diff --git a/packages/kilo-jetbrains/build.gradle.kts b/packages/kilo-jetbrains/build.gradle.kts
index 21fdb5af949..18968642c79 100644
--- a/packages/kilo-jetbrains/build.gradle.kts
+++ b/packages/kilo-jetbrains/build.gradle.kts
@@ -24,7 +24,10 @@ fun port(value: String): Int {
 
 fun checked(value: String): String {
     if (value == "0.0.0-dev") return value
-    require(Regex("^[0-9]+\\.[0-9]+\\.[0-9]+(-rc\\.[0-9]+)?$").matches(value)) {
+    // The optional +<sha> is SemVer build metadata: it never affects release ordering (Release below
+    // parses only the part before it) and only ever comes from a local override, never from a release
+    // tag, so it cannot leak into a published version.
+    require(Regex("^[0-9]+\\.[0-9]+\\.[0-9]+(-rc\\.[0-9]+)?(\\+[0-9a-f]+)?$").matches(value)) {
         "Invalid JetBrains plugin version: $value"
     }
     return value
diff --git a/packages/kilo-jetbrains/script/build-version.sh b/packages/kilo-jetbrains/script/build-version.sh
index 581880ebb65..4a000cba6b7 100755
--- a/packages/kilo-jetbrains/script/build-version.sh
+++ b/packages/kilo-jetbrains/script/build-version.sh
@@ -9,7 +9,9 @@ Builds the JetBrains plugin for a version without creating or validating a git t
 By default this runs a clean build, signs the ZIP, and verifies it.
 
 Version:
-  x.y.z or x.y.z-rc.n, with an optional leading v.
+  x.y.z or x.y.z-rc.n, with an optional leading v. An optional +<sha> build-metadata
+  suffix marks a local, non-release build off a dev commit (e.g. 7.0.1-rc.1+8d0c4147);
+  it never matches a jetbrains/v<version> release tag.
 
 Options:
   --skip-signing       Build an unsigned ZIP without requiring JetBrains signing secrets.
@@ -22,6 +24,7 @@ Examples:
   $0 v7.0.1-rc.1
   $0 7.0.1-rc.1 --skip-signing --skip-verification
   $0 7.0.1 --skip-clean --skip-signing --skip-verification
+  $0 7.0.1-rc.1+8d0c4147 --skip-signing --skip-verification
 EOF
 }
 
@@ -68,8 +71,8 @@ if [[ -z "$raw" ]]; then
 fi
 
 version="${raw#v}"
-if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$ ]]; then
-  echo "Unsupported version '$raw'. Expected x.y.z or x.y.z-rc.n, for example 7.0.1 or 7.0.1-rc.1." >&2
+if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?(\+[0-9a-f]+)?$ ]]; then
+  echo "Unsupported version '$raw'. Expected x.y.z or x.y.z-rc.n, optionally with a +<sha> suffix, for example 7.0.1, 7.0.1-rc.1, or 7.0.1-rc.1+8d0c4147." >&2
   exit 1
 fi