diff --git a/Containerfile b/Containerfile
index 76ec03b..2396a8e 100644
--- a/Containerfile
+++ b/Containerfile
@@ -3,6 +3,11 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 
 FROM docker.io/library/alpine:3.18.0 as dhall-cache
+# https://stackoverflow.com/questions/53681522/share-variable-in-multi-stage-dockerfile-arg-before-from-not-substituted
+# https://docs.docker.com/engine/reference/builder/#arg
+ARG VERSION
+ARG BUILD_DATE
+ARG VCS_REF
 ENV XDG_CACHE_HOME=/var/cache
 ENV DHALL_VERSION=1.42.0
 
@@ -19,6 +24,8 @@ RUN tar xf /tmp/dhall.tar.bz2 \
 
 FROM docker.io/library/golang:1.20.4-alpine3.17 as go-build
 ARG VERSION
+ARG BUILD_DATE
+ARG VCS_REF
 
 COPY . /go/pcmt
 
@@ -26,22 +33,20 @@ WORKDIR /go/pcmt
 
 RUN apk add --no-cache npm=9.1.2-r0 \
     && go generate -v . \
-    && CGO_ENABLED=0 GOLDFLAGS="-s -w -X main.version=${VERSION:-prod}" \
-    go build -trimpath -v .
+    && CGO_ENABLED=0 \
+    go build -v -trimpath -ldflags="-s -w -X main.version=${VERSION:-prod}" .
 
 
 FROM docker.io/immawanderer/scratch-cacerts:linux-amd64
+ARG BUILD_DATE
+ARG VCS_REF
+ENV XDG_CACHE_HOME=/root/.cache
 
 COPY --from=dhall-cache /var/cache/dhall-haskell /root/.cache/dhall-haskell
 COPY --from=dhall-cache /var/cache/dhall         /root/.cache/dhall
 COPY --from=dhall-cache /tmp/exampleConfig.dhall /etc/pcmt/config.dhall
 COPY --from=go-build    /go/pcmt/pcmt            /bin/pcmt
 
-ARG BUILD_DATE
-ARG VCS_REF
-
-ENV XDG_CACHE_HOME=/root/.cache
-
 LABEL description="Password Compromise Monitoring Tool" \
       org.label-schema.build-date=$BUILD_DATE \
       org.label-schema.vcs-url="https://git.dotya.ml/mirre-mt/pcmt.git" \
diff --git a/run.go b/run.go
index c2fa175..944123f 100644
--- a/run.go
+++ b/run.go
@@ -38,6 +38,7 @@ const (
 ╚═╝      ╚═════╝╚═╝     ╚═╝   ╚═╝
 `
 	slug = `Password Compromise Monitoring Tool
+version: '%s'
 https://git.dotya.ml/mirre-mt/pcmt
 ____________________________________`
 
@@ -64,6 +65,7 @@ var (
 	configIsPathFlag = flag.Bool("configIsPath", true, "Whether the provided config is path or raw config")
 	devel            = flag.Bool("devel", false, "Run the application in dev mode, connect to a local browser-sync instance for hot-reloading")
 	license          = flag.Bool("license", false, "Print licensing information and exit")
+	versionFlag      = flag.Bool("version", false, "Print version and exit")
 	importFlag       = flag.String("import", "", "Path to import breach data from")
 	version          = "dev"
 	// the global logger.
@@ -80,6 +82,11 @@ func run() error { //nolint:gocognit
 		return nil
 	}
 
+	if *versionFlag {
+		fmt.Fprintf(os.Stderr, "pcmt version %s\n", version)
+		return nil
+	}
+
 	var doingImport bool
 
 	if importFlag != nil && *importFlag != "" {
@@ -251,6 +258,8 @@ func run() error { //nolint:gocognit
 }
 
 func printHeader() {
+	slug := fmt.Sprintf(slug, version)
+
 	fmt.Fprintf(os.Stderr,
 		"\033[34m%s%s\033[0m\n\n\n",
 		banner,