diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index f038b6c..e70a2a2 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -64,12 +64,9 @@ docker compose run --rm --build lint
 
 ## Updating the version number
 
-When releasing a new version, update all version references together:
+Run `./bump_version.sh <new-version>`, for example `./bump_version.sh 1.6.4`. It renames the rockspec, updates its `version = "..."` field, updates `_N._VERSION` in [`src/lua_resty_netacea.lua`](/home/user/github/lua_resty_netacea/src/lua_resty_netacea.lua), and finishes by running `check_rockspec_version.sh` to confirm everything agrees.
 
-1. Update [`src/lua_resty_netacea.lua`](/home/user/github/lua_resty_netacea/src/lua_resty_netacea.lua) and change `_N._VERSION` to the new library version, for example `1.2.2`.
-2. Rename the rockspec file to match the new release, for example `lua_resty_netacea-1.2.2-0.rockspec`.
-3. Update the `version = "..."` field inside the rockspec to the same value.
-4. Update any other hardcoded version references you introduce in future changes.
+If you introduce a new hardcoded version reference elsewhere, update `bump_version.sh` and `check_rockspec_version.sh` to cover it too, so a future bump can't miss it.
 
 `Dockerfile` and `Dockerfile.nginx_lua` pick up the rockspec via a `*.rockspec` glob, so they don't need updating for a version bump — as long as exactly one rockspec file exists in the repo root.
 
diff --git a/bump_version.sh b/bump_version.sh
new file mode 100755
index 0000000..e15b7f7
--- /dev/null
+++ b/bump_version.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Bumps the library to a new version in every place check_rockspec_version.sh
+# checks: renames the rockspec, updates its `version` field, and updates
+# _N._VERSION in src/lua_resty_netacea.lua. Always uses the "-0" release
+# suffix (see CONTRIBUTING.md).
+#
+# Usage: ./bump_version.sh <new-version>
+# Example: ./bump_version.sh 1.6.3
+
+NEW_VERSION="${1:?usage: $0 <new-version, e.g. 1.6.3>}"
+
+if [[ ! "$NEW_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  echo "Version '$NEW_VERSION' doesn't look like <major>.<minor>.<patch>, e.g. 1.6.3." >&2
+  exit 1
+fi
+
+SOURCE_FILE="$(dirname "$0")/src/lua_resty_netacea.lua"
+OLD_ROCKSPEC="$(ls ./lua_resty_netacea-*.rockspec 2>/dev/null | head -n1)"
+
+if [ -z "$OLD_ROCKSPEC" ] || [ ! -f "$OLD_ROCKSPEC" ]; then
+  echo "No existing rockspec found (expected ./lua_resty_netacea-*.rockspec)." >&2
+  exit 1
+fi
+
+NEW_ROCKSPEC="./lua_resty_netacea-${NEW_VERSION}-0.rockspec"
+
+if [ "$OLD_ROCKSPEC" = "$NEW_ROCKSPEC" ]; then
+  echo "$OLD_ROCKSPEC is already at version $NEW_VERSION." >&2
+  exit 1
+fi
+
+if [ -e "$NEW_ROCKSPEC" ]; then
+  echo "$NEW_ROCKSPEC already exists." >&2
+  exit 1
+fi
+
+if git -C "$(dirname "$0")" rev-parse --git-dir >/dev/null 2>&1; then
+  git mv "$OLD_ROCKSPEC" "$NEW_ROCKSPEC"
+else
+  mv "$OLD_ROCKSPEC" "$NEW_ROCKSPEC"
+fi
+
+sed -i -E "s/^version[[:space:]]*=[[:space:]]*\"[^\"]+\"/version = \"${NEW_VERSION}-0\"/" "$NEW_ROCKSPEC"
+sed -i -E "s/^_N\._VERSION[[:space:]]*=[[:space:]]*'[^']+'/_N._VERSION = '${NEW_VERSION}'/" "$SOURCE_FILE"
+
+echo "Bumped to $NEW_VERSION:"
+echo "  $NEW_ROCKSPEC"
+echo "  $SOURCE_FILE"
+
+"$(dirname "$0")/check_rockspec_version.sh" "$NEW_ROCKSPEC"
diff --git a/check_rockspec_version.sh b/check_rockspec_version.sh
index 203494d..71ea090 100755
--- a/check_rockspec_version.sh
+++ b/check_rockspec_version.sh
@@ -2,13 +2,16 @@
 set -euo pipefail
 
 # Confirms the checked-in rockspec's filename and its internal `version`
-# field agree, and that the version hasn't already been released as a git
-# tag, so a PR can't ship a rockspec that installs under one version while
-# claiming another, or silently reuse a version that's already out.
+# field agree, that the version hasn't already been released as a git tag,
+# and that src/lua_resty_netacea.lua's _N._VERSION was bumped to match, so
+# a PR can't ship a rockspec that installs under one version while claiming
+# another, silently reuse a version that's already out, or ship a release
+# that reports its own predecessor's version at runtime.
 #
 # Usage: ./check_rockspec_version.sh [path-to-rockspec]
 
 ROCKSPEC="${1:-$(ls ./lua_resty_netacea-*.rockspec 2>/dev/null | head -n1)}"
+SOURCE_FILE="$(dirname "$ROCKSPEC")/src/lua_resty_netacea.lua"
 
 if [ -z "$ROCKSPEC" ] || [ ! -f "$ROCKSPEC" ]; then
   echo "No rockspec found (expected ./lua_resty_netacea-*.rockspec)." >&2
@@ -42,4 +45,21 @@ if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then
   exit 1
 fi
 
-echo "OK: $BASENAME matches version field ($FIELD_VERSION) and tag $TAG is unused."
+if [ ! -f "$SOURCE_FILE" ]; then
+  echo "Could not find $SOURCE_FILE to check _N._VERSION." >&2
+  exit 1
+fi
+
+MODULE_VERSION="$(grep -E "^_N\._VERSION[[:space:]]*=" "$SOURCE_FILE" | head -n1 | sed -E "s/^_N\._VERSION[[:space:]]*=[[:space:]]*['\"]([^'\"]+)['\"].*/\1/")"
+
+if [ -z "$MODULE_VERSION" ]; then
+  echo "Could not find a _N._VERSION = \"...\" assignment in $SOURCE_FILE." >&2
+  exit 1
+fi
+
+if [ "$MODULE_VERSION" != "$RELEASE_VERSION" ]; then
+  echo "src/lua_resty_netacea.lua's _N._VERSION ($MODULE_VERSION) doesn't match the rockspec release version ($RELEASE_VERSION)." >&2
+  exit 1
+fi
+
+echo "OK: $BASENAME matches version field ($FIELD_VERSION), module version ($MODULE_VERSION), and tag $TAG is unused."
diff --git a/lua_resty_netacea-1.6.2-0.rockspec b/lua_resty_netacea-1.6.3-0.rockspec
similarity index 98%
rename from lua_resty_netacea-1.6.2-0.rockspec
rename to lua_resty_netacea-1.6.3-0.rockspec
index 0c17d5d..f17a35c 100644
--- a/lua_resty_netacea-1.6.2-0.rockspec
+++ b/lua_resty_netacea-1.6.3-0.rockspec
@@ -1,5 +1,5 @@
 package = "lua_resty_netacea"
-version = "1.6.2-0"
+version = "1.6.3-0"
 source = {
   url = "git://github.com/Netacea/lua_resty_netacea",
   branch = "master"
diff --git a/src/lua_resty_netacea.lua b/src/lua_resty_netacea.lua
index 0cd19e7..c80e0ce 100644
--- a/src/lua_resty_netacea.lua
+++ b/src/lua_resty_netacea.lua
@@ -8,7 +8,7 @@ local Constants = require("lua_resty_netacea_constants")
 local mitigation = require("lua_resty_netacea_mitigation")
 
 local _N = {}
-_N._VERSION = '1.6.0'
+_N._VERSION = '1.6.3'
 _N._TYPE = 'nginx'
 
 local ngx = require 'ngx'