diff --git a/products/02-iac-drift-detection/saas/Dockerfile b/products/02-iac-drift-detection/saas/Dockerfile
index 47da9d6..b623f86 100644
--- a/products/02-iac-drift-detection/saas/Dockerfile
+++ b/products/02-iac-drift-detection/saas/Dockerfile
@@ -12,4 +12,8 @@ COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/package.json ./
 EXPOSE 3000
+ARG BUILD_SHA=dev
+ARG BUILD_TIME=unknown
+ENV BUILD_SHA=$BUILD_SHA
+ENV BUILD_TIME=$BUILD_TIME
 CMD ["node", "dist/index.js"]
diff --git a/products/02-iac-drift-detection/saas/src/index.ts b/products/02-iac-drift-detection/saas/src/index.ts
index fedeed3..c9635b9 100644
--- a/products/02-iac-drift-detection/saas/src/index.ts
+++ b/products/02-iac-drift-detection/saas/src/index.ts
@@ -32,6 +32,7 @@ async function start() {
 
   // Health (before auth)
   app.get('/health', async () => ({ status: 'ok' }));
+app.get('/version', async () => ({ version: process.env.BUILD_SHA || 'dev', built: process.env.BUILD_TIME || 'unknown' }));
 
   // Auth routes (signup/login)
   registerAuthRoutes(app, config.jwtSecret, pool);
diff --git a/products/03-alert-intelligence/Dockerfile b/products/03-alert-intelligence/Dockerfile
index 742aa8e..2d98443 100644
--- a/products/03-alert-intelligence/Dockerfile
+++ b/products/03-alert-intelligence/Dockerfile
@@ -11,4 +11,8 @@ COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/package.json ./
 EXPOSE 3000
+ARG BUILD_SHA=dev
+ARG BUILD_TIME=unknown
+ENV BUILD_SHA=$BUILD_SHA
+ENV BUILD_TIME=$BUILD_TIME
 CMD ["node", "dist/index.js"]
diff --git a/products/03-alert-intelligence/src/index.ts b/products/03-alert-intelligence/src/index.ts
index ecb903b..c76b470 100644
--- a/products/03-alert-intelligence/src/index.ts
+++ b/products/03-alert-intelligence/src/index.ts
@@ -19,7 +19,8 @@ await app.register(helmet);
 
 registerAuth(app, config.JWT_SECRET, pool);
 
-app.get('/health', async () => ({ status: 'ok', service: 'dd0c-alert' }));
+app.get('/health', async () => ({ status: 'ok', service: 'dd0c-alert' } /* v:c4ec43c */));
+app.get('/version', async () => ({ version: process.env.BUILD_SHA || 'dev', built: process.env.BUILD_TIME || 'unknown' }));
 
 registerAuthRoutes(app, config.JWT_SECRET, pool);
 registerWebhookRoutes(app);
diff --git a/products/04-lightweight-idp/Dockerfile b/products/04-lightweight-idp/Dockerfile
index 742aa8e..2d98443 100644
--- a/products/04-lightweight-idp/Dockerfile
+++ b/products/04-lightweight-idp/Dockerfile
@@ -11,4 +11,8 @@ COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/package.json ./
 EXPOSE 3000
+ARG BUILD_SHA=dev
+ARG BUILD_TIME=unknown
+ENV BUILD_SHA=$BUILD_SHA
+ENV BUILD_TIME=$BUILD_TIME
 CMD ["node", "dist/index.js"]
diff --git a/products/04-lightweight-idp/src/index.ts b/products/04-lightweight-idp/src/index.ts
index 18043bd..f0b82e7 100644
--- a/products/04-lightweight-idp/src/index.ts
+++ b/products/04-lightweight-idp/src/index.ts
@@ -18,7 +18,8 @@ await app.register(helmet);
 
 registerAuth(app, config.JWT_SECRET, pool);
 
-app.get('/health', async () => ({ status: 'ok', service: 'dd0c-portal' }));
+app.get('/health', async () => ({ status: 'ok', service: 'dd0c-portal' } /* v:c4ec43c */));
+app.get('/version', async () => ({ version: process.env.BUILD_SHA || 'dev', built: process.env.BUILD_TIME || 'unknown' }));
 
 registerAuthRoutes(app, config.JWT_SECRET, pool);
 registerServiceRoutes(app);
diff --git a/products/05-aws-cost-anomaly/Dockerfile b/products/05-aws-cost-anomaly/Dockerfile
index 742aa8e..2d98443 100644
--- a/products/05-aws-cost-anomaly/Dockerfile
+++ b/products/05-aws-cost-anomaly/Dockerfile
@@ -11,4 +11,8 @@ COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/package.json ./
 EXPOSE 3000
+ARG BUILD_SHA=dev
+ARG BUILD_TIME=unknown
+ENV BUILD_SHA=$BUILD_SHA
+ENV BUILD_TIME=$BUILD_TIME
 CMD ["node", "dist/index.js"]
diff --git a/products/05-aws-cost-anomaly/src/index.ts b/products/05-aws-cost-anomaly/src/index.ts
index a04467a..0702db2 100644
--- a/products/05-aws-cost-anomaly/src/index.ts
+++ b/products/05-aws-cost-anomaly/src/index.ts
@@ -17,7 +17,8 @@ await app.register(cors, { origin: config.CORS_ORIGIN });
 
 registerAuth(app, config.JWT_SECRET, pool);
 
-app.get('/health', async () => ({ status: 'ok', service: 'dd0c-cost' }));
+app.get('/health', async () => ({ status: 'ok', service: 'dd0c-cost' } /* v:c4ec43c */));
+app.get('/version', async () => ({ version: process.env.BUILD_SHA || 'dev', built: process.env.BUILD_TIME || 'unknown' }));
 
 registerAuthRoutes(app, config.JWT_SECRET, pool);
 registerIngestionRoutes(app);
diff --git a/products/06-runbook-automation/saas/Dockerfile b/products/06-runbook-automation/saas/Dockerfile
index 742aa8e..2d98443 100644
--- a/products/06-runbook-automation/saas/Dockerfile
+++ b/products/06-runbook-automation/saas/Dockerfile
@@ -11,4 +11,8 @@ COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/package.json ./
 EXPOSE 3000
+ARG BUILD_SHA=dev
+ARG BUILD_TIME=unknown
+ENV BUILD_SHA=$BUILD_SHA
+ENV BUILD_TIME=$BUILD_TIME
 CMD ["node", "dist/index.js"]
diff --git a/products/06-runbook-automation/saas/src/index.ts b/products/06-runbook-automation/saas/src/index.ts
index 6993009..f04c888 100644
--- a/products/06-runbook-automation/saas/src/index.ts
+++ b/products/06-runbook-automation/saas/src/index.ts
@@ -19,6 +19,7 @@ await app.register(helmet);
 registerAuth(app, config.JWT_SECRET, pool);
 
 app.get('/health', async () => ({ status: 'ok', service: 'dd0c-run' }));
+app.get('/version', async () => ({ version: process.env.BUILD_SHA || 'dev', built: process.env.BUILD_TIME || 'unknown' }));
 
 registerAuthRoutes(app, config.JWT_SECRET, pool);
 registerRunbookRoutes(app);
diff --git a/products/build-push.sh b/products/build-push.sh
index c3e3ce9..f302f1c 100755
--- a/products/build-push.sh
+++ b/products/build-push.sh
@@ -54,7 +54,7 @@ for img in "${TARGETS[@]}"; do
   tag="${REGISTRY}/${img}:latest"
 
   echo -e "${YELLOW}▸ Building ${img}${NC}"
-  if docker build -t "$tag" "$SCRIPT_DIR/$ctx" --no-cache; then
+  if docker build -t "$tag" --build-arg BUILD_SHA=$(git rev-parse --short HEAD) --build-arg BUILD_TIME=$(date -u +%Y%m%dT%H%M%S) "$SCRIPT_DIR/$ctx" --no-cache; then
     echo -e "${YELLOW}  Pushing ${tag}${NC}"
     if docker push "$tag"; then
       echo -e "  ${GREEN}✓${NC} ${img}"
diff --git a/products/watch-loop.sh b/products/watch-loop.sh
index 7ef183f..b440a7c 100755
--- a/products/watch-loop.sh
+++ b/products/watch-loop.sh
@@ -53,7 +53,7 @@ for prefix in "${!SERVICES[@]}"; do
     IFS=: read -r img ctx <<< "${SERVICES[$prefix]}"
     TAG="${REGISTRY}/${img}:latest"
     echo "$(date -u '+%H:%M:%S') Building $img..."
-    if docker build -t "$TAG" "./$ctx" --no-cache && docker push "$TAG"; then
+    if docker build -t "$TAG" --build-arg BUILD_SHA=$(git rev-parse --short HEAD) --build-arg BUILD_TIME=$(date -u +%Y%m%dT%H%M%S) "./$ctx" --no-cache && docker push "$TAG"; then
       echo "$(date -u '+%H:%M:%S') ✓ $img pushed"
       ((REBUILT++)) || true
     else