diff --git a/go.mod b/go.mod
index 993ca93..2bf0eac 100644
--- a/go.mod
+++ b/go.mod
@@ -256,7 +256,7 @@
 	github.com/coredns/caddy v1.1.1 // indirect
 	github.com/coreos/go-iptables v0.6.0 // indirect
 	github.com/coreos/go-oidc v2.1.0+incompatible // indirect
-	github.com/coreos/go-semver v0.3.0 // indirect
+	github.com/coreos/go-semver v0.3.0
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
 	github.com/cosiner/argv v0.1.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
diff --git a/version/BUILD.bazel b/version/BUILD.bazel
new file mode 100644
index 0000000..f03d9c0
--- /dev/null
+++ b/version/BUILD.bazel
@@ -0,0 +1,9 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "version",
+    srcs = ["version.go"],
+    importpath = "source.monogon.dev/version",
+    visibility = ["//visibility:public"],
+    deps = ["//version/spec"],
+)
diff --git a/version/defs.bzl b/version/defs.bzl
new file mode 100644
index 0000000..d0e439b
--- /dev/null
+++ b/version/defs.bzl
@@ -0,0 +1,79 @@
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "GoLibrary",
+    "go_context",
+    "go_library",
+)
+
+def _go_version_library_impl(ctx):
+    output = ctx.actions.declare_file(ctx.attr.name + "_generated.go")
+
+    ctx.actions.run(
+        mnemonic = "GenVersion",
+        progress_message = "Generating version file",
+        inputs = [ctx.info_file],
+        outputs = [output],
+        executable = ctx.executable._genversion,
+        arguments = [
+            "-importpath",
+            ctx.attr.importpath,
+            "-product",
+            ctx.attr.product,
+            "-status_file",
+            ctx.info_file.path,
+            "-out_file",
+            output.path,
+        ],
+    )
+
+    go = go_context(ctx)
+    source_files = [output]
+    library = go.new_library(
+        go,
+        srcs = source_files,
+    )
+    source = go.library_to_source(go, ctx.attr, library, False)
+    providers = [library, source]
+    output_groups = {
+        "go_generated_srcs": source_files,
+    }
+    return providers + [OutputGroupInfo(**output_groups)]
+
+go_version_library = rule(
+    doc = """
+        Generate a Go library target which can be further embedded/depended upon
+        by other Go code. This library contains a Version proto field which will
+        be automatically populated with version based on build state data.
+    """,
+    implementation = _go_version_library_impl,
+    attrs = {
+        "importpath": attr.string(
+            mandatory = True,
+        ),
+        "product": attr.string(
+            mandatory = True,
+            doc = """
+                Name of Monogon product that for which this version library will
+                be generated. This must correspond to the product name as used in
+                Git tags, which in turn is used to extract a release version
+                during a build.
+            """,
+        ),
+        "_genversion": attr.label(
+            default = Label("//version/stampgo"),
+            cfg = "host",
+            executable = True,
+            allow_files = True,
+        ),
+        "_go_context_data": attr.label(
+            default = "@io_bazel_rules_go//:go_context_data",
+        ),
+        "deps": attr.label_list(
+            default = [
+                "@org_golang_google_protobuf//proto",
+                "//version/spec",
+            ],
+        ),
+    },
+    toolchains = ["@io_bazel_rules_go//go:toolchain"],
+)
diff --git a/version/spec/spec.proto b/version/spec/spec.proto
index 8d43535..2f638ec 100644
--- a/version/spec/spec.proto
+++ b/version/spec/spec.proto
@@ -19,7 +19,6 @@
         int64 major = 1;
         int64 minor = 2;
         int64 patch = 3;
-        repeated string prerelease = 4;
     }
     Release release = 1;
 
diff --git a/version/stampgo/BUILD.bazel b/version/stampgo/BUILD.bazel
new file mode 100644
index 0000000..cbcca39
--- /dev/null
+++ b/version/stampgo/BUILD.bazel
@@ -0,0 +1,19 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+    name = "stampgo_lib",
+    srcs = ["main.go"],
+    importpath = "source.monogon.dev/version/stampgo",
+    visibility = ["//visibility:private"],
+    deps = [
+        "//version/spec",
+        "@com_github_coreos_go_semver//semver",
+        "@org_golang_google_protobuf//proto",
+    ],
+)
+
+go_binary(
+    name = "stampgo",
+    embed = [":stampgo_lib"],
+    visibility = ["//visibility:public"],
+)
diff --git a/version/stampgo/main.go b/version/stampgo/main.go
new file mode 100644
index 0000000..0ce658a
--- /dev/null
+++ b/version/stampgo/main.go
@@ -0,0 +1,187 @@
+// Package main implements 'stampgo', a tool to convert build status data into a
+// version.spec.Version proto, which is then embedded into a Go source file.
+package main
+
+import (
+	"bufio"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/coreos/go-semver/semver"
+	"google.golang.org/protobuf/proto"
+
+	"source.monogon.dev/version/spec"
+)
+
+var (
+	flagStatusFile string
+	flagOutFile    string
+	flagImportpath string
+	flagProduct    string
+)
+
+var (
+	rePrereleaseCommitOffset = regexp.MustCompile(`^dev([0-9]+)$`)
+	rePrereleaseDirty        = regexp.MustCompile(`^dirty$`)
+	rePrereleaseGitHash      = regexp.MustCompile(`^g[0-9a-f]+$`)
+)
+
+func init() {
+	flag.StringVar(&flagStatusFile, "status_file", "", "path to bazel workspace status file")
+	flag.StringVar(&flagOutFile, "out_file", "version.go", "path to os-release output file")
+	flag.StringVar(&flagImportpath, "importpath", "", "importpath of generated source")
+	flag.StringVar(&flagProduct, "product", "", "product name within the monogon source tree")
+}
+
+// parseStatusFile reads and parses a Bazel build status file and returns
+// a string -> string map based on its contents.
+func parseStatusFile(path string) (map[string]string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, fmt.Errorf("open failed: %w", err)
+	}
+	defer f.Close()
+
+	res := make(map[string]string)
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := scanner.Text()
+		parts := strings.Split(line, " ")
+		if len(parts) != 2 {
+			return nil, fmt.Errorf("invalid line: %q", line)
+		}
+		k, v := parts[0], parts[1]
+		if k == "" {
+			return nil, fmt.Errorf("invalid line: %q", line)
+		}
+		if _, ok := res[k]; ok {
+			return nil, fmt.Errorf("repeated key %q", k)
+		}
+		res[k] = v
+	}
+	return res, nil
+}
+
+func main() {
+	flag.Parse()
+	if flagImportpath == "" {
+		log.Fatalf("Importpath must be set")
+	}
+	importpathParts := strings.Split(flagImportpath, "/")
+	packageName := importpathParts[len(importpathParts)-1]
+
+	values, err := parseStatusFile(flagStatusFile)
+	if err != nil {
+		log.Fatalf("Failed to read workspace status file: %v", err)
+	}
+
+	commitHash := values["STABLE_MONOGON_gitCommit"]
+	if commitHash == "" {
+		log.Fatalf("No git commit in workspace status")
+	}
+	if len(commitHash) < 8 {
+		log.Fatalf("Git commit hash too short")
+	}
+	buildTreeState := spec.Version_GitInformation_BUILD_TREE_STATE_INVALID
+	switch values["STABLE_MONOGON_gitTreeState"] {
+	case "clean":
+		buildTreeState = spec.Version_GitInformation_BUILD_TREE_STATE_CLEAN
+	case "dirty":
+		buildTreeState = spec.Version_GitInformation_BUILD_TREE_STATE_DIRTY
+	default:
+		log.Fatalf("Invalid git tree state %q", values["STABLE_MONOGON_gitTreeState"])
+	}
+
+	version := &spec.Version{
+		GitInformation: &spec.Version_GitInformation{
+			CommitHash:     commitHash[:8],
+			BuildTreeState: buildTreeState,
+		},
+	}
+
+	productVersion := values["STABLE_MONOGON_"+flagProduct+"_version"]
+	if productVersion != "" {
+		if productVersion[0] != 'v' {
+			log.Fatalf("Invalid %s version %q: does not start with v", flagProduct, productVersion)
+		}
+		productVersion = productVersion[1:]
+		v, err := semver.NewVersion(productVersion)
+		if err != nil {
+			log.Fatalf("Invalid %s version %q: %v", flagProduct, productVersion, err)
+		}
+		// Parse prerelease strings (v1.2.3-foo-bar -> [foo, bar])
+		for _, el := range v.PreRelease.Slice() {
+			// Skip empty slices which happens when there's a semver string with no
+			// prerelease data.
+			if el == "" {
+				continue
+			}
+			preCommitOffset := rePrereleaseCommitOffset.FindStringSubmatch(el)
+			preDirty := rePrereleaseDirty.FindStringSubmatch(el)
+			preGitHash := rePrereleaseGitHash.FindStringSubmatch(el)
+			switch {
+			case preCommitOffset != nil:
+				offset, err := strconv.ParseUint(preCommitOffset[1], 10, 64)
+				if err != nil {
+					log.Fatalf("Invalid commit offset value: %v", err)
+				}
+				version.GitInformation.CommitsSinceRelease = offset
+			case preDirty != nil:
+				// Ignore field, we have it from the global monorepo state.
+			case preGitHash != nil:
+				// Ignore field, we have it from the global monorepo state.
+			default:
+				log.Fatalf("Invalid prerelease string %q (in %q)", el, productVersion)
+			}
+		}
+		version.Release = &spec.Version_Release{
+			Major: v.Major,
+			Minor: v.Minor,
+			Patch: v.Patch,
+		}
+	}
+
+	versionBytes, err := proto.Marshal(version)
+	literalBytes := make([]string, len(versionBytes))
+	for i, by := range versionBytes {
+		literalBytes[i] = fmt.Sprintf("0x%02x", by)
+	}
+
+	content := []string{
+		`// Generated by //version/stampgo`,
+		`package ` + packageName,
+		``,
+		`import (`,
+		`	"fmt"`,
+		`	"os"`,
+		``,
+		`	"google.golang.org/protobuf/proto"`,
+		``,
+		`	"source.monogon.dev/version/spec"`,
+		`)`,
+		``,
+		`var raw = []byte{`,
+		`	` + strings.Join(literalBytes, ", ") + `,`,
+		`}`,
+		``,
+		`var Version *spec.Version`,
+		``,
+		`func init() {`,
+		`	var version spec.Version`,
+		`	if err := proto.Unmarshal(raw, &version); err != nil {`,
+		`		fmt.Fprintf(os.Stderr, "Invalid stamped version: %v\n", err)`,
+		`	}`,
+		`	Version = &version`,
+		`}`,
+		``,
+	}
+
+	if err := os.WriteFile(flagOutFile, []byte(strings.Join(content, "\n")), 0644); err != nil {
+		log.Fatalf("Failed to write output file: %v", err)
+	}
+}
diff --git a/version/version.go b/version/version.go
new file mode 100644
index 0000000..b495528
--- /dev/null
+++ b/version/version.go
@@ -0,0 +1,40 @@
+// Package version is a companion library to the //version/spec proto.
+package version
+
+import (
+	"fmt"
+	"strings"
+
+	"source.monogon.dev/version/spec"
+)
+
+// Release converts a spec.Version's Release field into a SemVer 2.0.0 compatible
+// string in the X.Y.Z form.
+func Release(v *spec.Version) string {
+	if v == nil || v.Release == nil {
+		return "0.0.0"
+	}
+	rel := v.Release
+	return fmt.Sprintf("%d.%d.%d", rel.Major, rel.Minor, rel.Patch)
+}
+
+// Semver converts a spec.Version proto message into a SemVer 2.0.0 compatible
+// string.
+func Semver(v *spec.Version) string {
+	ver := "v" + Release(v)
+	var prerelease []string
+	if git := v.GitInformation; git != nil {
+		if n := git.CommitsSinceRelease; n != 0 {
+			prerelease = append(prerelease, fmt.Sprintf("dev%d", n))
+		}
+		prerelease = append(prerelease, fmt.Sprintf("g%s", git.CommitHash[:8]))
+		if git.BuildTreeState != spec.Version_GitInformation_BUILD_TREE_STATE_CLEAN {
+			prerelease = append(prerelease, "dirty")
+		}
+	}
+
+	if len(prerelease) > 0 {
+		ver += "-" + strings.Join(prerelease, ".")
+	}
+	return ver
+}