diff --git a/CLAUDE.md b/CLAUDE.md
index 6c03c80..f8d1f68 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -20,14 +20,15 @@ There are no automated tests in this project.
 
 ## Build-time configuration
 
-Four URLs are baked into the bundle via webpack `DefinePlugin` (see `webpack.config.js`):
+Five values are baked into the bundle via webpack `DefinePlugin` (see `webpack.config.js`):
 
 - `PKG_URL` — PostGuard Key Generation server.
 - `CRYPTIFY_URL` — Cryptify file-share service.
 - `POSTGUARD_WEBSITE_URL` — used by the SDK envelope for the browser fallback link.
 - `ADDIN_PUBLIC_URL` — the add-in's own public origin (e.g. `https://addin.postguard.eu/`). Used by `launchevent.ts` to build the Yivi dialog URL; `window.location` is unreliable in the launchevent runtime on New Outlook for Mac. Webpack picks `urlDev` in dev mode and `urlProd` (overridable via this env var) otherwise.
+- `ADDIN_VERSION` — the deployed extension version, read from `package.json` at build time. Stamped into the fourth field of `X-PostGuard-Client-Version` so PKG metrics can distinguish current vs. historical clients. release-please's `release-type: node` bumps `package.json` natively, so this stays in sync without extra config.
 
-These are read from `.env` (copy `.env.example`) or fall back to staging defaults. They are accessed through `src/lib/pkg-client.ts` — do not read `process.env` elsewhere.
+The URLs are read from `.env` (copy `.env.example`) or fall back to staging defaults; `ADDIN_VERSION` is sourced from `package.json`. All five are accessed through `src/lib/pkg-client.ts` — do not read `process.env` elsewhere.
 
 The webpack config also rewrites `https://localhost:3000/` → `ADDIN_PUBLIC_URL` (default `https://addin.postguard.eu/`) inside `manifest.xml` when building in non-development mode, so the *same* manifest is used for dev sideloading and production hosting.
 
diff --git a/src/lib/pkg-client.ts b/src/lib/pkg-client.ts
index a8e9bf3..46ec106 100644
--- a/src/lib/pkg-client.ts
+++ b/src/lib/pkg-client.ts
@@ -8,6 +8,9 @@ export const POSTGUARD_WEBSITE_URL: string = process.env.POSTGUARD_WEBSITE_URL a
 // OnMessageSend launchevent runtime to construct the Yivi dialog URL —
 // window.location is unreliable there on New Outlook for Mac.
 export const ADDIN_PUBLIC_URL: string = process.env.ADDIN_PUBLIC_URL as string;
+// Injected from package.json at build time so the fourth field of the
+// client-version header tracks the deployed release automatically.
+export const ADDIN_VERSION: string = process.env.ADDIN_VERSION as string;
 
 export const CLIENT_NAME = "Outlook";
 export const CLIENT_ID = "pg4ol";
diff --git a/src/taskpane/compose-view.ts b/src/taskpane/compose-view.ts
index a937566..51ba0a6 100644
--- a/src/taskpane/compose-view.ts
+++ b/src/taskpane/compose-view.ts
@@ -23,7 +23,13 @@ import {
 import { toBase64 } from "../lib/encoding";
 import { EMAIL_ATTRIBUTE_TYPE } from "../lib/attributes";
 import { Policy, MimeAttachment } from "../lib/types";
-import { PKG_URL, CRYPTIFY_URL, POSTGUARD_WEBSITE_URL, clientHeaders } from "../lib/pkg-client";
+import {
+  PKG_URL,
+  CRYPTIFY_URL,
+  POSTGUARD_WEBSITE_URL,
+  ADDIN_VERSION,
+  clientHeaders,
+} from "../lib/pkg-client";
 import { POSTGUARD_ENCRYPTED_FILENAME } from "../lib/mime";
 import { buildSignAttributes, getEncryptionEnabled } from "../lib/settings";
 import { t } from "../lib/i18n";
@@ -36,8 +42,6 @@ import {
 import { mountPolicyPanel } from "./policy-editor";
 import { showView, setStatus, showError } from "./taskpane";
 
-const ADDIN_VERSION = "0.1.0";
-
 // Internet-header keys shared with the OnMessageSend handler. Custom header
 // names must be x-prefixed.
 //
diff --git a/src/taskpane/read-view.ts b/src/taskpane/read-view.ts
index fbfa31b..0106ea4 100644
--- a/src/taskpane/read-view.ts
+++ b/src/taskpane/read-view.ts
@@ -26,13 +26,11 @@ import {
   readMimeHeader,
 } from "../lib/mime";
 import { Badge, FriendlySender } from "../lib/types";
-import { PKG_URL, CRYPTIFY_URL, clientHeaders } from "../lib/pkg-client";
+import { PKG_URL, CRYPTIFY_URL, ADDIN_VERSION, clientHeaders } from "../lib/pkg-client";
 import { t } from "../lib/i18n";
 import { stringifyError } from "../lib/stringify-error";
 import { showView, setStatus, showError } from "./taskpane";
 
-const ADDIN_VERSION = "0.1.0";
-
 interface ReadState {
   ciphertext: Uint8Array | null;
   recipientEmail: string;
diff --git a/src/yivi-dialog/yivi-dialog.ts b/src/yivi-dialog/yivi-dialog.ts
index 5f50685..76c49d9 100644
--- a/src/yivi-dialog/yivi-dialog.ts
+++ b/src/yivi-dialog/yivi-dialog.ts
@@ -10,7 +10,13 @@
 
 import { PostGuard, buildMime, UploadSessionExpiredError } from "@e4a/pg-js";
 import { toBase64, fromBase64 } from "../lib/encoding";
-import { PKG_URL, CRYPTIFY_URL, POSTGUARD_WEBSITE_URL } from "../lib/pkg-client";
+import {
+  PKG_URL,
+  CRYPTIFY_URL,
+  POSTGUARD_WEBSITE_URL,
+  ADDIN_VERSION,
+  clientHeaders,
+} from "../lib/pkg-client";
 import { ChunkAssembler, chunkPayload, isChunkMessage, ChunkMessage } from "../lib/dialog-chunk";
 import { stringifyError } from "../lib/stringify-error";
 import {
@@ -19,8 +25,6 @@ import {
   probeAndClearPendingUpload,
 } from "../lib/pending-upload";
 
-const ADDIN_VERSION = "0.1.0";
-
 interface AttachmentPayload {
   name: string;
   type: string;
@@ -131,9 +135,7 @@ async function runEncryption(req: EncryptRequest): Promise<EncryptResult> {
   const pg = new PostGuard({
     pkgUrl: PKG_URL,
     cryptifyUrl: CRYPTIFY_URL,
-    headers: {
-      "X-PostGuard-Client-Version": `Outlook,1.0,pg4outlook,${ADDIN_VERSION}`,
-    },
+    headers: clientHeaders(ADDIN_VERSION),
   } as never);
 
   const recipients = [...req.to, ...req.cc].map((email) =>
diff --git a/webpack.config.js b/webpack.config.js
index 39bebe3..748b47e 100644
--- a/webpack.config.js
+++ b/webpack.config.js
@@ -6,6 +6,8 @@ const HtmlWebpackPlugin = require("html-webpack-plugin");
 const webpack = require("webpack");
 require("dotenv").config();
 
+const { version: PACKAGE_VERSION } = require("./package.json");
+
 const urlDev = "https://localhost:3000/";
 const urlProd = process.env.ADDIN_PUBLIC_URL || "https://addin.postguard.eu/";
 
@@ -92,6 +94,10 @@ module.exports = async (env, options) => {
         // override (JSRuntime.Url) where window.location is an Office-
         // internal URL, not the add-in origin.
         "process.env.ADDIN_PUBLIC_URL": JSON.stringify(dev ? urlDev : urlProd),
+        // Fourth field of the X-PostGuard-Client-Version header. Sourced
+        // from package.json so release-please's version bumps flow through
+        // automatically — no separate constant to forget to update.
+        "process.env.ADDIN_VERSION": JSON.stringify(PACKAGE_VERSION),
       }),
       new HtmlWebpackPlugin({
         filename: "taskpane.html",