diff --git a/.gitignore b/.gitignore
index d826854..2f5c48a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,4 @@ node.csr
 
 # OS / editor cruft
 .DS_Store
+bin/
diff --git a/VERSION b/VERSION
new file mode 100644
index 0000000..6e8bf73
--- /dev/null
+++ b/VERSION
@@ -0,0 +1 @@
+0.1.0
diff --git a/scripts/build.sh b/scripts/build.sh
new file mode 100755
index 0000000..c07eb14
--- /dev/null
+++ b/scripts/build.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# Build node with the version from VERSION injected at link time.
+#   scripts/build.sh [output-path]
+set -euo pipefail
+cd "$(dirname "$0")/.."
+VERSION="$(tr -d '[:space:]' < VERSION)"
+go build -ldflags "-X github.com/PharosVPN/node/internal/cli.version=$VERSION" -o "${1:-bin/node}" ./cmd/node
+echo "built node $VERSION -> ${1:-bin/node}"
diff --git a/scripts/bump-version.sh b/scripts/bump-version.sh
new file mode 100755
index 0000000..17cf17c
--- /dev/null
+++ b/scripts/bump-version.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# Semantic-version bump for this component. Reads + writes ./VERSION.
+#   scripts/bump-version.sh [major|minor|patch]   (default: patch)
+# Strips any -prerelease suffix; pass --tag to also create a git tag vX.Y.Z.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+part="patch"; tag=0
+for a in "$@"; do case "$a" in major|minor|patch) part="$a";; --tag) tag=1;; *) echo "usage: $0 [major|minor|patch] [--tag]" >&2; exit 2;; esac; done
+cur="$(tr -d '[:space:]' < VERSION)"; base="${cur%%-*}"
+IFS=. read -r ma mi pa <<< "$base"
+case "$part" in major) ma=$((ma+1)); mi=0; pa=0;; minor) mi=$((mi+1)); pa=0;; patch) pa=$((pa+1));; esac
+new="$ma.$mi.$pa"; printf '%s\n' "$new" > VERSION
+echo "VERSION: $cur -> $new"
+[ "$tag" = 1 ] && git tag "v$new" && echo "tagged v$new"
+exit 0