diff --git a/bin/app-version.sh b/bin/app-version.sh
new file mode 100755
index 0000000..37b070d
--- /dev/null
+++ b/bin/app-version.sh
@@ -0,0 +1,76 @@
+#!/bin/bash
+
+# Usage: ./app-version.sh app-directory
+#
+# Pull image tag versions and digests into each recipe's compose.yml file, and
+# update git tags to point to the new ref
+
+YQ="$HOME/.abra/vendor/yq"
+
+function process_file() {
+	compose_file="${1?Compose file not set}"
+
+	mapfile -t services < <($YQ e -N '.services | keys | .[]' "$compose_file" | sort -u)
+
+	for service in "${services[@]}"; do
+		# 3wc: skip the "app" service unless we're in compose.yml; this service is
+		# often repeated in other compose.*.yml files to extend options, but we only
+		# want to add the deploy.label in one definition
+		# TODO 3wc: make this smarter, what if a separate compose file extends
+		# other services too?
+		if [ "$compose_file" != "compose.yml" ] && [ "$service" = "app" ]; then
+			echo "debug: skipping $service"
+			continue
+		fi
+
+		echo "debug: processing $service"
+
+		service_data=$(jq ".$app.versions.\"$latest_version\".$service" ~/.abra/apps.json)
+		service_tag=$(echo "$service_data" | jq -r '.tag')
+		service_digest=$(echo "$service_data" | jq -r '.digest')
+
+		label="coop-cloud.\${STACK_NAME}.$service.version=${service_tag}-${service_digest}"
+
+		# delete old label, if one exists
+		$YQ eval -i "del(.services.$service.deploy.labels.[] | select(. == \"coop*\"))" "$compose_file"
+		# add new label
+		$YQ eval -i ".services.$service.deploy.labels += [\"$label\"]" "$compose_file"
+
+	done
+}
+
+stack_dir="${ABRA_DIR:-$HOME/.abra}/apps/"
+
+app="${1?No app provided}"
+
+cd "$stack_dir/$app" || exit
+
+mapfile -t extra_compose_files < <(ls -- compose.*.yml || true)
+
+compose_files=("compose.yml" "${extra_compose_files[@]}")
+
+mapfile -t git_tags < <(git tag -l)
+latest_version="${git_tags[-1]}"
+latest_version_message=$(git tag -l "$latest_version" --format='%(contents)')
+
+echo "debug: latest version: $latest_version"
+
+for compose_file in "${compose_files[@]}"; do
+	process_file "$compose_file"
+done
+
+read -rp "On the next screen, you'll see the proposed changes; press 'q' to exit when you're done. Hit 'return' / 'enter' to continue now" choice
+
+git diff
+
+read -rp "Commit this change and replace the '$latest_version' tag? (y/[n])? " choice
+
+if [ "${choice,,}" != "y" ]; then
+	exit
+fi
+
+git commit -a -m "Auto-add service labels"
+
+git tag -d "$latest_version"
+
+git tag -a "$latest_version" -m "$latest_version_message"