diff --git a/build.cfg b/build.cfg
index 6db6e062..bd2e6bf4 100644
--- a/build.cfg
+++ b/build.cfg
@@ -10,8 +10,10 @@ FREEBSD_MEMSTICK_URL="${FREEBSD_ISO_BASE_URL}/FreeBSD-${FREEBSD_VERSION}-${FREEB
 FREEBSD_MEMSTICK_SHA256_URL="${FREEBSD_ISO_BASE_URL}/CHECKSUM.SHA256-FreeBSD-${FREEBSD_VERSION}-${FREEBSD_ARCH}"
 
 # ISO version metadata.
-# ISO version is independent from the bundled Clawdie-AI runtime version.
-ISO_VERSION="0.1.0"
+# The ISO version tracks the zot release the image is built upon — no separately
+# invented number. "auto" resolves it at build time from the zot checkout
+# (git describe), falling back to ZOT_VERSION. Set ISO_VERSION=x.y.z to override.
+ISO_VERSION="${ISO_VERSION:-auto}"
 BUILD_CHANNEL="${BUILD_CHANNEL:-dev}"  # dev | release
 
 # Output image
diff --git a/build.sh b/build.sh
index 85be7d35..b1a42306 100755
--- a/build.sh
+++ b/build.sh
@@ -112,8 +112,23 @@ if [ "${BUILD_CHANNEL}" = "release" ]; then
     esac
 fi
 
+# ISO version tracks the zot release built upon — no separately invented number.
+# "auto" resolves from the zot checkout (git describe); else the pinned ZOT_VERSION.
+_iso_zot_repo="${ZOT_REPO:-${SCRIPT_DIR}/../zot}"
+case "${_iso_zot_repo}" in /*) ;; *) _iso_zot_repo="${SCRIPT_DIR}/${_iso_zot_repo}" ;; esac
+ZOT_RESOLVED_VERSION=""
+ZOT_RESOLVED_COMMIT=""
+if [ -d "${_iso_zot_repo}/.git" ]; then
+    ZOT_RESOLVED_VERSION="$(git -C "${_iso_zot_repo}" describe --tags --always 2>/dev/null || true)"
+    ZOT_RESOLVED_COMMIT="$(git -C "${_iso_zot_repo}" rev-parse --short=12 HEAD 2>/dev/null || true)"
+fi
+[ -n "${ZOT_RESOLVED_VERSION}" ] || ZOT_RESOLVED_VERSION="${ZOT_VERSION}"
+if [ -z "${ISO_VERSION:-}" ] || [ "${ISO_VERSION}" = "auto" ]; then
+    ISO_VERSION="${ZOT_RESOLVED_VERSION#v}"
+fi
+
 echo "==> clawdie-iso build"
-echo "    ISO     : ${ISO_VERSION}-${BUILD_CHANNEL}"
+echo "    ISO     : ${ISO_VERSION}-${BUILD_CHANNEL} (tracks zot ${ZOT_RESOLVED_VERSION})"
 echo "    FreeBSD : ${FREEBSD_VERSION} ${FREEBSD_ARCH}"
 echo "    Clawdie : ${CLAWDIE_REF}"
 echo "    Desktop : ${DEFAULT_DESKTOP}"
@@ -469,6 +484,9 @@ write_build_manifest() {
     cat > "$_manifest_path" <<EOF
 {
   "iso_version": "$(json_escape "${ISO_VERSION}")",
+  "iso_version_tracks": "zot",
+  "zot_version": "$(json_escape "${ZOT_RESOLVED_VERSION:-${ZOT_VERSION}}")",
+  "zot_commit": "$(json_escape "${ZOT_RESOLVED_COMMIT:-unknown}")",
   "build_channel": "$(json_escape "${BUILD_CHANNEL}")",
   "freebsd_version": "$(json_escape "${FREEBSD_VERSION}")",
   "freebsd_arch": "$(json_escape "${FREEBSD_ARCH}")",