diff --git a/README.md b/README.md
index e88047553..6720f4356 100644
--- a/README.md
+++ b/README.md
@@ -40,6 +40,11 @@ Download the latest release for your platform from the [Releases page](https://g
 | **Windows** | `.exe` installer or `.msi` |
 | **Linux** | `.AppImage`, `.deb`, `.rpm`, or `.tar.gz` |
 
+> **Note for Linux deb/rpm users**: The server component requires [wasmtime](https://wasmtime.dev/). Install it with:
+> ```bash
+> curl https://wasmtime.dev/install.sh -sSf | bash
+> ```
+
 ### Other Installation Methods
 
 | Method | Command |
diff --git a/src/rustfava/cli.py b/src/rustfava/cli.py
index b632718c4..d577ff7d7 100644
--- a/src/rustfava/cli.py
+++ b/src/rustfava/cli.py
@@ -8,6 +8,16 @@
 
 import click
 
+# Version for PyInstaller builds where importlib.metadata is unavailable
+__version__ = "0.1.8"
+
+try:
+    from importlib.metadata import version as get_version
+
+    __version__ = get_version("rustfava")
+except Exception:  # pragma: no cover
+    pass
+
 
 class AddressInUse(click.ClickException):  # noqa: D101
     def __init__(self, port: int) -> None:  # pragma: no cover
@@ -93,7 +103,7 @@ def _add_env_filenames(filenames: tuple[str, ...]) -> tuple[str, ...]:
 @click.option(
     "--poll-watcher", is_flag=True, help="Use old polling-based watcher."
 )
-@click.version_option(package_name="rustfava")
+@click.version_option(version=__version__)
 def main(  # noqa: PLR0913
     *,
     filenames: tuple[str, ...] = (),
diff --git a/src/rustfava/rustledger/engine.py b/src/rustfava/rustledger/engine.py
index 348cfbf38..934439049 100644
--- a/src/rustfava/rustledger/engine.py
+++ b/src/rustfava/rustledger/engine.py
@@ -263,7 +263,9 @@ def is_encrypted(self, filepath: str) -> bool:
         """
         # Resolve to absolute path for WASM file access
         file_path = Path(filepath).resolve()
-        allow_dir = str(file_path.parent)
+        # Use root "/" to allow include paths with ".." (parent directory references)
+        # This matches native beancount behavior where includes can reference any path
+        allow_dir = "/"
         result_json = self._run(
             ["is-encrypted", str(file_path)],
             allow_dir=allow_dir,
@@ -438,7 +440,9 @@ def load_full(
                 - loaded_files: List of all resolved include files
         """
         file_path = Path(filepath).resolve()
-        allow_dir = str(file_path.parent)
+        # Use root "/" to allow include paths with ".." (parent directory references)
+        # This matches native beancount behavior where includes can reference any path
+        allow_dir = "/"
 
         # Build command args
         args = ["load-full", str(file_path)]