diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 59a27d8..33eadb3 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -60,8 +60,9 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           annotations: ${{ steps.meta.outputs.annotations }}
-          # Keep the in-app build stamp in lockstep with the image tag.
+          # Build stamp: version from package.json, commit from the sha (the
+          # build context has no .git) → `v<version> (<short-sha>)`.
           build-args: |
-            ASB_VERSION=${{ steps.meta.outputs.version }}
+            ASB_COMMIT=${{ github.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
diff --git a/Dockerfile b/Dockerfile
index 64b9b1d..b50075a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,10 +17,15 @@ COPY schemas ./schemas
 COPY src ./src
 COPY THIRD-PARTY-NOTICES.md ./
 
-# Stamp the in-HTML build marker with the image version so the in-app build
-# stamp matches the published tag (build.mjs honours $ASB_VERSION over package.json).
+# In-HTML build stamp = `v<version> (<commit>)`. The build context ships no .git,
+# so pass the commit in via ASB_COMMIT (build.mjs shortens it); the version comes
+# from package.json unless ASB_VERSION overrides it (bundle.sh passes the release
+# tag). docker.yml passes ASB_COMMIT=${{ github.sha }} and leaves ASB_VERSION
+# unset so the stamp reads the package.json version, e.g. `v0.5.0 (6b360e8)`.
 ARG ASB_VERSION
-ENV ASB_VERSION=${ASB_VERSION}
+ARG ASB_COMMIT
+ENV ASB_VERSION=${ASB_VERSION} \
+    ASB_COMMIT=${ASB_COMMIT}
 
 RUN npm ci --no-audit --no-fund && npm run build
 
diff --git a/build/build.mjs b/build/build.mjs
index 30cb34c..971ef08 100644
--- a/build/build.mjs
+++ b/build/build.mjs
@@ -31,7 +31,13 @@ async function buildStamp() {
     commit = execFileSync('git', ['rev-parse', '--short', 'HEAD'], { cwd: root }).toString().trim();
     // `git status --porcelain` is empty iff the tree exactly matches HEAD.
     if (execFileSync('git', ['status', '--porcelain'], { cwd: root }).toString().trim()) commit += '-dirty';
-  } catch { /* not a git checkout — fall back to version only */ }
+  } catch {
+    // Not a git checkout (e.g. the Docker build context ships no .git) — use an
+    // injected commit if one was passed, so the stamp stays `v<version> (<sha>)`
+    // instead of falling back to version-only. $ASB_COMMIT is the full sha;
+    // shorten to git's 7-char form.
+    if (process.env.ASB_COMMIT) commit = process.env.ASB_COMMIT.trim().slice(0, 7);
+  }
   return commit ? `v${version} (${commit})` : `v${version}`;
 }