diff --git a/.env b/.env
new file mode 100644
index 0000000..a3a4478
--- /dev/null
+++ b/.env
@@ -0,0 +1 @@
+PLUGIN_VERSION=0.1.1
diff --git a/.gitea/workflows/version-bump.yml b/.gitea/workflows/version-bump.yml
index 069a9f5..24d34b2 100644
--- a/.gitea/workflows/version-bump.yml
+++ b/.gitea/workflows/version-bump.yml
@@ -34,6 +34,7 @@ jobs:
         with:
           ref: develop
           fetch-depth: 0
+          token: ${{ secrets.CI_BOT_TOKEN }}
 
       - name: Determine bump level from PR labels
         id: level
@@ -49,29 +50,26 @@ jobs:
           echo "::error::merged PR into develop has no bump/major, bump/minor, bump/patch, or bump/skip label"
           exit 1
 
-      - name: Bump CMakeLists.txt and flake.nix
+      - name: Bump PLUGIN_VERSION in .env
         if: steps.level.outputs.level != 'skip'
         env:
           LEVEL: ${{ steps.level.outputs.level }}
         run: |
           set -euo pipefail
 
-          CURRENT=$(grep -oP '(?<=VERSION )[0-9]+(\.[0-9]+){1,2}' CMakeLists.txt | head -1)
-
-          # Pad to 3 components so a pre-existing 2-component version (e.g.
-          # "0.1") still splits into MAJOR/MINOR/PATCH correctly.
-          IFS='.' read -r MAJOR MINOR PATCH <<< "${CURRENT}.0.0"
+          CURRENT=$(sed -n 's/^PLUGIN_VERSION=//p' .env)
+          IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT"
 
           case "$LEVEL" in
             major) MAJOR=$((MAJOR + 1)); MINOR=0; PATCH=0 ;;
             minor) MINOR=$((MINOR + 1)); PATCH=0 ;;
             patch) PATCH=$((PATCH + 1)) ;;
+            *) echo "::error::unknown bump level '$LEVEL'"; exit 1 ;;
           esac
 
           NEW="$MAJOR.$MINOR.$PATCH"
 
-          sed -i "s/VERSION ${CURRENT}/VERSION ${NEW}/" CMakeLists.txt
-          sed -i "s/version = \"${CURRENT}\"/version = \"${NEW}\"/" flake.nix
+          sed -i "s/^PLUGIN_VERSION=.*/PLUGIN_VERSION=${NEW}/" .env
 
           echo "CURRENT_VERSION=${CURRENT}" >> "$GITHUB_ENV"
           echo "NEW_VERSION=${NEW}" >> "$GITHUB_ENV"
@@ -86,6 +84,6 @@ jobs:
           fi
           git config user.name "gitea-actions"
           git config user.email "actions@noreply.localhost"
-          git add CMakeLists.txt flake.nix
-          git commit -m "Bump version to ${NEW_VERSION}"
+          git add .env
+          git commit -m "Bump PLUGIN_VERSION to ${NEW_VERSION}"
           git push origin HEAD:develop
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2c02b39..184c872 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,8 +1,19 @@
 cmake_minimum_required(VERSION 3.27)
 
+# PLUGIN_VERSION lives in .env (single source of truth - also read by
+# flake.nix) so .gitea/workflows/version-bump.yml only ever has to touch one
+# file, rather than a "VERSION X.Y" grep/sed that can't tell this project's
+# own version apart from cmake_minimum_required's version above.
+file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/.env" HYPR_CHROME_ENV_LINES)
+foreach(HYPR_CHROME_ENV_LINE IN LISTS HYPR_CHROME_ENV_LINES)
+    if(HYPR_CHROME_ENV_LINE MATCHES "^PLUGIN_VERSION=(.*)$")
+        set(HYPR_CHROME_PLUGIN_VERSION "${CMAKE_MATCH_1}")
+    endif()
+endforeach()
+
 project(hypr-chrome
     DESCRIPTION "Draws a chamfered HUD-style border frame with a title bar around each window."
-    VERSION 0.1
+    VERSION ${HYPR_CHROME_PLUGIN_VERSION}
 )
 
 # Match the Makefile's prior default (CXXFLAGS ?= -O2) so a bare `cmake -B
diff --git a/flake.nix b/flake.nix
index ad5b465..453f023 100644
--- a/flake.nix
+++ b/flake.nix
@@ -18,13 +18,23 @@
     let
       system = "x86_64-linux";
       pkgs = import nixpkgs { inherit system; };
+
+      # Read from .env (also read by CMakeLists.txt) rather than a separate
+      # hardcoded string, so .gitea/workflows/version-bump.yml only ever has
+      # to touch that one file for both build systems to stay in sync.
+      pluginVersion =
+        let
+          envLines = pkgs.lib.splitString "\n" (builtins.readFile ./.env);
+          versionLine = pkgs.lib.findFirst (pkgs.lib.hasPrefix "PLUGIN_VERSION=") null envLines;
+        in
+        pkgs.lib.removePrefix "PLUGIN_VERSION=" versionLine;
     in
     {
       # Build with Hyprland's own stdenv (not nixpkgs' default one) so the
       # compiler/libstdc++ ABI matches what Hyprland itself was built with.
       packages.${system}.default = pkgs.hyprland.stdenv.mkDerivation {
         pname = "hypr-chrome";
-        version = "0.1";
+        version = pluginVersion;
         src = self;
 
         nativeBuildInputs = [ pkgs.cmake pkgs.pkg-config ];