diff --git a/.version b/.version
index 0d91a54c..9e11b32f 100644
--- a/.version
+++ b/.version
@@ -1 +1 @@
-0.3.0
+0.3.1
diff --git a/cli/Cargo.lock b/cli/Cargo.lock
index 36e86732..1561729f 100644
--- a/cli/Cargo.lock
+++ b/cli/Cargo.lock
@@ -3383,7 +3383,7 @@ dependencies = [
 
 [[package]]
 name = "shared-context-engineering"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "anyhow",
  "apple-native-keyring-store",
diff --git a/cli/Cargo.toml b/cli/Cargo.toml
index 31d2aa30..71ba23a5 100644
--- a/cli/Cargo.toml
+++ b/cli/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "shared-context-engineering"
-version = "0.3.0"
+version = "0.3.1"
 edition = "2021"
 description = "Shared Context Engineering CLI"
 license = "Apache-2.0"
diff --git a/nix/bump-version.sh b/nix/bump-version.sh
index dbd10f1c..0c8eee18 100755
--- a/nix/bump-version.sh
+++ b/nix/bump-version.sh
@@ -5,8 +5,8 @@ APP_ID="dev.crocoder.sce"
 
 usage() {
   printf 'usage: bump-version.sh --repo-root <path> --version <version>\n\n' >&2
-  printf 'Updates .version, cli/Cargo.toml, cli/Cargo.lock, npm/package.json,\n' >&2
-  printf 'and packaging/flatpak/%s.metainfo.xml to match --version.\n' "$APP_ID" >&2
+  printf 'Updates the project version in .version, cli/Cargo.toml, cli/Cargo.lock,\n' >&2
+  printf 'npm/package.json, and the first release in packaging/flatpak/%s.metainfo.xml.\n' "$APP_ID" >&2
   printf '\n' >&2
   printf 'Options:\n' >&2
   printf '  --repo-root <path>  Repository root directory\n' >&2
@@ -60,6 +60,15 @@ done
 [[ -n "$repo_root" ]] || fail_usage
 [[ -n "$version" ]] || fail_usage
 
+escape_sed_regex() {
+  # shellcheck disable=SC2016
+  sed 's/[.[\*^$()+?{}|\\]/\\&/g'
+}
+
+escape_sed_replacement() {
+  sed 's/[&\\]/\\&/g'
+}
+
 version_path="$repo_root/.version"
 cargo_toml_path="$repo_root/cli/Cargo.toml"
 cargo_lock_path="$repo_root/cli/Cargo.lock"
@@ -89,20 +98,59 @@ for f in "${files[@]}"; do
   fi
 done
 
+from_version_regex="$(printf '%s' "$from_version" | escape_sed_regex)"
+version_replacement="$(printf '%s' "$version" | escape_sed_replacement)"
 changes=0
 
-for f in "${files[@]}"; do
-  rel="${f#"$repo_root"/}"
-  if grep -qF "$from_version" "$f"; then
-    printf '  %s: %s -> %s\n' "$rel" "$from_version" "$version"
-    if [[ "$dry_run" -ne 1 ]]; then
-      sed -i "s/\\b$from_version\\b/$version/g" "$f"
-    fi
-    changes=$((changes + 1))
-  else
-    printf '  %s: warning: did not find %s, skipping\n' "$rel" "$from_version"
+replace_once() {
+  local path="$1"
+  local description="$2"
+  local expression="$3"
+  local tmp_path
+  local rel
+
+  rel="${path#"$repo_root"/}"
+  tmp_path="$(mktemp)"
+  sed "$expression" "$path" > "$tmp_path"
+
+  if cmp -s "$path" "$tmp_path"; then
+    printf '  %s: warning: did not update %s from %s\n' "$rel" "$description" "$from_version"
+    rm -f "$tmp_path"
+    return
   fi
-done
+
+  printf '  %s: %s: %s -> %s\n' "$rel" "$description" "$from_version" "$version"
+  if [[ "$dry_run" -ne 1 ]]; then
+    cp "$tmp_path" "$path"
+  fi
+  rm -f "$tmp_path"
+  changes=$((changes + 1))
+}
+
+replace_once \
+  "$version_path" \
+  "checked-in version" \
+  "s/^${from_version_regex}\$/${version_replacement}/"
+
+replace_once \
+  "$cargo_toml_path" \
+  "package version" \
+  "0,/^version = /{/^version = \"$from_version_regex\"\$/s//version = \"$version_replacement\"/}"
+
+replace_once \
+  "$cargo_lock_path" \
+  "shared-context-engineering package version" \
+  "/^name = \"shared-context-engineering\"\$/,/^dependencies = \[/s/^version = \"$from_version_regex\"\$/version = \"$version_replacement\"/"
+
+replace_once \
+  "$npm_package_path" \
+  "package version" \
+  "0,/\"version\": /{/\"version\": \"$from_version_regex\"/s//\"version\": \"$version_replacement\"/}"
+
+replace_once \
+  "$metainfo_path" \
+  "primary Flatpak release version" \
+  "0,/<release /{/<release version=\"$from_version_regex\"/s//<release version=\"$version_replacement\"/}"
 
 if [[ "$dry_run" -eq 1 ]]; then
   printf 'Dry run: %d file(s) would change\n' "$changes"
diff --git a/npm/package.json b/npm/package.json
index 9dfb1d73..490295ec 100644
--- a/npm/package.json
+++ b/npm/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@crocoder-dev/sce",
-	"version": "0.3.0",
+	"version": "0.3.1",
 	"description": "npm launcher package for the Shared Context Engineering CLI",
 	"type": "module",
 	"private": false,
diff --git a/packaging/flatpak/dev.crocoder.sce.metainfo.xml b/packaging/flatpak/dev.crocoder.sce.metainfo.xml
index 30c20cc9..c4150809 100644
--- a/packaging/flatpak/dev.crocoder.sce.metainfo.xml
+++ b/packaging/flatpak/dev.crocoder.sce.metainfo.xml
@@ -21,7 +21,7 @@
     <binary>sce</binary>
   </provides>
   <releases>
-    <release version="0.3.0" date="2026-07-02" />
+    <release version="0.3.1" date="2026-07-02" />
     <release version="0.3.0-pre-alpha-v4" date="2026-07-02" />
   </releases>
   <content_rating type="oars-1.1" />