diff --git a/bin/build-phar.sh b/bin/build-phar.sh
index 0a55d0e5d12..e15205f6571 100755
--- a/bin/build-phar.sh
+++ b/bin/build-phar.sh
@@ -8,7 +8,13 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 
 php $DIR/improve_class_alias.php
 
-vendor/bin/box compile
+php -r 'require "vendor/autoload.php"; Psalm\Internal\VersionUtils::dump();'
+if [[ ! -f build/phar-versions.php ]] ; then
+   echo "failed to dump versions";
+   exit;
+fi
+
+vendor/bin/box compile --no-parallel
 
 if [[ "$GPG_SIGNING" != '' ]] ; then
     if [[ "$GPG_SECRET_KEY" != '' ]] ; then
diff --git a/box.json.dist b/box.json.dist
index 97d99cddc50..1e3d29e86da 100644
--- a/box.json.dist
+++ b/box.json.dist
@@ -1,7 +1,11 @@
 {
     "output" : "build/psalm.phar",
     "files": [
-        "psalm"
+        "psalm",
+        "build/phar-versions.php"
+    ],
+    "map": [
+        {"build/phar-versions.php" : "phar-versions.php"}
     ],
     "files-bin": ["config.xsd"],
     "directories-bin" : [
diff --git a/scoper.inc.php b/scoper.inc.php
index 933ea320e7f..fd949abe620 100644
--- a/scoper.inc.php
+++ b/scoper.inc.php
@@ -4,7 +4,7 @@
 
 return [
     'patchers' => [
-        function ($filePath, $prefix, $contents) {
+        function (string $filePath, string $prefix, string $contents): string {
             //
             // PHP-Parser patch
             //
@@ -20,14 +20,14 @@ function ($filePath, $prefix, $contents) {
 
             return $contents;
         },
-        function ($filePath, $prefix, $contents) {
+        function (string $_filePath, string $prefix, string $contents): string {
             return str_replace(
-                '\\'.$prefix.'\Composer\Autoload\ClassLoader',
+                '\\' . $prefix . '\Composer\Autoload\ClassLoader',
                 '\Composer\Autoload\ClassLoader',
                 $contents
             );
         },
-        function ($filePath, $prefix, $contents) {
+        function (string $filePath, string $prefix, string $contents): string {
             if (strpos($filePath, 'src/Psalm') === 0) {
                 return str_replace(
                     [' \\PhpParser\\'],
@@ -38,7 +38,7 @@ function ($filePath, $prefix, $contents) {
 
             return $contents;
         },
-        function ($filePath, $prefix, $contents) {
+        function (string $filePath, string $prefix, string $contents): string {
             if (strpos($filePath, 'vendor/openlss') === 0) {
                 return str_replace(
                     $prefix . '\\DomDocument',
@@ -49,32 +49,19 @@ function ($filePath, $prefix, $contents) {
 
             return $contents;
         },
-        function ($filePath, $prefix, $contents) {
-            if ($filePath === 'src/Psalm/Internal/Cli/Psalm.php') {
-                return str_replace(
-                    '\\' . $prefix . '\\PSALM_VERSION',
-                    'PSALM_VERSION',
-                    $contents
-                );
-            }
-
-            return $contents;
-        },
-        function ($filePath, $prefix, $contents) {
-            $ret = str_replace(
-                $prefix . '\\Psalm\\',
-                'Psalm\\',
-                $contents
-            );
-            return $ret;
-        },
     ],
-    'whitelist' => [
+    'exclude-classes' => [
         ClassLoader::class,
         Stringable::class,
-        'Psalm\*',
     ],
-    'files-whitelist' => [
+    'exclude-namespaces' => [
+        'Psalm',
+    ],
+    'exclude-constants' => [
+        'PSALM_VERSION',
+        'PHP_PARSER_VERSION',
+    ],
+    'exclude-files' => [
         'src/spl_object_id.php',
         'vendor/symfony/polyfill-php80/Php80.php',
         'vendor/symfony/polyfill-php80/PhpToken.php',
diff --git a/src/Psalm/Internal/Cli/Plugin.php b/src/Psalm/Internal/Cli/Plugin.php
index c4e8fe4ab8a..cafaf4597cb 100644
--- a/src/Psalm/Internal/Cli/Plugin.php
+++ b/src/Psalm/Internal/Cli/Plugin.php
@@ -2,7 +2,6 @@
 
 namespace Psalm\Internal\Cli;
 
-use PackageVersions\Versions;
 use Psalm\Internal\CliUtils;
 use Psalm\Internal\PluginManager\Command\DisableCommand;
 use Psalm\Internal\PluginManager\Command\EnableCommand;
@@ -31,7 +30,7 @@ public static function run(): void
         $vendor_dir = CliUtils::getVendorDir($current_dir);
         CliUtils::requireAutoloaders($current_dir, false, $vendor_dir);
 
-        $app = new Application('psalm-plugin', Versions::getVersion('vimeo/psalm'));
+        $app = new Application('psalm-plugin', PSALM_VERSION);
 
         $psalm_root = dirname(__DIR__, 4) . DIRECTORY_SEPARATOR;
 
diff --git a/src/Psalm/Internal/CliUtils.php b/src/Psalm/Internal/CliUtils.php
index 05dea134a7a..c3d536eeb5d 100644
--- a/src/Psalm/Internal/CliUtils.php
+++ b/src/Psalm/Internal/CliUtils.php
@@ -4,7 +4,6 @@
 
 use Composer\Autoload\ClassLoader;
 use JsonException;
-use PackageVersions\Versions;
 use Phar;
 use Psalm\Config;
 use Psalm\Config\Creator;
@@ -158,8 +157,8 @@ public static function requireAutoloaders(
             exit(1);
         }
 
-        define('PSALM_VERSION', Versions::getVersion('vimeo/psalm'));
-        define('PHP_PARSER_VERSION', Versions::getVersion('nikic/php-parser'));
+        define('PSALM_VERSION', VersionUtils::getPsalmVersion());
+        define('PHP_PARSER_VERSION', VersionUtils::getPhpParserVersion());
 
         return $first_autoloader;
     }
diff --git a/src/Psalm/Internal/VersionUtils.php b/src/Psalm/Internal/VersionUtils.php
new file mode 100644
index 00000000000..c175b0ad581
--- /dev/null
+++ b/src/Psalm/Internal/VersionUtils.php
@@ -0,0 +1,99 @@
+<?php
+
+namespace Psalm\Internal;
+
+use OutOfBoundsException;
+use PackageVersions\Versions;
+use Phar;
+
+use function class_exists;
+use function dirname;
+use function file_put_contents;
+use function var_export;
+
+/**
+ * @internal
+ * @psalm-type _VersionData=array{"vimeo/psalm": string, "nikic/php-parser": string}
+ */
+final class VersionUtils
+{
+    private const PSALM_PACKAGE = 'vimeo/psalm';
+    private const PHP_PARSER_PACKAGE = 'nikic/php-parser';
+
+    /** @var null|_VersionData */
+    private static $versions = null;
+
+    /** @psalm-suppress UnusedConstructor it's here to prevent instantiations */
+    private function __construct()
+    {
+    }
+
+    public static function getPsalmVersion(): string
+    {
+        return self::getVersions()[self::PSALM_PACKAGE];
+    }
+
+    public static function getPhpParserVersion(): string
+    {
+        return self::getVersions()[self::PHP_PARSER_PACKAGE];
+    }
+
+    /** @psalm-suppress UnusedMethod called from bin/build-phar.sh */
+    public static function dump(): void
+    {
+        $versions = self::loadComposerVersions();
+        $exported = '<?php return ' . var_export($versions, true) . ';';
+        file_put_contents(dirname(__DIR__, 3) . '/build/phar-versions.php', $exported);
+    }
+
+    /** @return _VersionData */
+    private static function getVersions(): array
+    {
+        if (self::$versions !== null) {
+            return self::$versions;
+        }
+
+        if ($versions = self::loadPharVersions()) {
+            return self::$versions = $versions;
+        }
+
+        if ($versions = self::loadComposerVersions()) {
+            return self::$versions = $versions;
+        }
+
+        return self::$versions = [self::PSALM_PACKAGE => 'unknown', self::PHP_PARSER_PACKAGE => 'unknown'];
+    }
+
+    /** @return _VersionData|null */
+    private static function loadPharVersions(): ?array
+    {
+        if (!class_exists(Phar::class)) {
+            return null;
+        }
+
+        $phar_filename = Phar::running(true);
+
+        if (!$phar_filename) {
+            return null;
+        }
+
+        /**
+         * @psalm-suppress UnresolvableInclude
+         * @var _VersionData
+         */
+        return require($phar_filename . '/phar-versions.php');
+    }
+
+    /** @return _VersionData|null */
+    private static function loadComposerVersions(): ?array
+    {
+        try {
+            return [
+                self::PSALM_PACKAGE => Versions::getVersion(self::PSALM_PACKAGE),
+                self::PHP_PARSER_PACKAGE => Versions::getVersion(self::PHP_PARSER_PACKAGE),
+            ];
+        } catch (OutOfBoundsException $ex) {
+        }
+        return null;
+    }
+}
diff --git a/vendor-bin/box/composer.json b/vendor-bin/box/composer.json
index f0d926cb1f8..f6b05bbd5cd 100644
--- a/vendor-bin/box/composer.json
+++ b/vendor-bin/box/composer.json
@@ -2,7 +2,7 @@
 	"minimum-stability": "dev",
 	"prefer-stable": true,
 	"require": {
-		"humbug/box": "3.10.*"
+		"humbug/box": "^3.16.0"
 	},
 	"config": {
 		"allow-plugins": {