diff --git a/publish.ps1 b/publish.ps1
index 8f26159eb..ef2a400ee 100644
--- a/publish.ps1
+++ b/publish.ps1
@@ -2,8 +2,18 @@ $ErrorActionPreference = 'Stop'
 $repoRoot = Split-Path -Parent $MyInvocation.MyCommand.Path
 
 $toolBinary = Join-Path (Join-Path $repoRoot 'tools') 'build-tool.exe'
+$stampFile = Join-Path (Join-Path $repoRoot 'tools') '.build-tool-commit'
 $buildToolProject = Join-Path (Join-Path (Join-Path $repoRoot 'Projects') 'BuildTool') 'BuildTool.csproj'
 
+function Get-BuildToolCommit {
+    try {
+        $hash = & git -C $repoRoot log -1 --format=%H -- Projects/BuildTool/ 2>$null
+        if ($LASTEXITCODE -eq 0 -and $hash) { return $hash.Trim() }
+    }
+    catch { }
+    return $null
+}
+
 function Get-BuildToolFromRelease {
     try {
         # Determine platform
@@ -27,6 +37,12 @@ function Get-BuildToolFromRelease {
         }
 
         Invoke-WebRequest -Uri $asset.browser_download_url -OutFile $toolBinary -TimeoutSec 60
+
+        $commitHash = Get-BuildToolCommit
+        if ($null -ne $commitHash) {
+            Set-Content -Path $stampFile -Value $commitHash -NoNewline
+        }
+
         return $true
     }
     catch {
@@ -44,10 +60,29 @@ function Test-DotNetAvailable {
     }
 }
 
-# Try native binary first
+# Try native binary first (with staleness check)
 if (Test-Path $toolBinary) {
-    & $toolBinary @args
-    exit $LASTEXITCODE
+    $currentCommit = Get-BuildToolCommit
+    if ($null -ne $currentCommit -and (Test-Path $stampFile)) {
+        $storedCommit = (Get-Content $stampFile -Raw).Trim()
+        if ($currentCommit -eq $storedCommit) {
+            & $toolBinary @args
+            exit $LASTEXITCODE
+        }
+        else {
+            Write-Host "Build tool source has changed, updating..." -ForegroundColor Yellow
+            Remove-Item $toolBinary -Force
+        }
+    }
+    elseif ($null -eq $currentCommit) {
+        # Not in a git repo — use binary as-is
+        & $toolBinary @args
+        exit $LASTEXITCODE
+    }
+    else {
+        # Binary exists but no stamp — re-download to establish tracking
+        Remove-Item $toolBinary -Force
+    }
 }
 
 # Try to download native binary
diff --git a/publish.sh b/publish.sh
index c4e728117..30d80c4f2 100755
--- a/publish.sh
+++ b/publish.sh
@@ -21,8 +21,14 @@ detect_platform() {
 
 PLATFORM="$(detect_platform)"
 TOOL_BINARY="$REPO_ROOT/tools/build-tool"
+STAMP_FILE="$REPO_ROOT/tools/.build-tool-commit"
 BUILD_TOOL_PROJECT="$REPO_ROOT/Projects/BuildTool/BuildTool.csproj"
 
+# Get the commit hash of the latest change to BuildTool source
+get_buildtool_commit() {
+    git -C "$REPO_ROOT" log -1 --format=%H -- Projects/BuildTool/ 2>/dev/null
+}
+
 # Try to download native binary from GitHub Release
 download_build_tool() {
     local asset_name="build-tool-${PLATFORM}"
@@ -45,6 +51,13 @@ download_build_tool() {
     mkdir -p "$tools_dir"
     curl -fsSL --connect-timeout 10 -o "$TOOL_BINARY" "$download_url" || return 1
     chmod +x "$TOOL_BINARY"
+
+    local current_commit
+    current_commit="$(get_buildtool_commit)"
+    if [ -n "$current_commit" ]; then
+        echo -n "$current_commit" > "$STAMP_FILE"
+    fi
+
     return 0
 }
 
@@ -62,9 +75,24 @@ if [ -f /etc/os-release ]; then
     esac
 fi
 
-# Try native binary first
+# Try native binary first (with staleness check)
 if [ -x "$TOOL_BINARY" ]; then
-    exec "$TOOL_BINARY" "$@"
+    current_commit="$(get_buildtool_commit)"
+    if [ -n "$current_commit" ] && [ -f "$STAMP_FILE" ]; then
+        stored_commit="$(cat "$STAMP_FILE")"
+        if [ "$current_commit" = "$stored_commit" ]; then
+            exec "$TOOL_BINARY" "$@"
+        else
+            echo -e "\033[33mBuild tool source has changed, updating...\033[0m"
+            rm -f "$TOOL_BINARY"
+        fi
+    elif [ -z "$current_commit" ]; then
+        # Not in a git repo — use binary as-is
+        exec "$TOOL_BINARY" "$@"
+    else
+        # Binary exists but no stamp file — re-download to establish tracking
+        rm -f "$TOOL_BINARY"
+    fi
 fi
 
 # Try to download native binary