diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 2e5de8cc6..8de55ba91 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -40,11 +40,11 @@ jobs:
       - name: Read app version and calculate next Docker build version
         id: tag_version
         run: |
-          APP_VERSION=$(grep -E '^version = ' surfsense_backend/pyproject.toml | sed 's/version = "\(.*\)"/\1/')
-          echo "App version from pyproject.toml: $APP_VERSION"
+          APP_VERSION=$(tr -d '[:space:]' < VERSION)
+          echo "App version from VERSION file: $APP_VERSION"
 
           if [ -z "$APP_VERSION" ]; then
-            echo "Error: Could not read version from surfsense_backend/pyproject.toml"
+            echo "Error: Could not read version from VERSION file"
             exit 1
           fi
 
diff --git a/VERSION b/VERSION
new file mode 100644
index 000000000..9789c4ccb
--- /dev/null
+++ b/VERSION
@@ -0,0 +1 @@
+0.0.14
diff --git a/scripts/bump-version.sh b/scripts/bump-version.sh
new file mode 100644
index 000000000..ed7dc7ba3
--- /dev/null
+++ b/scripts/bump-version.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+VERSION_FILE="$REPO_ROOT/VERSION"
+
+if [ ! -f "$VERSION_FILE" ]; then
+  echo "ERROR: VERSION file not found at $VERSION_FILE" >&2
+  exit 1
+fi
+
+VERSION="$(tr -d '[:space:]' < "$VERSION_FILE")"
+
+if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$'; then
+  echo "ERROR: '$VERSION' is not valid semver (expected X.Y.Z)" >&2
+  exit 1
+fi
+
+echo "Bumping all packages to $VERSION"
+echo "---------------------------------"
+
+bump_json() {
+  local file="$1"
+  if [ ! -f "$file" ]; then
+    echo "  SKIP  $file (not found)"
+    return
+  fi
+  local old
+  old="$(sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$file" | head -1)"
+  if [ "$old" = "$VERSION" ]; then
+    echo "  OK    $file ($old -- already up to date)"
+  else
+    sed -i "s/\"version\": \"$old\"/\"version\": \"$VERSION\"/" "$file"
+    echo "  SET   $file ($old -> $VERSION)"
+  fi
+}
+
+bump_toml() {
+  local file="$1"
+  if [ ! -f "$file" ]; then
+    echo "  SKIP  $file (not found)"
+    return
+  fi
+  local old
+  old="$(sed -n 's/^version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' "$file" | head -1)"
+  if [ "$old" = "$VERSION" ]; then
+    echo "  OK    $file ($old -- already up to date)"
+  else
+    sed -i "s/^version = \"$old\"/version = \"$VERSION\"/" "$file"
+    echo "  SET   $file ($old -> $VERSION)"
+  fi
+}
+
+bump_json "$REPO_ROOT/surfsense_web/package.json"
+bump_json "$REPO_ROOT/surfsense_browser_extension/package.json"
+bump_json "$REPO_ROOT/surfsense_desktop/package.json"
+bump_toml "$REPO_ROOT/surfsense_backend/pyproject.toml"
+
+echo "---------------------------------"
+echo "Done. All packages set to $VERSION"