diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4fc32be..16e6b9f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,3 +18,12 @@ jobs:
 
       - name: Verify formatting and run quality gate
         run: ./scripts/check.sh
+
+      - name: Build provider binary (stamped metadata)
+        run: |
+          VERSION="${GITHUB_REF_NAME:-dev}"
+          COMMIT="$(git rev-parse --short HEAD)"
+          DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+
+          go build -o terraform-provider-dynu \
+            -ldflags="-X main.version=${VERSION} -X main.commit=${COMMIT} -X main.date=${DATE}"
diff --git a/README.md b/README.md
index 3765f18..5a6bdc1 100644
--- a/README.md
+++ b/README.md
@@ -14,6 +14,11 @@ This provider is **not published** to the Terraform Registry yet. For local deve
 go build -o terraform-provider-dynu
 ```
 
+By default, local builds use embedded metadata values:
+- `version=dev`
+- `commit=none`
+- `built=unknown`
+
 2. Configure `~/.terraformrc`:
 
 ```hcl
@@ -53,6 +58,33 @@ terraform plan
 
 When provider configuration or code changes, rebuild the provider binary first, then re-run `terraform validate` and `terraform plan`.
 
+### Version metadata in binaries
+
+The provider embeds build metadata (`version`, `commit`, `date`) in the binary.
+
+- Local builds (no `-ldflags`) default to:
+  - `version=dev`
+  - `commit=none`
+  - `built=unknown`
+- You can inspect metadata from the binary with either:
+  - `./terraform-provider-dynu --version`
+  - `./terraform-provider-dynu version`
+
+Build a stamped binary with standard Go `-ldflags`:
+
+```bash
+VERSION=${VERSION:-v0.2.0}
+COMMIT=$(git rev-parse --short HEAD)
+DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+go build -o terraform-provider-dynu \
+  -ldflags="-X main.version=${VERSION} -X main.commit=${COMMIT} -X main.date=${DATE}"
+```
+
+Release tag/version mapping:
+- Git tag `v0.1.0` -> build with `VERSION=v0.1.0`
+- Git tag `v0.2.0` -> build with `VERSION=v0.2.0`
+
 ## Copy/paste starter configuration
 
 ```hcl
diff --git a/main.go b/main.go
index 1331619..b4b4302 100644
--- a/main.go
+++ b/main.go
@@ -2,15 +2,30 @@ package main
 
 import (
 	"context"
+	"fmt"
 	"log"
+	"os"
 
 	"github.com/hashicorp/terraform-plugin-framework/providerserver"
 
 	"github.com/dynu/terraform-provider-dynu/internal/provider"
 )
 
+var (
+	version = "dev"
+	commit  = "none"
+	date    = "unknown"
+)
+
 func main() {
-	err := providerserver.Serve(context.Background(), provider.New("dev"), providerserver.ServeOpts{
+	if len(os.Args) == 2 && (os.Args[1] == "--version" || os.Args[1] == "version") {
+		fmt.Printf("terraform-provider-dynu version=%s commit=%s built=%s\n", version, commit, date)
+		return
+	}
+
+	log.Printf("starting terraform-provider-dynu version=%s commit=%s built=%s", version, commit, date)
+
+	err := providerserver.Serve(context.Background(), provider.New(version), providerserver.ServeOpts{
 		Address: "registry.terraform.io/dynu/dynu",
 	})
 	if err != nil {