diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5f2d5d8..1edb52b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,10 +7,40 @@ permissions:
   contents: read
 
 jobs:
+  validate-version:
+    name: Validate monorepo version
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Normalize release tag for SemVer validation
+        id: normalize-tag
+        run: |
+          raw_tag="${{ github.event.release.tag_name }}"
+          if [[ "$raw_tag" =~ ^[vV](.+)$ ]]; then
+            semver_tag="${BASH_REMATCH[1]}"
+          else
+            semver_tag="$raw_tag"
+          fi
+          echo "semver_tag=$semver_tag" >> "$GITHUB_OUTPUT"
+
+      - name: Validate shared version against release tag
+        run: python3 scripts/wefa_version.py check --expect "${{ steps.normalize-tag.outputs.semver_tag }}"
+
   publish-bff-image:
     name: Build, tag and publish BFF image
     if: ${{ !github.event.release.draft }}
     runs-on: ubuntu-latest
+    needs: validate-version
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -21,15 +51,15 @@ jobs:
       - name: Login to registry
         uses: docker/login-action@v3
         with:
-          registry: ${{ secrets.OCI_REGISTRY_HOST }}
-          username: ${{ secrets.OCI_REGISTRY_USERNAME }}
-          password: ${{ secrets.OCI_REGISTRY_PASSWORD }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Compute image metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ secrets.OCI_REGISTRY_HOST }}/${{ secrets.OCI_BFF_IMAGE_REPOSITORY }}
+          images: ghcr.io/${{ github.repository }}/bff
           tags: |
             type=raw,value=${{ github.event.release.tag_name }}
             type=raw,value=latest,enable=${{ !github.event.release.prerelease }}
@@ -46,6 +76,7 @@ jobs:
   publish-npm:
     name: Publish Vue package to npm
     runs-on: ubuntu-latest
+    needs: validate-version
     permissions:
       id-token: write
     defaults:
@@ -82,6 +113,7 @@ jobs:
   publish-pypi:
     name: Publish Django package to PyPI
     runs-on: ubuntu-latest
+    needs: validate-version
     environment:
       name: pypi
       url: https://pypi.org/p/nside-wefa
diff --git a/.github/workflows/scripts.yml b/.github/workflows/scripts.yml
new file mode 100644
index 0000000..bcffd54
--- /dev/null
+++ b/.github/workflows/scripts.yml
@@ -0,0 +1,29 @@
+name: Scripts CI
+
+on:
+  pull_request:
+    paths:
+      - 'scripts/**'
+      - '.github/workflows/scripts.yml'
+  push:
+    branches: [ main, develop ]
+    paths:
+      - 'scripts/**'
+      - '.github/workflows/scripts.yml'
+  workflow_dispatch:
+
+jobs:
+  tests:
+    name: Scripts Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Run scripts unit tests
+        run: python3 -m unittest discover -s scripts -p 'test_*.py'
diff --git a/README.md b/README.md
index 910f5f9..66826ef 100644
--- a/README.md
+++ b/README.md
@@ -63,6 +63,32 @@ See the [Vue README](vue/README.md) for build scripts, Storybook, and component
 
 The demo apps in both workspaces illustrate how to compose the packages together.
 
+## Release Versioning
+
+This monorepo uses one shared version across `vue/`, `django/`, and `bff/`.
+Use the root orchestrator script for any version change:
+
+```bash
+python3 scripts/wefa_version.py -h
+python3 scripts/wefa_version.py show
+python3 scripts/wefa_version.py check --expect <x.y.z[-prerelease]>
+python3 scripts/wefa_version.py bump patch
+python3 scripts/wefa_version.py set 1.0.0-rc.1
+```
+
+Use `--dry-run` to preview changes and `--allow-dirty-version-files` only when you intentionally need to override preflight checks.
+
+Use SemVer for CLI inputs and release tags (for example `1.2.3-rc.1`). For prereleases, only
+`alpha.<N>`, `beta.<N>`, and `rc.<N>` are supported. Python project files are written in PEP 440
+equivalent form (`1.2.3a1`, `1.2.3b1`, `1.2.3rc1`) by the orchestrator.
+
+### BFF Container Image
+
+When a GitHub release is published, CI builds and pushes the BFF Docker image to GitHub Container Registry (GHCR):
+
+- `ghcr.io/n-side-dev/wefa/bff:<release-tag>`
+- `ghcr.io/n-side-dev/wefa/bff:latest` for non-prerelease tags only
+
 ## Contributing
 
 Contributions are welcome! Start with open issues or propose new ideas through GitHub discussions. Please read [Django CONTRIBUTE](django/CONTRIBUTE.md) and/or [Vue CONTRIBUTE](vue/CONTRIBUTE.md) for the current contribution workflow.
diff --git a/django/CONTRIBUTE.md b/django/CONTRIBUTE.md
index bfa409e..165c16a 100644
--- a/django/CONTRIBUTE.md
+++ b/django/CONTRIBUTE.md
@@ -337,6 +337,7 @@ When making changes:
 - Update the main README if adding new features
 - Keep examples up to date
 - Update version numbers as needed
+- For monorepo releases, run version bumps from the repository root with `python3 scripts/wefa_version.py`
 
 ### API Documentation
 
@@ -354,4 +355,4 @@ If you have questions or need help:
 3. Create a new issue with detailed information
 4. Tag maintainers if urgent
 
-Thank you for contributing to N-SIDE WeFa!
\ No newline at end of file
+Thank you for contributing to N-SIDE WeFa!
diff --git a/scripts/test_wefa_version.py b/scripts/test_wefa_version.py
new file mode 100644
index 0000000..63b7e5f
--- /dev/null
+++ b/scripts/test_wefa_version.py
@@ -0,0 +1,104 @@
+import argparse
+import importlib.util
+import sys
+import tempfile
+from pathlib import Path
+from unittest import TestCase, mock
+
+
+MODULE_PATH = Path(__file__).with_name("wefa_version.py")
+SPEC = importlib.util.spec_from_file_location("wefa_version_module", MODULE_PATH)
+assert SPEC and SPEC.loader
+wefa_version = importlib.util.module_from_spec(SPEC)
+sys.modules[SPEC.name] = wefa_version
+SPEC.loader.exec_module(wefa_version)
+
+
+MIXED_RC_VERSIONS = {
+    "vue/package.json": "1.0.0-rc.1",
+    "vue/package-lock.json": "1.0.0-rc.1",
+    "django/pyproject.toml": "1.0.0rc1",
+    "django/uv.lock": "1.0.0rc1",
+    "django/nside_wefa/__init__.py": "1.0.0rc1",
+    "bff/pyproject.toml": "1.0.0rc1",
+    "bff/uv.lock": "1.0.0rc1",
+}
+
+
+class WefaVersionTests(TestCase):
+    def test_semver_to_pep440_conversion(self) -> None:
+        self.assertEqual(
+            wefa_version.semver_to_python_version("1.2.3-rc.4", flag_name="version"),
+            "1.2.3rc4",
+        )
+        self.assertEqual(
+            wefa_version.semver_to_python_version("1.2.3-alpha.2", flag_name="version"),
+            "1.2.3a2",
+        )
+        self.assertEqual(
+            wefa_version.semver_to_python_version("1.2.3-beta.7", flag_name="version"),
+            "1.2.3b7",
+        )
+
+    def test_pep440_to_semver_conversion(self) -> None:
+        self.assertEqual(
+            wefa_version.pep440_to_semver("1.2.3rc4", flag_name="version"),
+            "1.2.3-rc.4",
+        )
+        self.assertEqual(
+            wefa_version.pep440_to_semver("1.2.3a2", flag_name="version"),
+            "1.2.3-alpha.2",
+        )
+        self.assertEqual(
+            wefa_version.pep440_to_semver("1.2.3b7", flag_name="version"),
+            "1.2.3-beta.7",
+        )
+
+    def test_rejects_unsupported_semver_prerelease_label(self) -> None:
+        with self.assertRaisesRegex(ValueError, "prerelease label must be one of"):
+            wefa_version.build_version_targets("1.2.3-preview.1", flag_name="version")
+
+    def test_supported_prerelease_label_is_canonicalized_to_lowercase(self) -> None:
+        targets = wefa_version.build_version_targets("1.2.3-RC.1", flag_name="version")
+        self.assertEqual(targets.semver, "1.2.3-rc.1")
+        self.assertEqual(targets.python, "1.2.3rc1")
+
+    def test_unified_version_accepts_mixed_semver_and_pep440(self) -> None:
+        self.assertEqual(wefa_version.unified_version(MIXED_RC_VERSIONS), "1.0.0-rc.1")
+
+    def test_check_expect_semver_matches_pep440_python_sources(self) -> None:
+        args = argparse.Namespace(expect="1.0.0-rc.1")
+        with mock.patch.object(wefa_version, "collect_versions", return_value=MIXED_RC_VERSIONS):
+            self.assertEqual(wefa_version.cmd_check(args), 0)
+
+    def test_post_update_assertions_require_expected_serialization(self) -> None:
+        targets = wefa_version.build_version_targets("1.0.0-rc.1", flag_name="version")
+
+        with mock.patch.object(wefa_version, "collect_versions", return_value=MIXED_RC_VERSIONS):
+            wefa_version.post_update_assertions(targets)
+
+        wrong_versions = dict(MIXED_RC_VERSIONS)
+        wrong_versions["django/pyproject.toml"] = "1.0.0-rc.1"
+        with mock.patch.object(wefa_version, "collect_versions", return_value=wrong_versions):
+            with self.assertRaisesRegex(RuntimeError, "expected 1.0.0rc1"):
+                wefa_version.post_update_assertions(targets)
+
+    def test_transactional_update_restores_files_on_failure(self) -> None:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            path = Path(tmpdir) / "version.txt"
+            path.write_text("before\n", encoding="utf-8")
+            source = wefa_version.VersionSource(
+                path=path,
+                reader=lambda p: p.read_text(encoding="utf-8").strip(),
+                version_format=wefa_version.VERSION_FORMAT_SEMVER,
+            )
+
+            def mutate() -> None:
+                path.write_text("after\n", encoding="utf-8")
+                raise RuntimeError("boom")
+
+            with mock.patch.object(wefa_version, "VERSION_SOURCES", (source,)):
+                with self.assertRaisesRegex(RuntimeError, "restored tracked version files"):
+                    wefa_version.run_transactional_version_update(mutate)
+
+            self.assertEqual(path.read_text(encoding="utf-8"), "before\n")
diff --git a/scripts/wefa_version.py b/scripts/wefa_version.py
new file mode 100644
index 0000000..6299d73
--- /dev/null
+++ b/scripts/wefa_version.py
@@ -0,0 +1,583 @@
+#!/usr/bin/env python3
+"""Unified monorepo version orchestrator for vue, django, and bff."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import shlex
+import subprocess
+import sys
+import tomllib
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Callable
+
+ROOT = Path(__file__).resolve().parent.parent
+
+SEMVER_RE = re.compile(
+    r"^(?P<major>0|[1-9]\d*)\."
+    r"(?P<minor>0|[1-9]\d*)\."
+    r"(?P<patch>0|[1-9]\d*)"
+    r"(?:-(?P<prerelease>"
+    r"(?:0|[1-9]\d*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)"
+    r"(?:\.(?:0|[1-9]\d*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*))*"
+    r"))?$"
+)
+
+PEP440_RE = re.compile(
+    r"^(?P<major>0|[1-9]\d*)\."
+    r"(?P<minor>0|[1-9]\d*)\."
+    r"(?P<patch>0|[1-9]\d*)"
+    r"(?:(?P<label>a|b|rc)(?P<number>0|[1-9]\d*))?$"
+)
+
+DJANGO_PACKAGE_NAME = "nside-wefa"
+BFF_PACKAGE_NAME = "backend-for-frontend"
+VERSION_FORMAT_SEMVER = "semver"
+VERSION_FORMAT_PEP440 = "pep440"
+
+PRERELEASE_LABEL_TO_PEP440 = {
+    "alpha": "a",
+    "beta": "b",
+    "rc": "rc",
+}
+PEP440_LABEL_TO_PRERELEASE = {
+    "a": "alpha",
+    "b": "beta",
+    "rc": "rc",
+}
+
+
+@dataclass(frozen=True)
+class VersionSource:
+    path: Path
+    reader: Callable[[Path], str]
+    version_format: str
+
+
+@dataclass(frozen=True)
+class VersionTargets:
+    semver: str
+    python: str
+
+
+def relpath(path: Path) -> str:
+    return path.relative_to(ROOT).as_posix()
+
+
+def read_json_version(path: Path) -> str:
+    data = json.loads(path.read_text(encoding="utf-8"))
+    version = data.get("version")
+    if not isinstance(version, str):
+        raise ValueError("missing top-level version")
+    return version
+
+
+def read_package_lock_version(path: Path) -> str:
+    data = json.loads(path.read_text(encoding="utf-8"))
+    root_version = data.get("version")
+    packages = data.get("packages", {})
+    package_root = packages.get("", {}) if isinstance(packages, dict) else {}
+    package_version = package_root.get("version")
+    if not isinstance(root_version, str):
+        raise ValueError("missing top-level version")
+    if not isinstance(package_version, str):
+        raise ValueError('missing packages[""].version')
+    if root_version != package_version:
+        raise ValueError(
+            f"inconsistent package-lock versions: root={root_version}, packages[\"\"]={package_version}"
+        )
+    return root_version
+
+
+def read_pyproject_version(path: Path) -> str:
+    data = tomllib.loads(path.read_text(encoding="utf-8"))
+    project = data.get("project")
+    if not isinstance(project, dict):
+        raise ValueError("missing [project] section")
+    version = project.get("version")
+    if not isinstance(version, str):
+        raise ValueError("missing project.version")
+    return version
+
+
+def read_uv_lock_package_version(path: Path, package_name: str) -> str:
+    data = tomllib.loads(path.read_text(encoding="utf-8"))
+    packages = data.get("package")
+    if not isinstance(packages, list):
+        raise ValueError("missing package entries")
+
+    matched_versions = [
+        pkg.get("version")
+        for pkg in packages
+        if isinstance(pkg, dict) and pkg.get("name") == package_name
+    ]
+    matched_versions = [value for value in matched_versions if isinstance(value, str)]
+    if len(matched_versions) != 1:
+        raise ValueError(f"expected exactly one package named {package_name!r}, found {len(matched_versions)}")
+    return matched_versions[0]
+
+
+def read_django_init_version(path: Path) -> str:
+    text = path.read_text(encoding="utf-8")
+    match = re.search(r'(?m)^__version__\s*=\s*"([^"]+)"\s*$', text)
+    if not match:
+        raise ValueError("missing __version__ assignment")
+    return match.group(1)
+
+
+VERSION_SOURCES: tuple[VersionSource, ...] = (
+    VersionSource(ROOT / "vue/package.json", read_json_version, VERSION_FORMAT_SEMVER),
+    VersionSource(ROOT / "vue/package-lock.json", read_package_lock_version, VERSION_FORMAT_SEMVER),
+    VersionSource(ROOT / "django/pyproject.toml", read_pyproject_version, VERSION_FORMAT_PEP440),
+    VersionSource(
+        ROOT / "django/uv.lock",
+        lambda path: read_uv_lock_package_version(path, DJANGO_PACKAGE_NAME),
+        VERSION_FORMAT_PEP440,
+    ),
+    VersionSource(ROOT / "django/nside_wefa/__init__.py", read_django_init_version, VERSION_FORMAT_PEP440),
+    VersionSource(ROOT / "bff/pyproject.toml", read_pyproject_version, VERSION_FORMAT_PEP440),
+    VersionSource(
+        ROOT / "bff/uv.lock",
+        lambda path: read_uv_lock_package_version(path, BFF_PACKAGE_NAME),
+        VERSION_FORMAT_PEP440,
+    ),
+)
+
+VERSION_SOURCE_BY_PATH = {relpath(source.path): source for source in VERSION_SOURCES}
+
+
+def collect_versions() -> dict[str, str]:
+    versions: dict[str, str] = {}
+    for source in VERSION_SOURCES:
+        try:
+            version = source.reader(source.path)
+        except Exception as exc:  # pragma: no cover - defensive branch
+            raise RuntimeError(f"failed to read version from {relpath(source.path)}: {exc}") from exc
+        versions[relpath(source.path)] = version
+    return versions
+
+
+def ensure_valid_semver(value: str, *, flag_name: str) -> re.Match[str]:
+    match = SEMVER_RE.fullmatch(value)
+    if not match:
+        raise ValueError(
+            f"invalid {flag_name} {value!r}; expected strict SemVer (e.g. 1.2.3 or 1.2.3-rc.1)"
+        )
+    return match
+
+
+def canonicalize_semver(value: str, *, flag_name: str) -> str:
+    match = ensure_valid_semver(value, flag_name=flag_name)
+    base = f"{match.group('major')}.{match.group('minor')}.{match.group('patch')}"
+    prerelease = match.group("prerelease")
+    if prerelease is None:
+        return base
+    parts = prerelease.split(".")
+    if len(parts) == 2 and parts[1].isdigit():
+        normalized_label = parts[0].lower()
+        if normalized_label in PRERELEASE_LABEL_TO_PEP440:
+            return f"{base}-{normalized_label}.{parts[1]}"
+    return f"{base}-{prerelease}"
+
+
+def semver_to_python_version(value: str, *, flag_name: str) -> str:
+    match = ensure_valid_semver(value, flag_name=flag_name)
+    base = f"{match.group('major')}.{match.group('minor')}.{match.group('patch')}"
+    prerelease = match.group("prerelease")
+    if prerelease is None:
+        return base
+
+    parts = prerelease.split(".")
+    if len(parts) != 2 or not parts[1].isdigit():
+        raise ValueError(
+            f"invalid {flag_name} {value!r}; prerelease must be <alpha|beta|rc>.<number> "
+            "to stay compatible with Python package metadata"
+        )
+
+    label = parts[0].lower()
+    number = parts[1]
+    pep440_label = PRERELEASE_LABEL_TO_PEP440.get(label)
+    if pep440_label is None:
+        raise ValueError(
+            f"invalid {flag_name} {value!r}; prerelease label must be one of "
+            f"{', '.join(sorted(PRERELEASE_LABEL_TO_PEP440))}"
+        )
+    return f"{base}{pep440_label}{number}"
+
+
+def pep440_to_semver(value: str, *, flag_name: str) -> str:
+    match = PEP440_RE.fullmatch(value)
+    if not match:
+        raise ValueError(
+            f"invalid {flag_name} {value!r}; expected PEP 440 core version (e.g. 1.2.3rc1)"
+        )
+
+    base = f"{match.group('major')}.{match.group('minor')}.{match.group('patch')}"
+    label = match.group("label")
+    number = match.group("number")
+    if label is None:
+        return base
+    semver_label = PEP440_LABEL_TO_PRERELEASE[label]
+    return f"{base}-{semver_label}.{number}"
+
+
+def normalize_recorded_version(path: str, value: str) -> str:
+    try:
+        return canonicalize_semver(value, flag_name=f"version in {path}")
+    except ValueError:
+        pass
+    try:
+        return pep440_to_semver(value, flag_name=f"version in {path}")
+    except ValueError as exc:
+        raise ValueError(
+            f"unsupported version format in {path}: {value!r}; expected strict SemVer or "
+            "PEP 440 prerelease form (a/b/rc)"
+        ) from exc
+
+
+def unified_version(versions: dict[str, str]) -> str | None:
+    normalized = {path: normalize_recorded_version(path, value) for path, value in versions.items()}
+    unique = sorted(set(normalized.values()))
+    if len(unique) == 1:
+        return unique[0]
+    return None
+
+
+def render_versions(versions: dict[str, str]) -> str:
+    lines = [f"- {path}: {version}" for path, version in versions.items()]
+    return "\n".join(lines)
+
+
+def build_version_targets(value: str, *, flag_name: str) -> VersionTargets:
+    semver = canonicalize_semver(value, flag_name=flag_name)
+    python = semver_to_python_version(value, flag_name=flag_name)
+    return VersionTargets(semver=semver, python=python)
+
+
+def bump_semver(version: str, part: str) -> str:
+    match = SEMVER_RE.fullmatch(version)
+    if not match:
+        raise ValueError(f"cannot bump non-SemVer version {version!r}")
+    major = int(match.group("major"))
+    minor = int(match.group("minor"))
+    patch = int(match.group("patch"))
+    if part == "major":
+        return f"{major + 1}.0.0"
+    if part == "minor":
+        return f"{major}.{minor + 1}.0"
+    if part == "patch":
+        return f"{major}.{minor}.{patch + 1}"
+    raise ValueError(f"unknown bump part {part!r}")
+
+
+def tracked_version_paths() -> list[str]:
+    return [relpath(source.path) for source in VERSION_SOURCES]
+
+
+def git_dirty_version_files() -> list[str]:
+    command = ["git", "status", "--porcelain", "--", *tracked_version_paths()]
+    result = subprocess.run(
+        command,
+        cwd=ROOT,
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+    if result.returncode != 0:
+        raise RuntimeError(f"failed to inspect git status: {result.stderr.strip()}")
+
+    dirty: list[str] = []
+    for line in result.stdout.splitlines():
+        entry = line[3:]
+        if " -> " in entry:
+            entry = entry.split(" -> ", 1)[1]
+        dirty.append(entry)
+    return sorted(set(dirty))
+
+
+def ensure_dirty_preflight_allowed(allow_dirty: bool) -> None:
+    dirty_files = git_dirty_version_files()
+    if not dirty_files or allow_dirty:
+        return
+    formatted = "\n".join(f"- {path}" for path in dirty_files)
+    raise RuntimeError(
+        "refusing to run with modified version files:\n"
+        f"{formatted}\n"
+        "commit/revert those changes first, or use --allow-dirty-version-files"
+    )
+
+
+def run_command(command: list[str]) -> None:
+    print(f"+ {' '.join(shlex.quote(part) for part in command)}")
+    subprocess.run(command, cwd=ROOT, check=True)
+
+
+def expected_version_for_path(path: str, targets: VersionTargets) -> str:
+    source = VERSION_SOURCE_BY_PATH.get(path)
+    if source is None:
+        raise RuntimeError(f"unknown version source path {path!r}")
+    if source.version_format == VERSION_FORMAT_SEMVER:
+        return targets.semver
+    if source.version_format == VERSION_FORMAT_PEP440:
+        return targets.python
+    raise RuntimeError(f"unsupported version format {source.version_format!r} for {path}")
+
+
+def snapshot_version_file_contents() -> dict[Path, str]:
+    return {source.path: source.path.read_text(encoding="utf-8") for source in VERSION_SOURCES}
+
+
+def restore_version_file_contents(snapshot: dict[Path, str]) -> None:
+    for path, content in snapshot.items():
+        path.write_text(content, encoding="utf-8")
+
+
+def run_transactional_version_update(action: Callable[[], None]) -> None:
+    snapshot = snapshot_version_file_contents()
+    try:
+        action()
+    except Exception as exc:
+        try:
+            restore_version_file_contents(snapshot)
+        except Exception as rollback_exc:  # pragma: no cover - defensive branch
+            raise RuntimeError(
+                "version update failed and rollback could not restore tracked version files"
+            ) from rollback_exc
+        raise RuntimeError(f"version update failed; restored tracked version files ({exc})") from exc
+
+
+def update_django_init_version(target_version: str) -> None:
+    path = ROOT / "django/nside_wefa/__init__.py"
+    text = path.read_text(encoding="utf-8")
+    pattern = re.compile(r'(?m)^__version__\s*=\s*"([^"]+)"\s*$')
+    match = pattern.search(text)
+    if not match:
+        raise RuntimeError(f"unable to locate __version__ in {relpath(path)}")
+    if match.group(1) == target_version:
+        return
+    updated, replacements = pattern.subn(f'__version__ = "{target_version}"', text, count=1)
+    if replacements != 1:
+        raise RuntimeError(f"unable to update __version__ in {relpath(path)}")
+    path.write_text(updated, encoding="utf-8")
+
+
+def post_update_assertions(targets: VersionTargets) -> None:
+    versions = collect_versions()
+    mismatches: list[str] = []
+    for path, actual in versions.items():
+        expected = expected_version_for_path(path, targets)
+        if actual != expected:
+            mismatches.append(f"- {path}: expected {expected}, found {actual}")
+    if mismatches:
+        formatted = "\n".join(mismatches)
+        raise RuntimeError(
+            "post-update validation failed; files do not match expected serialized versions:\n"
+            f"{formatted}"
+        )
+
+    merged = unified_version(versions)
+    if merged != targets.semver:
+        raise RuntimeError(
+            "post-update validation failed; files are not aligned:\n"
+            f"{render_versions(versions)}"
+        )
+
+
+def print_change_summary() -> None:
+    dirty_files = git_dirty_version_files()
+    if not dirty_files:
+        print("No version files changed.")
+        return
+    print("Changed version files:")
+    for path in dirty_files:
+        print(f"- {path}")
+
+
+def preflight_for_mutation(command_name: str, allow_dirty: bool) -> dict[str, str]:
+    versions = collect_versions()
+    if command_name == "bump" and unified_version(versions) is None:
+        raise RuntimeError(
+            "cannot bump because version sources are inconsistent:\n"
+            f"{render_versions(versions)}\n"
+            "run `set <version>` first to realign all projects"
+        )
+    ensure_dirty_preflight_allowed(allow_dirty)
+    return versions
+
+
+def cmd_show(_: argparse.Namespace) -> int:
+    versions = collect_versions()
+    merged = unified_version(versions)
+    if merged is None:
+        print("Version mismatch detected:", file=sys.stderr)
+        print(render_versions(versions), file=sys.stderr)
+        return 1
+    print(merged)
+    return 0
+
+
+def cmd_check(args: argparse.Namespace) -> int:
+    versions = collect_versions()
+    merged = unified_version(versions)
+    if merged is None:
+        print("Version mismatch detected:", file=sys.stderr)
+        print(render_versions(versions), file=sys.stderr)
+        return 1
+
+    if args.expect:
+        expected = build_version_targets(args.expect, flag_name="--expect")
+        if merged != expected.semver:
+            print(
+                f"Version mismatch: expected {expected.semver}, found {merged}",
+                file=sys.stderr,
+            )
+            return 1
+    print(f"OK: {merged}")
+    return 0
+
+
+def cmd_set(args: argparse.Namespace) -> int:
+    targets = build_version_targets(args.version, flag_name="version")
+    current_versions = preflight_for_mutation("set", args.allow_dirty_version_files)
+    current = unified_version(current_versions)
+
+    if args.dry_run:
+        print(f"Dry run: would set monorepo version to {targets.semver}")
+        if targets.python != targets.semver:
+            print(f"Python projects will use normalized PEP 440 value: {targets.python}")
+        if current is not None:
+            print(f"Current unified version: {current}")
+        else:
+            print("Current versions are inconsistent:")
+            print(render_versions(current_versions))
+        print("Files in scope:")
+        for path in tracked_version_paths():
+            print(f"- {path}")
+        return 0
+
+    def mutate() -> None:
+        run_command(["uv", "version", "--project", "django", targets.python, "--no-sync"])
+        run_command(["uv", "version", "--project", "bff", targets.python, "--no-sync"])
+        run_command(
+            [
+                "npm",
+                "--prefix",
+                "vue",
+                "version",
+                targets.semver,
+                "--no-git-tag-version",
+                "--allow-same-version",
+            ]
+        )
+        update_django_init_version(targets.python)
+        post_update_assertions(targets)
+
+    run_transactional_version_update(mutate)
+    print(f"Updated monorepo version to {targets.semver}")
+    print_change_summary()
+    return 0
+
+
+def cmd_bump(args: argparse.Namespace) -> int:
+    versions = preflight_for_mutation("bump", args.allow_dirty_version_files)
+    current = unified_version(versions)
+    assert current is not None  # validated in preflight
+
+    target = bump_semver(current, args.part)
+    targets = build_version_targets(target, flag_name="bumped version")
+    if args.dry_run:
+        print(f"Dry run: would bump version from {current} to {targets.semver}")
+        if targets.python != targets.semver:
+            print(f"Python projects will use normalized PEP 440 value: {targets.python}")
+        print("Files in scope:")
+        for path in tracked_version_paths():
+            print(f"- {path}")
+        return 0
+
+    def mutate() -> None:
+        run_command(["uv", "version", "--project", "django", targets.python, "--no-sync"])
+        run_command(["uv", "version", "--project", "bff", targets.python, "--no-sync"])
+        run_command(
+            [
+                "npm",
+                "--prefix",
+                "vue",
+                "version",
+                targets.semver,
+                "--no-git-tag-version",
+                "--allow-same-version",
+            ]
+        )
+        update_django_init_version(targets.python)
+        post_update_assertions(targets)
+
+    run_transactional_version_update(mutate)
+    print(f"Bumped monorepo version from {current} to {targets.semver}")
+    print_change_summary()
+    return 0
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        description="Manage the shared monorepo version across vue, django, and bff."
+    )
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    parser_show = subparsers.add_parser("show", help="Show the unified monorepo version.")
+    parser_show.set_defaults(func=cmd_show)
+
+    parser_check = subparsers.add_parser("check", help="Check that all project versions are aligned.")
+    parser_check.add_argument(
+        "--expect",
+        help="Assert the unified version matches this SemVer value (prerelease: alpha|beta|rc.<N>).",
+    )
+    parser_check.set_defaults(func=cmd_check)
+
+    parser_set = subparsers.add_parser("set", help="Set the unified monorepo version.")
+    parser_set.add_argument(
+        "version",
+        help="Target SemVer version (prerelease must be alpha|beta|rc.<N> for Python compatibility).",
+    )
+    parser_set.add_argument("--dry-run", action="store_true", help="Preview changes without writing files.")
+    parser_set.add_argument(
+        "--allow-dirty-version-files",
+        action="store_true",
+        help="Allow running when tracked version files are already modified.",
+    )
+    parser_set.set_defaults(func=cmd_set)
+
+    parser_bump = subparsers.add_parser("bump", help="Bump the unified monorepo version.")
+    parser_bump.add_argument("part", choices=["major", "minor", "patch"], help="Version segment to bump.")
+    parser_bump.add_argument("--dry-run", action="store_true", help="Preview changes without writing files.")
+    parser_bump.add_argument(
+        "--allow-dirty-version-files",
+        action="store_true",
+        help="Allow running when tracked version files are already modified.",
+    )
+    parser_bump.set_defaults(func=cmd_bump)
+
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+    try:
+        return args.func(args)
+    except ValueError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 1
+    except RuntimeError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 1
+    except subprocess.CalledProcessError as exc:
+        command = " ".join(shlex.quote(part) for part in exc.cmd)
+        print(f"error: command failed ({exc.returncode}): {command}", file=sys.stderr)
+        return exc.returncode or 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/vue/CONTRIBUTE.md b/vue/CONTRIBUTE.md
index 69d80ff..75fe194 100644
--- a/vue/CONTRIBUTE.md
+++ b/vue/CONTRIBUTE.md
@@ -114,10 +114,17 @@ Document deviations from these gates in the pull request summary and explain the
 Our first public release will be automated through GitHub Actions. For now follow the manual flow when testing locally:
 
 ```bash
-npm version <major|minor|patch>
+cd ..
+python3 scripts/wefa_version.py bump <major|minor|patch>
+# or:
+python3 scripts/wefa_version.py set <x.y.z[-prerelease]>
+cd vue
 npm publish --access public
 ```
 
+Use SemVer when calling the script. Prerelease identifiers are limited to `alpha.<N>`, `beta.<N>`,
+or `rc.<N>`. Python package files are written with the equivalent PEP 440 prerelease notation.
+
 Do not publish from feature branches. Coordinate releases through a dedicated pull request, obtain approvals, update the changelog, and tag the release. Once CI is in place the workflow will be updated here.
 
 ---
diff --git a/vue/README.md b/vue/README.md
index 2f84180..5e8a344 100644
--- a/vue/README.md
+++ b/vue/README.md
@@ -184,13 +184,21 @@ We welcome pull requests! Start with [`CONTRIBUTE`](CONTRIBUTE.md) for the full
 
 ## Release process
 
-Versioning currently follows SemVer. To test a release locally:
+Versioning for this repository is managed from the monorepo root so `vue`, `django`, and `bff` stay aligned:
 
 ```bash
-npm version <major|minor|patch>
+cd ..
+python3 scripts/wefa_version.py bump <major|minor|patch>
+# or:
+python3 scripts/wefa_version.py set <x.y.z[-prerelease]>
+cd vue
 npm publish --access public
 ```
 
+The version script expects SemVer for user input and tags. For prereleases, use
+`alpha.<N>`, `beta.<N>`, or `rc.<N>`; Python package files are automatically normalized to PEP 440
+(`a`, `b`, `rc`) during updates.
+
 ## Testing the library locally
 
 If you want to test the library locally on a project using WeFa, you can do it with the following steps:
@@ -209,4 +217,4 @@ npm pack
 ```bash
 # Install the packed dependency
 npm i /ABSOLUTE_PATH_TO_THE_PACK/nside-wefa-0.3.0.tgz
-```
\ No newline at end of file
+```