diff --git a/README.md b/README.md
index 903c7af..5662992 100644
--- a/README.md
+++ b/README.md
@@ -50,11 +50,17 @@ an isolated workspace, then sends the result back over the same channel.
 ```powershell
 git clone https://github.com/brocla/FileMill.git
 cd FileMill
-go build -o bin/filemill.exe ./cmd/filemill
+.\scripts\Build-FileMill.ps1
 go build -o bin/copy-rename.exe ./examples/transformers/copy-rename
 go build -o bin/uppercase.exe ./examples/transformers/uppercase
 ```
 
+`Build-FileMill.ps1` stamps the binary with `git describe --tags --dirty
+--always`, so `filemill --version` and the webhook startup line always name
+the exact commit that was built — not a hand-maintained string that quietly
+goes stale. The example transformers don't carry a version, so they build
+directly with `go build`.
+
 `copy-rename` and `uppercase` are two minimal example transformers included
 in the repo — see [Writing a transformer](#writing-a-transformer) below.
 
@@ -240,7 +246,7 @@ Get-CimInstance Win32_Process -Filter "Name='powershell.exe'" |
   Where-Object { $_.CommandLine -match 'Supervise-FileMill' } |
   ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
 Get-Process filemill -ErrorAction SilentlyContinue | Stop-Process -Force
-go build -o bin\filemill.exe ./cmd/filemill
+.\scripts\Build-FileMill.ps1
 Start-ScheduledTask -TaskName 'FileMill Worker'
 ```
 
@@ -277,8 +283,8 @@ against a migrated database is not a rollback: it runs constraints the
 schema no longer enforces, which is how duplicate rows get written rather
 than rejected.
 
-Then `go build` overwrites the binary and `Start-ScheduledTask` launches a
-fresh supervised chain on the new code. Confirm it came up the same way
+Then `Build-FileMill.ps1` overwrites the binary and `Start-ScheduledTask`
+launches a fresh supervised chain on the new code. Confirm it came up the same way
 described in [Logs](#logs) above. Because a fresh start also re-reads the
 YAML, this one sequence covers any change that touches code, with or without
 config.
diff --git a/cmd/filemill/main.go b/cmd/filemill/main.go
index 02894f6..763bc1e 100644
--- a/cmd/filemill/main.go
+++ b/cmd/filemill/main.go
@@ -17,9 +17,13 @@ import (
 	"filemill/internal/mailgun"
 )
 
-// version is the FileMill build version. Overridable at build time with
-// -ldflags "-X main.version=$(git describe --tags)"; defaults to the tagged release.
-var version = "0.1.1"
+// version is the FileMill build version, stamped at build time by
+// scripts/Build-FileMill.ps1 via -ldflags "-X main.version=$(git describe)".
+// A binary built directly with `go build`, bypassing that script, keeps this
+// default — so an unstamped build is obviously identifiable rather than
+// silently claiming a specific version number that only goes stale, the way
+// a hand-maintained default here already has once.
+var version = "dev"
 
 func main() {
 	if len(os.Args) >= 2 && (os.Args[1] == "--version" || os.Args[1] == "-v" || os.Args[1] == "version") {
diff --git a/scripts/Build-FileMill.ps1 b/scripts/Build-FileMill.ps1
new file mode 100644
index 0000000..5035c62
--- /dev/null
+++ b/scripts/Build-FileMill.ps1
@@ -0,0 +1,20 @@
+[CmdletBinding()]
+param()
+
+$ErrorActionPreference = 'Stop'
+
+$repositoryRoot = Split-Path -Parent $PSScriptRoot
+
+Push-Location -LiteralPath $repositoryRoot
+try {
+    $describe = git describe --tags --dirty --always 2>$null
+    if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($describe)) {
+        Write-Warning 'git describe failed (no commits or tags reachable?) - building without a stamped version'
+        go build -o bin\filemill.exe .\cmd\filemill
+    } else {
+        Write-Host "Building filemill $describe"
+        go build -ldflags "-X main.version=$describe" -o bin\filemill.exe .\cmd\filemill
+    }
+} finally {
+    Pop-Location
+}
diff --git a/scripts/Start-FileMill.ps1 b/scripts/Start-FileMill.ps1
index f6218cb..df53e5d 100644
--- a/scripts/Start-FileMill.ps1
+++ b/scripts/Start-FileMill.ps1
@@ -9,7 +9,7 @@ $repositoryRoot = Split-Path -Parent $PSScriptRoot
 $executable = Join-Path $repositoryRoot 'bin\filemill.exe'
 
 if (-not (Test-Path -LiteralPath $executable -PathType Leaf)) {
-    throw "FileMill executable not found at $executable. Build it with: go build -o bin/filemill.exe ./cmd/filemill"
+    throw "FileMill executable not found at $executable. Build it with: .\scripts\Build-FileMill.ps1"
 }
 
 if ($Foreground) {