diff --git a/VERSION b/VERSION
new file mode 100644
index 0000000..5c13e7f
--- /dev/null
+++ b/VERSION
@@ -0,0 +1 @@
+2026.5.22
diff --git a/backend/Dockerfile b/backend/Dockerfile
index 52774f6..11ae9e1 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -7,6 +7,9 @@ WORKDIR /app
 COPY package*.json ./
 RUN npm ci
 COPY . .
+# VERSION must be copied into the build context before `docker build`.
+# In CI / deploy scripts run: cp VERSION backend/VERSION  (or pass --build-arg)
+COPY VERSION ./
 RUN npm run build
 
 # Stage 2: Production
@@ -17,9 +20,10 @@ WORKDIR /app
 COPY package*.json ./
 RUN npm ci --omit=dev && npm cache clean --force
 
-# Copy compiled output and New Relic preload from builder
+# Copy compiled output, New Relic preload, and VERSION from builder
 COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/newrelic-preload.js ./newrelic-preload.js
+COPY --from=builder /app/VERSION ./VERSION
 
 # New Relic agent — configured entirely via environment variables
 ENV NEW_RELIC_NO_CONFIG_FILE=true
diff --git a/backend/src/app.controller.ts b/backend/src/app.controller.ts
index 8f8d114..65acacc 100644
--- a/backend/src/app.controller.ts
+++ b/backend/src/app.controller.ts
@@ -1,4 +1,20 @@
 import { Controller, Get } from '@nestjs/common';
+import { readFileSync } from 'fs';
+import { resolve } from 'path';
+
+// Read at module load time — one I/O call for the lifetime of the process.
+// VERSION file lives at the container root (/app/VERSION), mounted from the
+// repo root via docker-compose. Falls back to package.json version if absent
+// (e.g. in environments that pass APP_VERSION as an env var instead).
+function readAppVersion(): string {
+  try {
+    return readFileSync(resolve(process.cwd(), 'VERSION'), 'utf-8').trim();
+  } catch {
+    return process.env.APP_VERSION ?? 'unknown';
+  }
+}
+
+const APP_VERSION = readAppVersion();
 
 @Controller()
 export class AppController {
@@ -13,6 +29,7 @@ export class AppController {
   getRoot() {
     return {
       status: 'ok',
+      version: APP_VERSION,
       timestamp: new Date().toISOString(),
       service: 'hoa-financial-platform',
     };
@@ -23,6 +40,7 @@ export class AppController {
   getHealth() {
     return {
       status: 'ok',
+      version: APP_VERSION,
       timestamp: new Date().toISOString(),
       service: 'hoa-financial-platform',
     };
diff --git a/backend/src/common/interceptors/newrelic-transaction.interceptor.ts b/backend/src/common/interceptors/newrelic-transaction.interceptor.ts
index 71adeaa..e471bb9 100644
--- a/backend/src/common/interceptors/newrelic-transaction.interceptor.ts
+++ b/backend/src/common/interceptors/newrelic-transaction.interceptor.ts
@@ -1,12 +1,15 @@
 import { Injectable, NestInterceptor, ExecutionContext, CallHandler } from '@nestjs/common';
 import { Observable } from 'rxjs';
 import { Request } from 'express';
+import { readFileSync } from 'fs';
+import { resolve } from 'path';
 
 /**
- * Sets a meaningful New Relic transaction name for every HTTP request.
+ * Sets a meaningful New Relic transaction name for every HTTP request and
+ * tags each transaction with the running app version.
  *
- * Without this, NestJS's setGlobalPrefix('api') causes the New Relic Express
- * instrumentation to group ALL requests under the generic bucket
+ * Without the name override, NestJS's setGlobalPrefix('api') causes the New Relic
+ * Express instrumentation to group ALL requests under the generic bucket
  * "Expressjs/GET/api$" (the compiled regex for the global prefix router),
  * making per-endpoint APM data completely blind.
  *
@@ -14,12 +17,25 @@ import { Request } from 'express';
  * the matched pattern, e.g. "/api/accounts/:id") and calls newrelic.setTransactionName()
  * to override the auto-detected name with "METHOD /route/pattern".
  *
+ * The appVersion custom attribute lets you filter / compare releases in NRQL:
+ *   SELECT average(duration) FROM Transaction WHERE appVersion = '2026.5.22'
+ *
  * Gracefully no-ops when:
  *  - NEW_RELIC_ENABLED is not 'true' (dev / CI)
  *  - newrelic package is not installed
  *  - The NR agent fails to load for any reason
  */
 
+function readAppVersion(): string {
+  try {
+    return readFileSync(resolve(process.cwd(), 'VERSION'), 'utf-8').trim();
+  } catch {
+    return process.env.APP_VERSION ?? 'unknown';
+  }
+}
+
+const APP_VERSION = readAppVersion();
+
 let newrelic: any;
 try {
   if (process.env.NEW_RELIC_ENABLED === 'true') {
@@ -40,6 +56,9 @@ export class NewRelicTransactionInterceptor implements NestInterceptor {
       // 404s get a useful name like "GET /api/unknown-path" instead of "Expressjs/GET/api$".
       const route: string = (req.route as any)?.path ?? req.path;
       newrelic.setTransactionName(`${req.method} ${route}`);
+      // Tag every transaction with the release version so you can segment NR
+      // dashboards and alerts by deployment.
+      newrelic.addCustomAttribute('appVersion', APP_VERSION);
     }
     return next.handle();
   }
diff --git a/docker-compose.yml b/docker-compose.yml
index 63cdc0a..d176d0c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -60,6 +60,7 @@ services:
       - ./backend/nest-cli.json:/app/nest-cli.json
       - ./backend/tsconfig.json:/app/tsconfig.json
       - ./backend/tsconfig.build.json:/app/tsconfig.build.json
+      - ./VERSION:/app/VERSION:ro
     depends_on:
       postgres:
         condition: service_healthy
@@ -80,6 +81,7 @@ services:
       - ./frontend/src:/app/src
       - ./frontend/index.html:/app/index.html
       - ./frontend/vite.config.ts:/app/vite.config.ts
+      - ./VERSION:/app/VERSION:ro
     depends_on:
       - backend
     networks:
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index b56bd2b..ebee601 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -7,6 +7,9 @@ WORKDIR /app
 COPY package*.json ./
 RUN npm ci
 COPY . .
+# VERSION must be copied into the build context before `docker build`.
+# In CI / deploy scripts run: cp VERSION frontend/VERSION  (or pass VITE_APP_VERSION as build arg)
+COPY VERSION ./
 RUN npm run build
 
 # Stage 2: Serve with nginx
diff --git a/frontend/src/pages/settings/SettingsPage.tsx b/frontend/src/pages/settings/SettingsPage.tsx
index 272de0c..a2abb9b 100644
--- a/frontend/src/pages/settings/SettingsPage.tsx
+++ b/frontend/src/pages/settings/SettingsPage.tsx
@@ -237,7 +237,7 @@ export function SettingsPage() {
             </Group>
             <Group justify="space-between">
               <Text size="sm" c="dimmed">Version</Text>
-              <Badge variant="light">2026.4.6</Badge>
+              <Badge variant="light">{__APP_VERSION__}</Badge>
             </Group>
             <Group justify="space-between">
               <Text size="sm" c="dimmed">API</Text>
diff --git a/frontend/src/vite-env.d.ts b/frontend/src/vite-env.d.ts
index 2399b4a..8faf3dc 100644
--- a/frontend/src/vite-env.d.ts
+++ b/frontend/src/vite-env.d.ts
@@ -4,3 +4,6 @@ declare module '*.svg' {
   const src: string;
   export default src;
 }
+
+/** Injected by vite.config.ts define — value comes from the root /VERSION file. */
+declare const __APP_VERSION__: string;
diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
index de3bd57..d251344 100644
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@@ -1,9 +1,27 @@
 import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
 import path from 'path';
+import fs from 'fs';
+
+// Read the canonical version from /VERSION (repo root, mounted at /app/VERSION in Docker).
+// Falls back to the VITE_APP_VERSION env var so production Docker builds can pass it
+// as a build arg (--build-arg VITE_APP_VERSION=$(cat VERSION)) without needing the file.
+function readAppVersion(): string {
+  try {
+    return fs.readFileSync(path.resolve(__dirname, 'VERSION'), 'utf-8').trim();
+  } catch {
+    return process.env.VITE_APP_VERSION ?? 'dev';
+  }
+}
+
+const APP_VERSION = readAppVersion();
 
 export default defineConfig({
   plugins: [react()],
+  define: {
+    // Injected at compile time — use __APP_VERSION__ anywhere in frontend source.
+    __APP_VERSION__: JSON.stringify(APP_VERSION),
+  },
   resolve: {
     alias: {
       '@': path.resolve(__dirname, './src'),