diff --git a/Directory.Build.props b/Directory.Build.props
index 476fafe..fe67d70 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -1,16 +1,17 @@
 <Project>
 
-  <!-- Human-facing app version, kept equal to the pinned ezvpn.dll release
-       (native/native.targets EzvpnReleaseTag, minus the leading "v"). It is stamped
-       into the Ezvpn.App assembly (shown in the main window + tray menu, see AppInfo)
-       and used as the MSI's Add/Remove Programs "DisplayVersion" (ARPDISPLAYVERSION),
-       so the app, Programs & Features, and the bundled DLL all report the same
-       version. scripts\bump-dll.ps1 rewrites this in lockstep with the DLL pin;
-       overridable from CI. NOTE: this is NOT the MSI ProductVersion — that stays a
-       monotonically increasing build-timestamp value so MajorUpgrade keeps working
-       (see installer/Ezvpn.Installer.wixproj and .github/workflows/release.yml). -->
+  <!-- Human-facing app version. Independent of the pinned ezvpn.dll release
+       (native/native.targets EzvpnReleaseTag, surfaced separately as
+       EzvpnCoreVersion): re-pinning the DLL with scripts\bump-dll.ps1 does not
+       touch this, and bumping this does not change which DLL ships. Bump it by
+       hand when the app itself changes. It is stamped into the Ezvpn.App assembly
+       (shown in the main window + tray menu, see AppInfo) and used as the MSI's
+       Add/Remove Programs "DisplayVersion" (ARPDISPLAYVERSION); overridable from
+       CI. NOTE: this is NOT the MSI ProductVersion — that stays a monotonically
+       increasing build-timestamp value so MajorUpgrade keeps working (see
+       installer/Ezvpn.Installer.wixproj and .github/workflows/release.yml). -->
   <PropertyGroup>
-    <EzvpnVersion Condition="'$(EzvpnVersion)' == ''">0.0.44</EzvpnVersion>
+    <EzvpnAppVersion Condition="'$(EzvpnAppVersion)' == ''">0.0.44</EzvpnAppVersion>
   </PropertyGroup>
 
 </Project>
diff --git a/installer/Ezvpn.Installer.wixproj b/installer/Ezvpn.Installer.wixproj
index 77550bc..7dd251c 100644
--- a/installer/Ezvpn.Installer.wixproj
+++ b/installer/Ezvpn.Installer.wixproj
@@ -16,9 +16,9 @@
          user sees. -->
     <ProductVersion Condition="'$(ProductVersion)' == ''">0.1.0.0</ProductVersion>
     <!-- DisplayVersion is the human-facing version shown in Add/Remove Programs
-         (via ARPDISPLAYVERSION). Sourced from EzvpnVersion (Directory.Build.props)
-         so it matches the version shown inside the app. -->
-    <DisplayVersion Condition="'$(DisplayVersion)' == ''">$(EzvpnVersion)</DisplayVersion>
+         (via ARPDISPLAYVERSION). Sourced from EzvpnAppVersion (Directory.Build.props)
+         so it matches the app version shown inside the app. -->
+    <DisplayVersion Condition="'$(DisplayVersion)' == ''">$(EzvpnAppVersion)</DisplayVersion>
     <!-- Directory holding the published, self-contained Ezvpn.App plus the
          native DLLs (ezvpn.dll, wintun.dll). CI publishes there before building;
          locally it defaults to ../publish. -->
diff --git a/native/native.targets b/native/native.targets
index c00f83d..ed36d3b 100644
--- a/native/native.targets
+++ b/native/native.targets
@@ -27,9 +27,13 @@
 
     <!-- Pinned ezvpn.dll release. Fill EzvpnDllZipSha256 with scripts\bump-dll.ps1
          once an ezvpn release that includes the build-windows-lib asset exists.
-         scripts\bump-dll.ps1 also mirrors this tag (minus "v") into EzvpnVersion in
-         Directory.Build.props, which is the version the app UI + MSI report. -->
+         The tag (minus "v") is also surfaced as EzvpnCoreVersion, which Ezvpn.App
+         stamps into its assembly metadata so the UI can name the core it ships
+         next to the app's own version (EzvpnAppVersion in Directory.Build.props,
+         which is independent of this pin). A local core build (EZVPN_LOCAL_DLL)
+         still reports the pinned number: the local DLL carries none. -->
     <EzvpnReleaseTag Condition="'$(EzvpnReleaseTag)' == ''">v0.0.44</EzvpnReleaseTag>
+    <EzvpnCoreVersion>$(EzvpnReleaseTag.TrimStart('v'))</EzvpnCoreVersion>
     <EzvpnDllZipUrl>https://github.com/flexaccessdev/ezvpn/releases/download/$(EzvpnReleaseTag)/ezvpn-windows.dll.zip</EzvpnDllZipUrl>
     <EzvpnDllZipSha256>8266f394ec55b0bffcd6ed283f2778fdd43c7c130fd1f92a8a6903fde406111e</EzvpnDllZipSha256>
 
diff --git a/scripts/bump-dll.ps1 b/scripts/bump-dll.ps1
index 98aa35a..e379085 100644
--- a/scripts/bump-dll.ps1
+++ b/scripts/bump-dll.ps1
@@ -6,9 +6,10 @@
   The Windows analog of ezvpn-apple's scripts/bump-xcframework.sh. Downloads the
   release's ezvpn-windows.dll.zip, computes its SHA256, and rewrites the
   EzvpnReleaseTag + EzvpnDllZipSha256 in native\native.targets so the app build
-  downloads that exact DLL by default (no local core build needed). It also updates
-  EzvpnVersion in Directory.Build.props to the same tag (minus the leading "v") so
-  the version shown in the app UI and in Add/Remove Programs tracks the bundled DLL.
+  downloads that exact DLL by default (no local core build needed). The app's own
+  version (EzvpnAppVersion in Directory.Build.props) is independent of the DLL pin
+  and is not touched; the UI shows the pinned core version next to it via the
+  EzvpnCoreVersion property native.targets derives from the tag.
   wintun.dll is pinned separately in native.targets and is not touched here.
 
 .PARAMETER Tag
@@ -30,10 +31,7 @@ $Asset = 'ezvpn-windows.dll.zip'
 $ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
 $Targets = Join-Path $ScriptDir '..\native\native.targets'
 
-$BuildProps = Join-Path $ScriptDir '..\Directory.Build.props'
-
 if (-not (Test-Path $Targets)) { throw "native.targets not found at $Targets" }
-if (-not (Test-Path $BuildProps)) { throw "Directory.Build.props not found at $BuildProps" }
 
 if (-not $Tag) {
     if (-not (Get-Command gh -ErrorAction SilentlyContinue)) {
@@ -68,19 +66,7 @@ if ($content -notmatch [regex]::Escape("<EzvpnDllZipSha256>$Sha</EzvpnDllZipSha2
 
 Set-Content -Path $Targets -Value $content -NoNewline
 
-# Keep the human-facing app/MSI version (Directory.Build.props EzvpnVersion) in sync
-# with the pinned DLL: same tag, minus a leading "v" (0.1.0 rather than v0.1.0).
-$Version = $Tag -replace '^[vV]', ''
-$props = Get-Content $BuildProps -Raw
-$props = $props -replace '(?s)(<EzvpnVersion\b[^>]*>).*?(</EzvpnVersion>)', "`${1}$Version`${2}"
-if ($props -notmatch [regex]::Escape(">$Version</EzvpnVersion>")) {
-    throw "failed to rewrite EzvpnVersion in $BuildProps"
-}
-Set-Content -Path $BuildProps -Value $props -NoNewline
-
 Write-Host "Pinned native.targets:"
 Write-Host "  tag:      $Tag"
 Write-Host "  checksum: $Sha"
 Write-Host "  url:      $Url"
-Write-Host "Synced Directory.Build.props:"
-Write-Host "  version:  $Version"
diff --git a/src/Ezvpn.App/AppInfo.cs b/src/Ezvpn.App/AppInfo.cs
index 76a6522..3f58c30 100644
--- a/src/Ezvpn.App/AppInfo.cs
+++ b/src/Ezvpn.App/AppInfo.cs
@@ -3,16 +3,28 @@
 namespace Ezvpn.App;
 
 /// <summary>
-/// App-level metadata surfaced in the UI. The version comes from the assembly's
-/// informational version (set by &lt;Version&gt; in Ezvpn.App.csproj, overridable
-/// from CI); any build-metadata suffix (e.g. "+&lt;commit&gt;" added by SourceLink)
-/// is trimmed off.
+/// App-level metadata surfaced in the UI. The app version comes from the
+/// assembly's informational version (set by &lt;Version&gt; in Ezvpn.App.csproj from
+/// EzvpnAppVersion, overridable from CI); any build-metadata suffix (e.g.
+/// "+&lt;commit&gt;" added by SourceLink) is trimmed off. The core version is the
+/// pinned ezvpn.dll release (native.targets EzvpnReleaseTag), stamped into the
+/// assembly as the "EzvpnCoreVersion" metadata entry. The two move independently.
 /// </summary>
 public static class AppInfo
 {
     /// <summary>The app version formatted for display, e.g. "v0.1.0".</summary>
     public static string Version { get; } = ComputeVersion();
 
+    /// <summary>
+    /// The pinned ezvpn core release formatted for display, e.g. "v0.0.44". A
+    /// local core build (EZVPN_LOCAL_DLL) still reports the pinned number — the
+    /// local DLL carries none.
+    /// </summary>
+    public static string CoreVersion { get; } = ComputeCoreVersion();
+
+    /// <summary>Both numbers on one line, e.g. "v0.1.0 · core v0.0.44".</summary>
+    public static string Summary { get; } = $"{Version} · core {CoreVersion}";
+
     private static string ComputeVersion()
     {
         var informational = Assembly.GetExecutingAssembly()
@@ -24,4 +36,13 @@ private static string ComputeVersion()
 
         return "v" + version;
     }
+
+    private static string ComputeCoreVersion()
+    {
+        var core = Assembly.GetExecutingAssembly()
+            .GetCustomAttributes<AssemblyMetadataAttribute>()
+            .FirstOrDefault(a => a.Key == "EzvpnCoreVersion")?.Value;
+
+        return core is { Length: > 0 } ? "v" + core : "unknown";
+    }
 }
diff --git a/src/Ezvpn.App/Ezvpn.App.csproj b/src/Ezvpn.App/Ezvpn.App.csproj
index 1542065..81b8459 100644
--- a/src/Ezvpn.App/Ezvpn.App.csproj
+++ b/src/Ezvpn.App/Ezvpn.App.csproj
@@ -7,9 +7,9 @@
     <RootNamespace>Ezvpn.App</RootNamespace>
     <ApplicationManifest>app.manifest</ApplicationManifest>
     <!-- App version shown in the UI (main window + tray menu) and stamped into the
-         assembly. Sourced from EzvpnVersion (Directory.Build.props) so it always
+         assembly. Sourced from EzvpnAppVersion (Directory.Build.props) so it always
          matches the MSI's Add/Remove Programs DisplayVersion. -->
-    <Version Condition="'$(Version)' == ''">$(EzvpnVersion)</Version>
+    <Version Condition="'$(Version)' == ''">$(EzvpnAppVersion)</Version>
     <Platforms>x64;arm64</Platforms>
     <RuntimeIdentifiers>win-x64;win-arm64</RuntimeIdentifiers>
     <!-- WinUI needs a RID to build. Default to win-x64 so `dotnet build` (and a
@@ -58,6 +58,13 @@
        (verified by SHA256) and copies them into the build / publish output. -->
   <Import Project="..\..\native\native.targets" />
 
+  <!-- The pinned ezvpn.dll release (native.targets EzvpnCoreVersion), stamped as
+       assembly metadata so AppInfo can show which core this build ships alongside
+       the app's own version. -->
+  <ItemGroup>
+    <AssemblyMetadata Include="EzvpnCoreVersion" Value="$(EzvpnCoreVersion)" />
+  </ItemGroup>
+
   <!-- `dotnet publish` for an unpackaged (WindowsPackageType=None) WinUI 3 app
        drops the app resource index (Ezvpn.App.pri) — it stays in the build output
        but is never added to the publish set. Without it, WinUI can't resolve its
diff --git a/src/Ezvpn.App/MainWindow.xaml.cs b/src/Ezvpn.App/MainWindow.xaml.cs
index 43c0ea1..23364ae 100644
--- a/src/Ezvpn.App/MainWindow.xaml.cs
+++ b/src/Ezvpn.App/MainWindow.xaml.cs
@@ -21,7 +21,7 @@ public MainWindow()
         InitializeComponent();
 
         Title = "ezvpn";
-        VersionText.Text = AppInfo.Version;
+        VersionText.Text = AppInfo.Summary;
         _manager = new TunnelsManager(DispatcherQueue);
         RootGrid.DataContext = _manager;