diff --git a/.gitignore b/.gitignore
index 247457f..1690420 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@ sdkconfig
 sdkconfig.old
 managed_components/
 build-*/
+tools/__pycache__/
diff --git a/CLAUDE.md b/CLAUDE.md
index 287dc09..d4e4556 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -28,6 +28,7 @@ Repo: https://gitea.apointless.space/bsncubed/aes67-ESP32-P4
   - Rev < 3 also limits Espressif's prebuilt audio libraries: `esp_audio_codec` must stay < 2.6 and `esp_audio_effects` < 1.4 (newer versions use P4 assembly that needs rev >= 3; the build fails with a message saying so). Check this for any new Espressif binary component.
 - Embed `web/index.html` via `EMBED_TXTFILES` in `aes67_web`.
 - cspot (Spotify, `external/cspot` git submodule, philippe44 fork, pinned): after cloning run `git submodule update --init external/cspot && git -C external/cspot submodule update --init cspot/bell`. Its nanopb code generator needs, in the IDF Python env: `python -m pip install protobuf grpcio-tools 'setuptools<81'` (after `. export.sh`). Our fixes to cspot/bell live in `components/spotify/patches/{cspot,bell}/*.patch` and are applied automatically at configure time; don't edit the submodule directly, add a patch.
+- Firmware version: first line of `version.txt` (e.g. `0.9.0`). Bump it for a release; editing it is enough, the next build picks it up.
 - Flash over the network (normal way since step 2b; keep USB for recovery):
   `curl -f --data-binary @build/aes67_p4.bin -H 'Content-Type: application/octet-stream' http://p4-aes67/api/ota`
   The board reboots into the new image on trial; check `GET /api/ota` shows the new version with `pending_verify: false`.
@@ -43,7 +44,7 @@ Repo: https://gitea.apointless.space/bsncubed/aes67-ESP32-P4
 - On-die temperature sensor only (driver/temperature_sensor.h).
 
 ## Build order / status
-- [x] 0. Check chip revision and flash size; create IDF project and empty component stubs (layout in aes67-core-base.md). Set up the OTA partition table (two app slots, no factory) and PROJECT_VER from git now, so the layout never changes later.
+- [x] 0. Check chip revision and flash size; create IDF project and empty component stubs (layout in aes67-core-base.md). Set up the OTA partition table (two app slots, no factory) and PROJECT_VER now, so the layout never changes later. (PROJECT_VER comes from `version.txt`, set by hand.)
 - [x] 1. Ethernet: IP101 up, DHCP, IP logged. Ping works.
 - [x] 2. Web server + config store (cJSON in NVS) + embedded index.html; /api/config, /api/status (stub values), /api/reboot.
 - [x] 2a. Finding the device: mDNS (hostname.local + _http._tcp), then LLDP (switch shows name + IP).
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2cae49d..7cbcc65 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,20 +1,9 @@
 cmake_minimum_required(VERSION 3.16)
 
-# Firmware version = git describe (tags, dirty flag). Reported by esp_app_get_description()
-# and in status.fw / GET /api/ota. CMake re-runs when git's HEAD log or index changes (commit,
-# checkout, add), so the version follows. A new tag or unstaged edits need `idf.py reconfigure`.
-set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS
-    ${CMAKE_CURRENT_LIST_DIR}/.git/logs/HEAD
-    ${CMAKE_CURRENT_LIST_DIR}/.git/index)
-execute_process(
-    COMMAND git describe --tags --always --dirty
-    WORKING_DIRECTORY ${CMAKE_CURRENT_LIST_DIR}
-    OUTPUT_VARIABLE PROJECT_VER
-    OUTPUT_STRIP_TRAILING_WHITESPACE
-    ERROR_QUIET)
-if(NOT PROJECT_VER)
-    set(PROJECT_VER "0.0.0-nogit")
-endif()
+# Firmware version = the first line of version.txt (edit it to release a new version). Reported by
+# esp_app_get_description() and in status.fw / GET /api/ota. Editing the file re-runs CMake.
+set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS ${CMAKE_CURRENT_LIST_DIR}/version.txt)
+file(STRINGS ${CMAKE_CURRENT_LIST_DIR}/version.txt PROJECT_VER LIMIT_COUNT 1)
 
 include($ENV{IDF_PATH}/tools/cmake/project.cmake)
 project(aes67_p4)
diff --git a/docs/aes67-core-base.md b/docs/aes67-core-base.md
index f2bbb3d..8d5e8af 100644
--- a/docs/aes67-core-base.md
+++ b/docs/aes67-core-base.md
@@ -125,7 +125,7 @@ When this device is the GM, offset/frequency/delay show "–".
 
 ## Firmware update (OTA)
 - Partition table: nvs, otadata, phy_init, ota_0, ota_1 (no factory app). Size the slots from flash_id; e.g. on 16 MB, 2 × 6 MB leaves room for growth (cspot + TLS + codecs). Keep NVS outside the app slots so config survives updates.
-- Version: `PROJECT_VER` from `git describe --tags --dirty`, read at runtime from `esp_app_get_description()`; also reported as `status.fw`.
+- Version: `PROJECT_VER` from the first line of `version.txt` (set by hand, e.g. `1.2.0`), read at runtime from `esp_app_get_description()`; also reported as `status.fw`.
 - API:
   - GET /api/ota -> {version, project, build_date, idf, running, previous, previous_version, pending_verify, can_rollback}
   - POST /api/ota: raw .bin as `application/octet-stream`, streamed with esp_ota_begin/write/end into the inactive slot (never buffered whole in RAM). 200 then reboot; 4xx with a message if rejected.
diff --git a/docs/user-guide.md b/docs/user-guide.md
index 2d56cfb..4962599 100644
--- a/docs/user-guide.md
+++ b/docs/user-guide.md
@@ -175,7 +175,12 @@ The log shows PTP lock/unlock, source switches, stream errors and firmware updat
 - flashes the firmware and finds the board's IP,
 - asks for a hostname, stream name and multicast address.
 
-The firmware `.bin` comes from building the project (`idf.py build` → `build/aes67_p4.bin`). This build is for ESP32-P4 chips of **revision v1.x** (the current Waveshare boards). A board with a v3 chip needs a build for that revision; the flash script refuses it with a hint.
+**Making an update file:**
+1. Set the version in **`version.txt`** (first line, e.g. `1.0.0`). This is what the page shows under *Firmware* and *Status*.
+2. Build: `idf.py build`.
+3. The update file is **`build/aes67_p4.bin`**. Upload it in the *Firmware* section, or with the `curl` command above.
+
+The .bin is for ESP32-P4 chips of **revision v1.x** (the current Waveshare boards). A board with a v3 chip needs a build for that revision; the flash script refuses it with a hint.
 
 ---
 
diff --git a/version.txt b/version.txt
new file mode 100644
index 0000000..ac39a10
--- /dev/null
+++ b/version.txt
@@ -0,0 +1 @@
+0.9.0