diff --git a/.gitea/workflows/version-bump.yml b/.gitea/workflows/version-bump.yml
new file mode 100644
index 0000000..069a9f5
--- /dev/null
+++ b/.gitea/workflows/version-bump.yml
@@ -0,0 +1,91 @@
+name: Version Bump
+
+on:
+  pull_request:
+    branches: [develop]
+    types: [opened, synchronize, reopened, labeled, unlabeled, closed]
+
+permissions:
+  contents: write
+
+jobs:
+  # Register this job's name as a required status check on develop's branch
+  # protection - that's what actually blocks the merge button.
+  check-bump-label:
+    if: github.event.action != 'closed'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require a bump/major, bump/minor, bump/patch, or bump/skip label
+        env:
+          LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
+        run: |
+          echo "$LABELS" | grep -qE '"bump/(major|minor|patch|skip)"' || {
+            echo "::error::PR into develop must carry one of bump/major, bump/minor, bump/patch, bump/skip"
+            exit 1
+          }
+
+  # Runs once, after the merge has already happened, to commit the actual
+  # version bump onto develop.
+  apply-version-bump:
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: develop
+          fetch-depth: 0
+
+      - name: Determine bump level from PR labels
+        id: level
+        env:
+          LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
+        run: |
+          for lvl in major minor patch skip; do
+            if echo "$LABELS" | grep -q "\"bump/$lvl\""; then
+              echo "level=$lvl" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+          done
+          echo "::error::merged PR into develop has no bump/major, bump/minor, bump/patch, or bump/skip label"
+          exit 1
+
+      - name: Bump CMakeLists.txt and flake.nix
+        if: steps.level.outputs.level != 'skip'
+        env:
+          LEVEL: ${{ steps.level.outputs.level }}
+        run: |
+          set -euo pipefail
+
+          CURRENT=$(grep -oP '(?<=VERSION )[0-9]+(\.[0-9]+){1,2}' CMakeLists.txt | head -1)
+
+          # Pad to 3 components so a pre-existing 2-component version (e.g.
+          # "0.1") still splits into MAJOR/MINOR/PATCH correctly.
+          IFS='.' read -r MAJOR MINOR PATCH <<< "${CURRENT}.0.0"
+
+          case "$LEVEL" in
+            major) MAJOR=$((MAJOR + 1)); MINOR=0; PATCH=0 ;;
+            minor) MINOR=$((MINOR + 1)); PATCH=0 ;;
+            patch) PATCH=$((PATCH + 1)) ;;
+          esac
+
+          NEW="$MAJOR.$MINOR.$PATCH"
+
+          sed -i "s/VERSION ${CURRENT}/VERSION ${NEW}/" CMakeLists.txt
+          sed -i "s/version = \"${CURRENT}\"/version = \"${NEW}\"/" flake.nix
+
+          echo "CURRENT_VERSION=${CURRENT}" >> "$GITHUB_ENV"
+          echo "NEW_VERSION=${NEW}" >> "$GITHUB_ENV"
+
+      - name: Commit and push
+        if: steps.level.outputs.level != 'skip'
+        run: |
+          set -euo pipefail
+          if [ "$CURRENT_VERSION" = "$NEW_VERSION" ]; then
+            echo "::error::version did not change (${CURRENT_VERSION} -> ${NEW_VERSION})"
+            exit 1
+          fi
+          git config user.name "gitea-actions"
+          git config user.email "actions@noreply.localhost"
+          git add CMakeLists.txt flake.nix
+          git commit -m "Bump version to ${NEW_VERSION}"
+          git push origin HEAD:develop