diff --git a/README.md b/README.md
index a63bba3..f842184 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 JFrog plugin for [Devin](https://devin.ai/): JFrog Platform skills for artifact management, security scanning, and supply-chain workflows, plus the JFrog Platform MCP server (remote HTTP + OAuth).
 
-> **Current version:** `0.3.0` — skills from [jfrog/jfrog-skills](https://github.com/jfrog/jfrog-skills) (pinned at `v0.25.0`) and a bundled JFrog MCP entry.
+> Skills from [jfrog/jfrog-skills](https://github.com/jfrog/jfrog-skills) (pin in [`.github/scripts/sync-skills-vendor.json`](.github/scripts/sync-skills-vendor.json)) and a bundled JFrog MCP entry. Plugin releases are tagged on GitHub — do not duplicate version numbers here.
 
 ## Skills
 
@@ -44,7 +44,7 @@ The plugin registers this MCP server (declared in `mcp.json` and referenced from
 - **Devin CLI** — see [Devin docs](https://docs.devin.ai/)
 - **Devin CLI plugins enabled** for your organization (`devin plugins install` must be allowed)
 - **`JFROG_PLATFORM_URL`** — JFrog platform host only (no `https://`, no trailing `/`). Required for the bundled MCP entry.
-- **Skill runtime** (when using the skills) — `jf` CLI, `jq`, and `curl` on `PATH`, plus a configured JFrog instance (`jf config add`). See [jfrog-skills requirements](https://github.com/jfrog/jfrog-skills/blob/v0.25.0/README.md#requirements).
+- **Skill runtime** (when using the skills) — `jf` CLI, `jq`, and `curl` on `PATH`, plus a configured JFrog instance (`jf config add`). See [jfrog-skills requirements](https://github.com/jfrog/jfrog-skills/blob/main/README.md#requirements).
 
 ## Installation
 
@@ -95,9 +95,9 @@ devin-plugin/
 node scripts/validate-devin-plugin.mjs
 ```
 
-## Versioning
+## Releasing
 
-Bump `version` in [`.devin-plugin/plugin.json`](.devin-plugin/plugin.json) when you publish a new release, then tag (for example `v0.3.0`).
+Bump `version` in [`.devin-plugin/plugin.json`](.devin-plugin/plugin.json) when you publish a new release, then tag on GitHub. See [`.github/workflows/release.yml`](.github/workflows/release.yml).
 
 ## License
 
diff --git a/VENDOR.md b/VENDOR.md
index c93540c..3f4f371 100644
--- a/VENDOR.md
+++ b/VENDOR.md
@@ -6,9 +6,12 @@ The skill packages under `skills/` are vendored from **[jfrog/jfrog-skills](http
 | --- | --- |
 | **Repository** | https://github.com/jfrog/jfrog-skills |
 | **Pinned release** | see `pin` in [`.github/scripts/sync-skills-vendor.json`](.github/scripts/sync-skills-vendor.json) |
+| **Plugin version** | see `version` in [`.devin-plugin/plugin.json`](.devin-plugin/plugin.json) |
 
 Included directories (as of the pinned release): `jfrog/`, `jfrog-init/`, `jfrog-ai-catalog-skills/`, `jfrog-mcp-management/`, `jfrog-package-safety-and-download/`, `jfrog-reference-architecture/`, `jfrog-setup-package-managers/`.
 
+The README deliberately omits release numbers. The manifest and GitHub tags/releases are the authoritative plugin-version sources; the vendor configuration is the authoritative skills pin.
+
 ## Refreshing
 
 When the upstream repo publishes a new release, refresh the vendored tree via a PR that: