diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index 150e769..af7e496 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -188,6 +188,13 @@ jobs:
           echo "Properties API: $STATUS"
           [ "$STATUS" = "200" ] || (echo "❌ Properties API falhou ($STATUS)" && exit 1)
 
+      - name: Check deployed version matches image tag
+        run: |
+          RESPONSE=$(curl -s --max-time 10 "https://${{ vars.DOMAIN }}/api/version")
+          echo "Version response: $RESPONSE"
+          echo "$RESPONSE" | grep -q "${{ needs.build.outputs.image_tag }}" \
+            || (echo "❌ Version tag não confere — esperado: ${{ needs.build.outputs.image_tag }}" && exit 1)
+
       - name: All checks passed
         run: |
           echo "✅ Deploy validado com sucesso!"
diff --git a/backend/app/__init__.py b/backend/app/__init__.py
index 20f7246..4333be0 100644
--- a/backend/app/__init__.py
+++ b/backend/app/__init__.py
@@ -53,6 +53,7 @@ def create_app(config_name: str | None = None) -> Flask:
     from app.routes.analytics import analytics_bp, _should_track, record_page_view
     from app.routes.config import config_bp
     from app.routes.agents import agents_public_bp, agents_admin_bp
+    from app.routes.version import version_bp
 
     app.register_blueprint(homepage_bp)
     app.register_blueprint(properties_bp)
@@ -65,6 +66,7 @@ def create_app(config_name: str | None = None) -> Flask:
     app.register_blueprint(config_bp)
     app.register_blueprint(agents_public_bp)
     app.register_blueprint(agents_admin_bp)
+    app.register_blueprint(version_bp)
 
     @app.route("/health")
     def health():
diff --git a/backend/app/routes/version.py b/backend/app/routes/version.py
new file mode 100644
index 0000000..a3deb0b
--- /dev/null
+++ b/backend/app/routes/version.py
@@ -0,0 +1,13 @@
+import os
+from flask import Blueprint, jsonify
+
+version_bp = Blueprint("version", __name__)
+
+
+@version_bp.get("/api/version")
+def get_version():
+    """Returns the running image tag — injected at deploy time via IMAGE_TAG env var."""
+    return jsonify({
+        "version": os.environ.get("IMAGE_TAG", "dev"),
+        "env":     os.environ.get("FLASK_ENV", "development"),
+    })
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 7d3e48b..0780dce 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -26,6 +26,7 @@ services:
       FLASK_ENV: production
       FLASK_APP: app
       CORS_ORIGINS: https://${DOMAIN}
+      IMAGE_TAG: ${IMAGE_TAG:-latest}
     depends_on:
       db:
         condition: service_healthy