diff --git a/src/App.php b/src/App.php
index b6d6b4e..40a4868 100644
--- a/src/App.php
+++ b/src/App.php
@@ -136,6 +136,19 @@ class App
         exit;
     }
 
+    // ── Asset versioning ─────────────────────────────────────────────────────
+
+    /**
+     * Return an asset URL with a filemtime-based cache-busting query string.
+     * Input is a root-relative URL path (e.g. /assets/css/main.css).
+     */
+    public static function assetV(string $urlPath): string
+    {
+        $file = APP_ROOT . '/public' . $urlPath;
+        $v    = file_exists($file) ? filemtime($file) : 0;
+        return $urlPath . ($v ? '?v=' . $v : '');
+    }
+
     // ── Template rendering ────────────────────────────────────────────────────
 
     /**
diff --git a/templates/admin/footer.php b/templates/admin/footer.php
index cd19b04..1876c30 100644
--- a/templates/admin/footer.php
+++ b/templates/admin/footer.php
@@ -1,5 +1,5 @@
 <?php foreach ($extraJs ?? [] as $js): ?>
-<script src="<?= htmlspecialchars($js) ?>"></script>
+<script src="<?= App::assetV($js) ?>"></script>
 <?php endforeach; ?>
 <?php if (!empty($extraJsInline)): ?>
 <script><?= $extraJsInline ?></script>
diff --git a/templates/head.php b/templates/head.php
index 6fbee50..aeb118b 100644
--- a/templates/head.php
+++ b/templates/head.php
@@ -64,10 +64,10 @@
     <link rel="icon" type="image/png" sizes="16x16" href="/assets/favicon/favicon-16x16.png">
     <link rel="shortcut icon" href="/assets/favicon/favicon.ico">
     <meta name="theme-color" content="#ffffff">
-    <link rel="stylesheet" href="/assets/css/modern-normalize.min.css">
-    <link rel="stylesheet" href="/assets/css/common.css">
+    <link rel="stylesheet" href="<?= App::assetV('/assets/css/modern-normalize.min.css') ?>">
+    <link rel="stylesheet" href="<?= App::assetV('/assets/css/common.css') ?>">
     <?php foreach ($extraCss ?? [] as $css): ?>
-    <link rel="stylesheet" href="<?= htmlspecialchars($css) ?>">
+    <link rel="stylesheet" href="<?= App::assetV($css) ?>">
     <?php endforeach; ?>
     <?php if (php_sapi_name() === 'cli-server'): ?>
     <script>