diff --git a/Makefile b/Makefile
index 84dc642..6bf12ab 100644
--- a/Makefile
+++ b/Makefile
@@ -4,8 +4,10 @@
   MAKEOPTS = $(MAKEOPTS)
 #endif
 
+GIT_COMMIT := $(shell git rev-list -1 HEAD)
+VERSION := 0.8.4
 #ifeq ($(BUILDOPTS),)
-  BUILDOPTS = $(BUILDOPTS)
+BUILDOPTS :=$(BUILDOPTS)" -ldflags \"-X main.version=$(VERSION) -X main.gitCommit=$(GIT_COMMIT)\""
 #endif
 
 SUBPKGS = logger spinsult hkexnet
@@ -24,27 +26,28 @@ clean:
 
 subpkgs:
 	for d in $(SUBPKGS); do\
-	  $(MAKE) -C $$d all;\
+	  $(MAKE) BUILDOPTS=$(BUILDOPTS) -C $$d all;\
 	done
 
 tools:
 	for d in $(TOOLS); do\
-	  $(MAKE) -C $$d all;\
+	  $(MAKE) BUILDOPTS=$(BUILDOPTS) -C $$d all;\
 	done
 
 
 common:
+	go build .
 	go install .
 
 
 client: common
-	$(MAKE) -C hkexsh
+	$(MAKE) BUILDOPTS=$(BUILDOPTS) -C hkexsh
 
 
 ifeq ($(MSYSTEM),)
 ifneq ($(GOOS),windows)
 server: common
-	$(MAKE) -C hkexshd
+	$(MAKE) BUILDOPTS=$(BUILDOPTS) -C hkexshd
 else
 	echo "Cross-build of hkexshd server for Windows not yet supported"
 endif
@@ -55,7 +58,7 @@ endif
 
 
 passwd: common
-	$(MAKE) -C hkexpasswd
+	$(MAKE) BUILDOPTS=$(BUILDOPTS) -C hkexpasswd
 
 vis:
 	@which go-callvis >/dev/null 2>&1; \
diff --git a/consts.go b/consts.go
index 527d952..56d54c8 100644
--- a/consts.go
+++ b/consts.go
@@ -8,6 +8,3 @@
 package hkexsh
 
 // common constants for the HKExSh
-
-// Version string returned by tools
-const Version = "0.8.4 (NO WARRANTY)"
diff --git a/hkexpasswd/Makefile b/hkexpasswd/Makefile
index 8300059..0e3475f 100644
--- a/hkexpasswd/Makefile
+++ b/hkexpasswd/Makefile
@@ -4,7 +4,7 @@ EXTPKGS = bytes,errors,flag,fmt,internal,io,log,net,os,path,runtime,time,strings
 EXE = $(notdir $(shell pwd))
 
 all:
-	go build .
+	go build $(BUILDOPTS) .
 
 clean:
 	$(RM) $(EXE) $(EXE).exe
diff --git a/hkexpasswd/hkexpasswd.go b/hkexpasswd/hkexpasswd.go
index 8e51164..f02028c 100644
--- a/hkexpasswd/hkexpasswd.go
+++ b/hkexpasswd/hkexpasswd.go
@@ -21,17 +21,29 @@ import (
 	"github.com/jameskeane/bcrypt"
 )
 
+var (
+	version   string
+	gitCommit string
+)
+
 // nolint: gocyclo
 func main() {
+	var vopt bool
 	var pfName string
 	var newpw string
 	var confirmpw string
 	var userName string
 
+	flag.BoolVar(&vopt, "v", false, "show version")
 	flag.StringVar(&userName, "u", "", "username")
 	flag.StringVar(&pfName, "f", "/etc/hkexsh.passwd", "passwd file")
 	flag.Parse()
 
+	if vopt {
+		fmt.Printf("version %s (%s)\n", version, gitCommit)
+		os.Exit(0)
+	}
+
 	var uname string
 	if len(userName) == 0 {
 		log.Println("specify username with -u")
diff --git a/hkexsh/Makefile b/hkexsh/Makefile
index ea7eb69..8e2fd39 100644
--- a/hkexsh/Makefile
+++ b/hkexsh/Makefile
@@ -4,6 +4,7 @@ EXTPKGS = bytes,errors,flag,fmt,internal,io,log,net,os,path,runtime,time,strings
 EXE = $(notdir $(shell pwd))
 
 all:
+	echo "BUILDOPTS:" $(BUILDOPTS)
 	go build $(BUILDOPTS) .
 
 clean:
diff --git a/hkexsh/hkexsh.go b/hkexsh/hkexsh.go
index c1c58db..d8a7f13 100755
--- a/hkexsh/hkexsh.go
+++ b/hkexsh/hkexsh.go
@@ -41,6 +41,9 @@ import (
 )
 
 var (
+	version   string
+	gitCommit string // set in -ldflags by build
+
 	// wg controls when the goroutines handling client I/O complete
 	wg sync.WaitGroup
 	// Log defaults to regular syslog output (no -d)
@@ -592,7 +595,6 @@ func sendSessionParams(conn io.Writer /* *hkexnet.Conn*/, rec *hkexsh.Session) (
 
 // TODO: reduce gocyclo
 func main() {
-	version := hkexsh.Version
 	var vopt bool
 	var gopt bool //login via password, asking server to generate authToken
 	var dbg bool
@@ -723,7 +725,7 @@ func main() {
 	}
 
 	if vopt {
-		fmt.Printf("version v%s\n", version)
+		fmt.Printf("version %s (%s)\n", version, gitCommit)
 		exitWithStatus(0)
 	}
 
diff --git a/hkexshd/hkexshd.go b/hkexshd/hkexshd.go
index 6584740..6d14ecc 100755
--- a/hkexshd/hkexshd.go
+++ b/hkexshd/hkexshd.go
@@ -35,6 +35,9 @@ import (
 )
 
 var (
+	version   string
+	gitCommit string // set in -ldflags by build
+
 	// Log - syslog output (with no -d)
 	Log *logger.Writer
 )
@@ -401,8 +404,6 @@ func GenAuthToken(who string, connhost string) string {
 // Compare to 'serverp.go' in this directory to see the equivalence.
 // TODO: reduce gocyclo
 func main() {
-	version := hkexsh.Version
-
 	var vopt bool
 	var chaffEnabled bool
 	var chaffFreqMin uint
@@ -421,7 +422,7 @@ func main() {
 	flag.Parse()
 
 	if vopt {
-		fmt.Printf("version v%s\n", version)
+		fmt.Printf("version %s (%s)\n", version, gitCommit)
 		os.Exit(0)
 	}