById('version');
+  if (!el) return;
+  const version = chrome.runtime.getManifest().version;
+  el.textContent = `v${version}`;
+  el.title = `Podkey ${version}`;
+  try {
+    const res = await fetch(chrome.runtime.getURL('build.json'));
+    if (!res.ok) return;
+    const build = await res.json();
+    if (typeof build.commit !== 'string' || !/^[0-9a-f]{7,40}$/.test(build.commit)) return;
+    el.textContent = `v${version} · ${build.commit.slice(0, 7)}`;
+    el.title = `Podkey ${version}, built from ${build.commit}${build.built ? ` on ${build.built}` : ''}`;
+  } catch {
+    // no build.json: a source build, version alone
+  }
+}
+
 // Initialize
 document.addEventListener('DOMContentLoaded', async () => {
+  showVersion();
   await checkKeypairStatus();
   setupEventListeners();