diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml
index 063274c..65984f2 100644
--- a/.github/workflows/build-binaries.yml
+++ b/.github/workflows/build-binaries.yml
@@ -78,7 +78,10 @@ jobs:
         # other targets are cross-compiled — we trust bun's compile output
         # for them and verify post-release.
         if: matrix.target == 'bun-linux-x64-modern'
-        run: ./${{ matrix.asset }} --version || true
+        run: |
+          EXPECTED="$(node -p "require('./package.json').version")"
+          ACTUAL="$(./${{ matrix.asset }} --version)"
+          test "${ACTUAL}" = "${EXPECTED}"
 
       - name: Upload to GitHub release
         env:
@@ -149,5 +152,9 @@ jobs:
         # needing real credentials.
         shell: pwsh
         run: |
-          ./codebase.exe --version
+          $expected = node -p "require('./package.json').version"
+          $actual = ./codebase.exe --version
+          if ($actual.Trim() -ne $expected.Trim()) {
+            throw "Version mismatch: expected $expected, got $actual"
+          }
           ./codebase.exe --help
diff --git a/package-lock.json b/package-lock.json
index 865313b..f31e99f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "codebase-cli",
-	"version": "2.0.0-pre.84",
+	"version": "2.0.0-pre.85",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "codebase-cli",
-			"version": "2.0.0-pre.84",
+			"version": "2.0.0-pre.85",
 			"license": "MIT",
 			"dependencies": {
 				"@agentclientprotocol/sdk": "^1.3.0",
diff --git a/package.json b/package.json
index 9fcdd01..f245934 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "codebase-cli",
-	"version": "2.0.0-pre.84",
+	"version": "2.0.0-pre.85",
 	"description": "Codebase CLI — a TypeScript coding agent on the pi-mono runtime. OAuth-aware, any LLM provider, single install.",
 	"keywords": [
 		"ai",
diff --git a/src/version.ts b/src/version.ts
index 069c794..c5894da 100644
--- a/src/version.ts
+++ b/src/version.ts
@@ -1,25 +1,8 @@
-import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
+import packageMetadata from "../package.json";
 
 /**
- * Resolves the running CLI's version at runtime by reading the bundled
- * package.json. This is the single source of truth for "what am I
- * running" — surfaced in the welcome banner, the status bar, and the
- * `--version` flag so the user can never wonder again whether their
- * shell is launching the build they just compiled.
- *
- * Fallback to "?.?.?" if the lookup fails for any reason; a missing
- * version string shouldn't crash the agent.
+ * Keep package.json as the single source of truth, but import it so native
+ * Bun builds embed the version instead of trying to read a neighboring file
+ * that does not exist beside a standalone binary.
  */
-export const VERSION: string = (() => {
-	try {
-		// dist/version.js → dist/ → package.json
-		// src/version.ts (via tsx) → src/  → package.json
-		const here = dirname(fileURLToPath(import.meta.url));
-		const pkg = JSON.parse(readFileSync(join(here, "..", "package.json"), "utf8")) as { version?: string };
-		return pkg.version ?? "?.?.?";
-	} catch {
-		return "?.?.?";
-	}
-})();
+export const VERSION = packageMetadata.version;