diff --git a/Makefile b/Makefile
index b30a62a3b..96cc7bc97 100644
--- a/Makefile
+++ b/Makefile
@@ -45,8 +45,8 @@ endif
 TARGETS = wasm32-wasi wasm32-wasip1 wasm32-wasip2 wasm32-wasip1-threads wasm32-wasi-threads
 
 # Only the major version is needed for Clang, see https://reviews.llvm.org/D125860.
-CLANG_VERSION=$(shell $(BASH) ./llvm_version_major.sh $(LLVM_PROJ_DIR))
-VERSION:=$(shell $(BASH) ./version.sh)
+CLANG_VERSION=$(shell $(BASH) ./version llvm-major --llvm-dir=$(LLVM_PROJ_DIR))
+VERSION:=$(shell $(BASH) ./version)
 DEBUG_PREFIX_MAP=-fdebug-prefix-map=$(ROOT_DIR)=wasisdk://v$(VERSION)
 
 default: build
diff --git a/RELEASING.md b/RELEASING.md
index d7eaef2f7..31c915965 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -3,7 +3,7 @@
 To publish a new version of `wasi-sdk` as a GitHub release:
 
 1. Tag a commit with an annotated tag. Note that this must be an annotated tag,
-   not a lightweight tag, so that `version.sh` can use it for calculating the
+   not a lightweight tag, so that `version` can use it for calculating the
    package version (use `git show wasi-sdk-...` to show other tag messages).
    Note that you may need to clear the repository cache to avoid problems with
    cached artifacts [^cache].
diff --git a/deb_from_installation.sh b/deb_from_installation.sh
index 2c1596163..d0925154c 100755
--- a/deb_from_installation.sh
+++ b/deb_from_installation.sh
@@ -18,7 +18,7 @@ fi
 if [ -n "$2" ]; then
     VERSION="$2"
 else
-    VERSION=`./version.sh`
+    VERSION=`./version`
 fi
 
 if [ -n "$3" ]; then
diff --git a/llvm_version_major.sh b/llvm_version_major.sh
deleted file mode 100755
index 93fe9b01b..000000000
--- a/llvm_version_major.sh
+++ /dev/null
@@ -1,4 +0,0 @@
-#/bin/bash
-LLVM_PROJ_DIR=${1:-./src/llvm-project}
-MAJOR=`(grep "set(LLVM_VERSION_MAJOR" $LLVM_PROJ_DIR/llvm/CMakeLists.txt || grep "set(LLVM_VERSION_MAJOR" $LLVM_PROJ_DIR/cmake/Modules/LLVMVersion.cmake) | awk '{print substr($2, 1, length($2) - 1)}'`
-echo $MAJOR
diff --git a/tar_from_installation.sh b/tar_from_installation.sh
index f90000bf5..78bd15e78 100755
--- a/tar_from_installation.sh
+++ b/tar_from_installation.sh
@@ -10,7 +10,7 @@ fi
 if [ -n "$2" ]; then
     VERSION="$2"
 else
-    VERSION=`./version.sh`
+    VERSION=`./version`
 fi
 
 if [ -n "$3" ]; then
diff --git a/version b/version
new file mode 100755
index 000000000..153eef5ae
--- /dev/null
+++ b/version
@@ -0,0 +1,89 @@
+#!/usr/bin/env python
+
+# This script finds and prints the various versions in this project: wasi-sdk
+# itself, LLVM, and the Git revisions of dependencies.
+#
+# Usage: version [wasi-sdk|llvm|llvm-major|dump]?
+
+import argparse
+import subprocess
+
+# The number of characters to use for the abbreviated Git revision.
+GIT_REF_LEN = 12
+
+
+def main(action, llvm_dir):
+    if action == 'wasi-sdk':
+        print(git_version())
+    elif action == 'llvm':
+        major, minor, path = llvm_cmake_version(llvm_dir)
+        print(f'{major}.{minor}.{path}')
+    elif action == 'llvm-major':
+        major, _, _ = llvm_cmake_version(llvm_dir)
+        print(major)
+    elif action == 'dump':
+        print(git_version())
+        print(f'wasi-libc: {git_commit("src/wasi-libc")}')
+        print(f'llvm: {git_commit(llvm_dir)}')
+        major, minor, path = llvm_cmake_version(llvm_dir)
+        print(f'llvm-version: {major}.{minor}.{path}')
+        print(f'config: {git_commit("src/config")}')
+
+
+def git_version():
+    version = exec(['git', 'describe', '--long', '--candidates=999',
+                    '--match=wasi-sdk-*', '--dirty=+m', f'--abbrev={GIT_REF_LEN}'])
+    # Parse, e.g.: wasi-sdk-21-0-g317548590b40+m
+    parts = version.replace('+', '-').split('-')
+    assert (parts[0:2] == ['wasi', 'sdk'])
+    major, minor, git, dirty = parts[2:]
+    version = f'{major}.{minor}'
+    if git:
+        assert (git.startswith('g'))
+        version += git
+    if dirty:
+        assert (dirty == 'm')
+        version += '+m'
+    return version
+
+
+def git_commit(dir='.'):
+    return exec(['git', 'rev-parse', f'--short={GIT_REF_LEN}', 'HEAD'], dir)
+
+
+def llvm_cmake_version(llvm_dir):
+    with open(f'{llvm_dir}/llvm/CMakeLists.txt', 'r') as file:
+        for line in file:
+            line = line.strip()
+            if line.startswith('set(LLVM_VERSION_MAJOR'):
+                llvm_version_major = parse_cmake_set(line)
+            elif line.startswith('set(LLVM_VERSION_MINOR'):
+                llvm_version_minor = parse_cmake_set(line)
+            elif line.startswith('set(LLVM_VERSION_PATCH'):
+                llvm_version_patch = parse_cmake_set(line)
+    return llvm_version_major, llvm_version_minor, llvm_version_patch
+
+
+def parse_cmake_set(line):
+    return line.split(' ')[1].split(')')[0]
+
+
+def exec(command, cwd='.'):
+    result = subprocess.run(command, capture_output=True, text=True, cwd=cwd)
+    return result.stdout.strip()
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(
+        description='Print the various kinds of versions in wasi-sdk')
+    parser.add_argument('action',
+                        choices=['wasi-sdk', 'llvm', 'llvm-major', 'dump'],
+                        nargs='?',
+                        default='wasi-sdk',
+                        help='Which kind of version to print (default: wasi-sdk).')
+    parser.add_argument('--llvm-dir',
+                        nargs='?',
+                        default='src/llvm-project',
+                        help='Override the location of the LLVM source directory (default: src/llvm-project).')
+    args = parser.parse_args()
+    main(args.action, args.llvm_dir)
diff --git a/version.sh b/version.sh
deleted file mode 100755
index 35c8a908e..000000000
--- a/version.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -e
-git config --global --add safe.directory "/workspace"
-GIT_DESCR=$(git describe --long --candidates=999 --match='wasi-sdk-*' --dirty='+m' --abbrev=12)
-GIT_PACKAGE_VERSION=$(echo $GIT_DESCR | perl -ne 'if(/^wasi-sdk-(\d+)-(\d+)-g([0-9a-f]{7,12})([+]m)?$/) { if($2 == 0) { print "$1.$2$4" } else { print "$1.$2g$3$4" } exit } else { print "could not parse git description"; exit 1 }';)
-echo $GIT_PACKAGE_VERSION