diff --git a/Earthfile b/Earthfile
index 79972bb..ae5933e 100644
--- a/Earthfile
+++ b/Earthfile
@@ -53,6 +53,7 @@ lint:
 
 secretshare:
     FROM +code
+    ARG RELEASE_TAG="dev"
     ARG GOOS
     ARG GO_EXTRA_LDFLAGS
     ARG GOARCH
@@ -62,7 +63,7 @@ secretshare:
     RUN --mount=type=cache,target=$GOCACHE \
         go build \
             -o build/secretshare \
-            -ldflags "$GO_EXTRA_LDFLAGS" \
+            -ldflags "-X main.Version=$RELEASE_TAG $GO_EXTRA_LDFLAGS" \
             cmd/secretshare/main.go
     SAVE ARTIFACT build/secretshare AS LOCAL "build/$GOOS/$GOARCH/secretshare"
 
diff --git a/build/darwin/amd64/secretshare b/build/darwin/amd64/secretshare
index 5aad795..e9e01ee 100755
Binary files a/build/darwin/amd64/secretshare and b/build/darwin/amd64/secretshare differ
diff --git a/build/linux/amd64/secretshare b/build/linux/amd64/secretshare
index fae2522..2b2ba39 100755
Binary files a/build/linux/amd64/secretshare and b/build/linux/amd64/secretshare differ
diff --git a/cmd/secretshare/main.go b/cmd/secretshare/main.go
index ece737f..40af926 100644
--- a/cmd/secretshare/main.go
+++ b/cmd/secretshare/main.go
@@ -20,6 +20,8 @@ import (
 	"golang.org/x/crypto/ssh"
 )
 
+var Version = "development"
+
 func marshalRSAPrivate(priv *rsa.PrivateKey) string {
 	return string(pem.EncodeToMemory(&pem.Block{
 		Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv),
@@ -294,6 +296,19 @@ func genOrLoadKeys() (string, string, error) {
 }
 
 func main() {
+	var arg string
+	if len(os.Args) == 2 {
+		arg = os.Args[1]
+	}
+	if len(os.Args) > 2 {
+		fmt.Fprintf(os.Stderr, "only a single arg is supported\n")
+		os.Exit(1)
+	}
+	if arg == "-v" || arg == "--version" {
+		fmt.Printf("secretshare version: %s\n", Version)
+		return
+	}
+
 	test()
 	pub, priv, err := genOrLoadKeys()
 	if err != nil {
@@ -313,15 +328,13 @@ func main() {
 		return
 	}
 
-	arg := os.Args[1]
-
 	data, err := ioutil.ReadAll(os.Stdin)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "failed while reading from stdin: %s\n", err.Error())
 		os.Exit(1)
 	}
 
-	if arg == "decrypt" {
+	if arg == "decrypt" || arg == "--decrypt" || arg == "-d" || arg == "d" {
 		data2, err := decrypt(string(data), priv)
 		if err != nil {
 			fmt.Fprintf(os.Stderr, "failed while decrypting: %s\n", err.Error())