diff --git a/Jenkinsfile.ops-web b/Jenkinsfile.ops-web
index 4228709..022845f 100644
--- a/Jenkinsfile.ops-web
+++ b/Jenkinsfile.ops-web
@@ -1,22 +1,20 @@
 pipeline {
   agent any
 
-  parameters {
-    string(name: 'IMAGE_TAG', defaultValue: 'latest', description: '镜像 Tag')
-  }
-
   environment {
-    ACR_REGISTRY    = 'crpi-n44qjpuucgjt8e8c.cn-beijing.personal.cr.aliyuncs.com'
-    ACR_NAMESPACE   = 'xuqmgroup'
-    ACR_USERNAME    = 'xuqinmin12'
-    PROD_HOST       = '106.54.23.149'
-    PROD_USER       = 'ubuntu'
-    COMPOSE_FILE    = '/opt/xuqm/deploy/compose.production.yaml'
+    ACR_REGISTRY   = 'crpi-n44qjpuucgjt8e8c.cn-beijing.personal.cr.aliyuncs.com'
+    ACR_NAMESPACE  = 'xuqmgroup'
+    ACR_USERNAME   = 'xuqinmin12'
+    PROD_HOST      = '106.54.23.149'
+    PROD_USER      = 'ubuntu'
+    COMPOSE_FILE   = '/opt/xuqm/deploy/compose.production.yaml'
+    VERSIONS_FILE  = '/opt/xuqm/deploy/versions.json'
     DOCKER_BUILDKIT = '1'
-    IMAGE_NAME      = 'ops-web'
-    DOCKERFILE      = 'Dockerfile.ops'
-    DEPLOY_SERVICE  = 'ops-web'
-    BUILD_ARGS      = '--build-arg OPS_APP_BASE=/ --build-arg OPS_API_BASE_URL=/api'
+    IMAGE_NAME     = 'ops-web'
+    DOCKERFILE     = 'Dockerfile.ops'
+    DEPLOY_SERVICE = 'ops-web'
+    BUILD_ARGS     = '--build-arg OPS_APP_BASE=/ --build-arg OPS_API_BASE_URL=/api'
+    VERSION_FILE   = 'VERSION.ops-web'
   }
 
   options {
@@ -37,21 +35,39 @@ pipeline {
       }
     }
 
+    stage('Resolve Version') {
+      steps {
+        script {
+          def current = fileExists(env.VERSION_FILE) ? readFile(env.VERSION_FILE).trim() : '1.0.0'
+          def parts = current.tokenize('.')
+          while (parts.size() < 3) parts.add('0')
+          def newVer = "${parts[0]}.${parts[1]}.${parts[2].toInteger() + 1}"
+          env.IMAGE_VERSION = newVer
+          writeFile file: env.VERSION_FILE, text: newVer
+          echo "${env.IMAGE_NAME}: ${current} → ${newVer}"
+        }
+      }
+    }
+
     stage('Docker Build & Push') {
       steps {
         withCredentials([string(credentialsId: 'ACR_PASSWORD', variable: 'ACR_PASS')]) {
           script {
-            def fullImage = "${env.ACR_REGISTRY}/${env.ACR_NAMESPACE}/${env.IMAGE_NAME}:${params.IMAGE_TAG}"
+            def base = "${env.ACR_REGISTRY}/${env.ACR_NAMESPACE}/${env.IMAGE_NAME}"
+            def versionedImage = "${base}:${env.IMAGE_VERSION}"
+            def latestImage = "${base}:latest"
             def gitCommit = env.GIT_COMMIT ?: 'unknown'
             bat """
               docker login ${env.ACR_REGISTRY} -u ${env.ACR_USERNAME} -p %ACR_PASS%
               if %errorlevel% neq 0 exit /b 1
-              docker pull --platform=linux/amd64 ${fullImage} || echo Pull failed, will build fresh
-              docker build --platform=linux/amd64 -f ${env.DOCKERFILE} ${env.BUILD_ARGS} --build-arg GIT_COMMIT=${gitCommit} --build-arg BUILDKIT_INLINE_CACHE=1 --cache-from ${fullImage} -t ${fullImage} .
+              docker pull --platform=linux/amd64 ${latestImage} || echo Pull failed, will build fresh
+              docker build --platform=linux/amd64 -f ${env.DOCKERFILE} ${env.BUILD_ARGS} --build-arg GIT_COMMIT=${gitCommit} --build-arg BUILDKIT_INLINE_CACHE=1 --cache-from ${latestImage} -t ${versionedImage} -t ${latestImage} .
               if %errorlevel% neq 0 exit /b 1
-              docker push ${fullImage}
+              docker push ${versionedImage}
               if %errorlevel% neq 0 exit /b 1
-              docker rmi ${fullImage}
+              docker push ${latestImage}
+              if %errorlevel% neq 0 exit /b 1
+              docker rmi ${versionedImage} ${latestImage}
               exit /b 0
             """
           }
@@ -64,21 +80,50 @@ pipeline {
         lock('prod-deploy') {
           withCredentials([sshUserPrivateKey(credentialsId: 'PROD_SSH_KEY', keyFileVariable: 'SSH_KEY')]) {
             script {
-              def fullImage = "${env.ACR_REGISTRY}/${env.ACR_NAMESPACE}/${env.IMAGE_NAME}:${params.IMAGE_TAG}"
+              def latestImage = "${env.ACR_REGISTRY}/${env.ACR_NAMESPACE}/${env.IMAGE_NAME}:latest"
               retry(2) {
                 bat """
-                  ssh -i "%SSH_KEY%" -o StrictHostKeyChecking=no ${env.PROD_USER}@${env.PROD_HOST} "docker image prune -f 2>/dev/null || true; docker pull ${fullImage} || exit 1; docker compose -f ${env.COMPOSE_FILE} up -d --no-deps --force-recreate ${env.DEPLOY_SERVICE} || exit 1; docker image prune -f"
+                  ssh -i "%SSH_KEY%" -o StrictHostKeyChecking=no ${env.PROD_USER}@${env.PROD_HOST} "docker image prune -f 2>/dev/null || true; docker pull ${latestImage} || exit 1; docker compose -f ${env.COMPOSE_FILE} up -d --no-deps --force-recreate ${env.DEPLOY_SERVICE} || exit 1; docker image prune -f"
                 """
               }
+              def releasedAt = new Date().format("yyyy-MM-dd'T'HH:mm:ss'Z'", TimeZone.getTimeZone('UTC'))
+              def updateScript = """\
+import json, os
+path = '${env.VERSIONS_FILE}'
+d = json.load(open(path)) if os.path.exists(path) else {}
+d.setdefault('services', {})['${env.DEPLOY_SERVICE}'] = {'version': '${env.IMAGE_VERSION}', 'changed': True}
+d['releasedAt'] = '${releasedAt}'
+json.dump(d, open(path, 'w'), indent=2, ensure_ascii=False)
+print('versions.json updated: ${env.DEPLOY_SERVICE} = ${env.IMAGE_VERSION}')
+""".stripIndent()
+              writeFile file: 'update_versions.py', text: updateScript
+              bat """
+                scp -i "%SSH_KEY%" -o StrictHostKeyChecking=no update_versions.py ${env.PROD_USER}@${env.PROD_HOST}:/tmp/update_versions.py
+                ssh -i "%SSH_KEY%" -o StrictHostKeyChecking=no ${env.PROD_USER}@${env.PROD_HOST} "python3 /tmp/update_versions.py && rm /tmp/update_versions.py"
+              """
             }
           }
         }
       }
     }
+
+    stage('Commit Version') {
+      steps {
+        script {
+          bat """
+            git config user.email "jenkins@xuqm.com"
+            git config user.name "Jenkins CI"
+            git add ${env.VERSION_FILE}
+            git diff --cached --quiet || git commit -m "ci: bump ${env.IMAGE_NAME} to ${env.IMAGE_VERSION} [skip ci]"
+            git push origin HEAD:main
+          """
+        }
+      }
+    }
   }
 
   post {
-    success { echo "✅ ${env.IMAGE_NAME}:${params.IMAGE_TAG} 构建部署成功" }
+    success { echo "✅ ${env.IMAGE_NAME}:${env.IMAGE_VERSION} 构建部署成功" }
     failure  { echo "❌ 构建失败，请检查日志" }
   }
 }
diff --git a/Jenkinsfile.tenant-web b/Jenkinsfile.tenant-web
index efbda53..6352036 100644
--- a/Jenkinsfile.tenant-web
+++ b/Jenkinsfile.tenant-web
@@ -1,22 +1,20 @@
 pipeline {
   agent any
 
-  parameters {
-    string(name: 'IMAGE_TAG', defaultValue: 'latest', description: '镜像 Tag')
-  }
-
   environment {
-    ACR_REGISTRY    = 'crpi-n44qjpuucgjt8e8c.cn-beijing.personal.cr.aliyuncs.com'
-    ACR_NAMESPACE   = 'xuqmgroup'
-    ACR_USERNAME    = 'xuqinmin12'
-    PROD_HOST       = '106.54.23.149'
-    PROD_USER       = 'ubuntu'
-    COMPOSE_FILE    = '/opt/xuqm/deploy/compose.production.yaml'
+    ACR_REGISTRY   = 'crpi-n44qjpuucgjt8e8c.cn-beijing.personal.cr.aliyuncs.com'
+    ACR_NAMESPACE  = 'xuqmgroup'
+    ACR_USERNAME   = 'xuqinmin12'
+    PROD_HOST      = '106.54.23.149'
+    PROD_USER      = 'ubuntu'
+    COMPOSE_FILE   = '/opt/xuqm/deploy/compose.production.yaml'
+    VERSIONS_FILE  = '/opt/xuqm/deploy/versions.json'
     DOCKER_BUILDKIT = '1'
-    IMAGE_NAME      = 'tenant-web'
-    DOCKERFILE      = 'Dockerfile.tenant'
-    DEPLOY_SERVICE  = 'tenant-web'
-    BUILD_ARGS      = '--build-arg TENANT_APP_BASE=/ --build-arg TENANT_API_BASE_URL=/api'
+    IMAGE_NAME     = 'tenant-web'
+    DOCKERFILE     = 'Dockerfile.tenant'
+    DEPLOY_SERVICE = 'tenant-web'
+    BUILD_ARGS     = '--build-arg TENANT_APP_BASE=/ --build-arg TENANT_API_BASE_URL=/api'
+    VERSION_FILE   = 'VERSION.tenant-web'
   }
 
   options {
@@ -37,21 +35,39 @@ pipeline {
       }
     }
 
+    stage('Resolve Version') {
+      steps {
+        script {
+          def current = fileExists(env.VERSION_FILE) ? readFile(env.VERSION_FILE).trim() : '1.0.0'
+          def parts = current.tokenize('.')
+          while (parts.size() < 3) parts.add('0')
+          def newVer = "${parts[0]}.${parts[1]}.${parts[2].toInteger() + 1}"
+          env.IMAGE_VERSION = newVer
+          writeFile file: env.VERSION_FILE, text: newVer
+          echo "${env.IMAGE_NAME}: ${current} → ${newVer}"
+        }
+      }
+    }
+
     stage('Docker Build & Push') {
       steps {
         withCredentials([string(credentialsId: 'ACR_PASSWORD', variable: 'ACR_PASS')]) {
           script {
-            def fullImage = "${env.ACR_REGISTRY}/${env.ACR_NAMESPACE}/${env.IMAGE_NAME}:${params.IMAGE_TAG}"
+            def base = "${env.ACR_REGISTRY}/${env.ACR_NAMESPACE}/${env.IMAGE_NAME}"
+            def versionedImage = "${base}:${env.IMAGE_VERSION}"
+            def latestImage = "${base}:latest"
             def gitCommit = env.GIT_COMMIT ?: 'unknown'
             bat """
               docker login ${env.ACR_REGISTRY} -u ${env.ACR_USERNAME} -p %ACR_PASS%
               if %errorlevel% neq 0 exit /b 1
-              docker pull --platform=linux/amd64 ${fullImage} || echo Pull failed, will build fresh
-              docker build --platform=linux/amd64 -f ${env.DOCKERFILE} ${env.BUILD_ARGS} --build-arg GIT_COMMIT=${gitCommit} --build-arg BUILDKIT_INLINE_CACHE=1 --cache-from ${fullImage} -t ${fullImage} .
+              docker pull --platform=linux/amd64 ${latestImage} || echo Pull failed, will build fresh
+              docker build --platform=linux/amd64 -f ${env.DOCKERFILE} ${env.BUILD_ARGS} --build-arg GIT_COMMIT=${gitCommit} --build-arg BUILDKIT_INLINE_CACHE=1 --cache-from ${latestImage} -t ${versionedImage} -t ${latestImage} .
               if %errorlevel% neq 0 exit /b 1
-              docker push ${fullImage}
+              docker push ${versionedImage}
               if %errorlevel% neq 0 exit /b 1
-              docker rmi ${fullImage}
+              docker push ${latestImage}
+              if %errorlevel% neq 0 exit /b 1
+              docker rmi ${versionedImage} ${latestImage}
               exit /b 0
             """
           }
@@ -64,21 +80,50 @@ pipeline {
         lock('prod-deploy') {
           withCredentials([sshUserPrivateKey(credentialsId: 'PROD_SSH_KEY', keyFileVariable: 'SSH_KEY')]) {
             script {
-              def fullImage = "${env.ACR_REGISTRY}/${env.ACR_NAMESPACE}/${env.IMAGE_NAME}:${params.IMAGE_TAG}"
+              def latestImage = "${env.ACR_REGISTRY}/${env.ACR_NAMESPACE}/${env.IMAGE_NAME}:latest"
               retry(2) {
                 bat """
-                  ssh -i "%SSH_KEY%" -o StrictHostKeyChecking=no ${env.PROD_USER}@${env.PROD_HOST} "docker image prune -f 2>/dev/null || true; docker pull ${fullImage} || exit 1; docker compose -f ${env.COMPOSE_FILE} up -d --no-deps --force-recreate ${env.DEPLOY_SERVICE} || exit 1; docker image prune -f"
+                  ssh -i "%SSH_KEY%" -o StrictHostKeyChecking=no ${env.PROD_USER}@${env.PROD_HOST} "docker image prune -f 2>/dev/null || true; docker pull ${latestImage} || exit 1; docker compose -f ${env.COMPOSE_FILE} up -d --no-deps --force-recreate ${env.DEPLOY_SERVICE} || exit 1; docker image prune -f"
                 """
               }
+              def releasedAt = new Date().format("yyyy-MM-dd'T'HH:mm:ss'Z'", TimeZone.getTimeZone('UTC'))
+              def updateScript = """\
+import json, os
+path = '${env.VERSIONS_FILE}'
+d = json.load(open(path)) if os.path.exists(path) else {}
+d.setdefault('services', {})['${env.DEPLOY_SERVICE}'] = {'version': '${env.IMAGE_VERSION}', 'changed': True}
+d['releasedAt'] = '${releasedAt}'
+json.dump(d, open(path, 'w'), indent=2, ensure_ascii=False)
+print('versions.json updated: ${env.DEPLOY_SERVICE} = ${env.IMAGE_VERSION}')
+""".stripIndent()
+              writeFile file: 'update_versions.py', text: updateScript
+              bat """
+                scp -i "%SSH_KEY%" -o StrictHostKeyChecking=no update_versions.py ${env.PROD_USER}@${env.PROD_HOST}:/tmp/update_versions.py
+                ssh -i "%SSH_KEY%" -o StrictHostKeyChecking=no ${env.PROD_USER}@${env.PROD_HOST} "python3 /tmp/update_versions.py && rm /tmp/update_versions.py"
+              """
             }
           }
         }
       }
     }
+
+    stage('Commit Version') {
+      steps {
+        script {
+          bat """
+            git config user.email "jenkins@xuqm.com"
+            git config user.name "Jenkins CI"
+            git add ${env.VERSION_FILE}
+            git diff --cached --quiet || git commit -m "ci: bump ${env.IMAGE_NAME} to ${env.IMAGE_VERSION} [skip ci]"
+            git push origin HEAD:main
+          """
+        }
+      }
+    }
   }
 
   post {
-    success { echo "✅ ${env.IMAGE_NAME}:${params.IMAGE_TAG} 构建部署成功" }
+    success { echo "✅ ${env.IMAGE_NAME}:${env.IMAGE_VERSION} 构建部署成功" }
     failure  { echo "❌ 构建失败，请检查日志" }
   }
 }
diff --git a/VERSION.ops-web b/VERSION.ops-web
new file mode 100644
index 0000000..3eefcb9
--- /dev/null
+++ b/VERSION.ops-web
@@ -0,0 +1 @@
+1.0.0
diff --git a/VERSION.tenant-web b/VERSION.tenant-web
new file mode 100644
index 0000000..3eefcb9
--- /dev/null
+++ b/VERSION.tenant-web
@@ -0,0 +1 @@
+1.0.0