diff --git a/.kiro/specs/build-time-versioning/tasks.md b/.kiro/specs/build-time-versioning/tasks.md
index bb974511..76d66219 100644
--- a/.kiro/specs/build-time-versioning/tasks.md
+++ b/.kiro/specs/build-time-versioning/tasks.md
@@ -64,10 +64,11 @@
   - _Boundary: apiserver/meson.build, xcecli/meson.build_
   - _Depends: 4.1_
 
-- [ ] 4.3 (P) Makefile dev-loop path computes and passes the same values
-  - `src/frontend/Makefile`'s `build-server`/`build-cli` targets compute commit id (git, dirty-suffixed) and build time (date) directly and pass the identical `-ldflags` shape 4.1 establishes, independent of meson
-  - Fall back to `unknown` for commit id when `git` itself fails (e.g. no `.git` present), matching 2.1's/4.1's fallback discipline
-  - Observable: `make build-server` and `make build-cli` each produce a binary whose `--version`/`-version` output matches the same commit id `git rev-parse --short HEAD` reports at build time
+- [x] 4.3 (P) Makefile dev-loop path computes and passes the same values
+  - `GIT_COMMIT_HASH`/`GIT_STATUS`/`GIT_COMMIT`/`BUILD_TIME`/`VERSION_LDFLAGS` (`:=`, computed once per invocation) mirror `xce-build.sh`'s dirty-check semantics and `go_build`'s exact `-ldflags` shape; `build-cli`/`build-server` recipes reference `$(VERSION_LDFLAGS)`
+  - `unknown` fallback verified via empty-output detection (robust for `git rev-parse --short HEAD` specifically: never succeeds with empty stdout)
+  - `--version` CLI output not yet observable (tasks 4.4/4.5 not landed) -- verified instead via `go version -m`'s embedded build-info metadata, matching live `git rev-parse --short HEAD` + dirty suffix
+  - `make build-server`'s pre-existing CGO failure (bug-1597) independently confirmed unrelated via a stash A/B (identical failure on the unmodified Makefile) -- not a regression
   - _Requirements: 1.1, 1.2, 1.3, 1.4, 4.1, 4.2, 5.1, 5.2_
   - _Boundary: Makefile_
   - _Depends: 4.1_
diff --git a/src/frontend/Makefile b/src/frontend/Makefile
index 7bbb45fb..29c6bf9f 100644
--- a/src/frontend/Makefile
+++ b/src/frontend/Makefile
@@ -9,6 +9,30 @@ XCE_BIN   ?= /tmp/xce_static
 SRV_URL   ?= http://localhost:8080
 GOFLAGS   := CGO_ENABLED=0
 
+# build-time-versioning task 4.3: dev-loop -ldflags path. Computes commit id
+# (git, -dirty suffixed) and build time (UTC) directly -- independent of
+# meson -- mirroring xce-build.sh's (task 2.1) git/dirty-check logic and
+# passing the identical -ldflags shape go_build (task 4.1) appends. `:=`
+# (simply expanded: the $(shell ...) calls run once, immediately, when this
+# line is parsed) rather than `=` (recursively expanded: would re-invoke git
+# and date on every reference to these variables) -- this computes each
+# value exactly once per `make` invocation, matching xce-build.sh's own
+# single-computation-per-invocation model, so build-server and build-cli
+# (and multiple references within one recipe) all see the same values.
+GIT_COMMIT_HASH := $(shell git rev-parse --short HEAD 2>/dev/null)
+GIT_STATUS      := $(shell git status --porcelain 2>/dev/null)
+ifeq ($(GIT_COMMIT_HASH),)
+# git itself failed (e.g. no .git present) -- Requirement 1.4/4.1's fallback
+# discipline: record as unknown rather than fail the build.
+GIT_COMMIT := unknown
+else ifeq ($(GIT_STATUS),)
+GIT_COMMIT := $(GIT_COMMIT_HASH)
+else
+GIT_COMMIT := $(GIT_COMMIT_HASH)-dirty
+endif
+BUILD_TIME      := $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
+VERSION_LDFLAGS := -ldflags "-X main.GitCommit=$(GIT_COMMIT) -X main.BuildTime=$(BUILD_TIME)"
+
 # bug-1558: test-backend's CGO_CFLAGS/CGO_LDFLAGS, self-derived via
 # pkg-config so `make test-backend` works standalone instead of only inside
 # meson's custom_target env (apiserver/meson.build is the source of truth
@@ -27,10 +51,10 @@ FRONTEND_CGO_LDFLAGS  := $(FRONTEND_CGO_SANITIZE) $(shell pkg-config --libs $(FR
 .PHONY: build-cli build-server test test-backend test-integration test-all
 
 build-cli:
-	cd xcecli && $(GOFLAGS) go build -o $(XCE_BIN) ./cmd/main.go
+	cd xcecli && $(GOFLAGS) go build $(VERSION_LDFLAGS) -o $(XCE_BIN) ./cmd/main.go
 
 build-server:
-	cd apiserver && go build -o /tmp/apiserver ./cmd/main.go
+	cd apiserver && go build $(VERSION_LDFLAGS) -o /tmp/apiserver ./cmd/main.go
 
 ## Run all Go unit tests that do not require CGO or a live server.
 test: