diff --git a/package.json b/package.json
index 16a97ac..166cdfd 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hasna/gateway",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Open-source AI model gateway core for one-key, multi-provider routing across Hasna apps and self-hosted deployments",
   "type": "module",
   "main": "dist/index.js",
@@ -46,7 +46,8 @@
     "test": "bun test",
     "contracts:validate": "contracts conformance fixtures/contracts",
     "dev": "bun run src/cli/index.ts serve --config gateway.config.example.json",
-    "prepublishOnly": "bun run typecheck && bun run build && bun run test"
+    "verify:version-parity": "bun scripts/verify-version-parity.mjs",
+    "prepublishOnly": "bun run verify:version-parity && bun run typecheck && bun run build && bun run test"
   },
   "keywords": [
     "ai",
diff --git a/scripts/verify-version-parity.mjs b/scripts/verify-version-parity.mjs
new file mode 100644
index 0000000..acd2179
--- /dev/null
+++ b/scripts/verify-version-parity.mjs
@@ -0,0 +1,25 @@
+#!/usr/bin/env bun
+// Publish gate (todos a403124e): refuse to publish an artifact whose
+// self-reported gatewayVersion disagrees with package.json. Release PR #25
+// bumped package.json only, so the published 0.1.7 answers `gateway --version`
+// with 0.1.6 — this exact skew, unchecked at publish time.
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+const manifest = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+const source = readFileSync(join(root, "src", "version.ts"), "utf8");
+const match = source.match(/gatewayVersion\s*=\s*"([^"]+)"/);
+
+if (!match) {
+  console.error("VERSION_PARITY_FAILED: gatewayVersion not found in src/version.ts");
+  process.exit(1);
+}
+if (match[1] !== manifest.version) {
+  console.error(
+    `VERSION_PARITY_FAILED: src/version.ts gatewayVersion=${match[1]} != package.json version=${manifest.version}`,
+  );
+  process.exit(1);
+}
+console.log(`version parity ok: ${manifest.version}`);
diff --git a/src/version.ts b/src/version.ts
index 68ff9c9..43fe8f4 100644
--- a/src/version.ts
+++ b/src/version.ts
@@ -1 +1 @@
-export const gatewayVersion = "0.1.6";
+export const gatewayVersion = "0.1.8";
diff --git a/tests/version-parity.test.ts b/tests/version-parity.test.ts
new file mode 100644
index 0000000..0d62161
--- /dev/null
+++ b/tests/version-parity.test.ts
@@ -0,0 +1,23 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { gatewayVersion } from "../src/version";
+
+const repositoryRoot = join(import.meta.dir, "..");
+
+/**
+ * Regression for the 0.1.7 release skew (todos a403124e): release PR #25
+ * bumped package.json only, so main — and the published 0.1.7 artifact —
+ * self-report 0.1.6 from `gateway --version`. The constant and the manifest
+ * must never disagree: `--version` is the instrument the fleet's version-skew
+ * discipline reads after an install, and a lagging constant makes every
+ * installed-version verification report a false mismatch.
+ */
+describe("version parity", () => {
+  test("gatewayVersion matches package.json version", () => {
+    const manifest = JSON.parse(
+      readFileSync(join(repositoryRoot, "package.json"), "utf8"),
+    ) as { version: string };
+    expect(gatewayVersion).toBe(manifest.version);
+  });
+});