diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index ed059fefc..45ebf9fd3 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -109,5 +109,7 @@ jobs:
                   push: ${{ steps.docker-meta.outputs.publish == 'true' }}
                   tags: ${{ steps.docker-meta.outputs.tags }}
                   platforms: ${{ steps.docker-meta.outputs.platforms }}
+                  build-args: |
+                      BUILD_COMMIT=${{ github.event.pull_request.head.sha || github.sha }}
                   cache-from: type=gha
                   cache-to: type=gha,mode=max,ignore-error=true
diff --git a/docker/Dockerfile b/docker/Dockerfile
index c00b232d9..53368c8c7 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -15,6 +15,11 @@ RUN corepack enable && pnpm install --frozen-lockfile --ignore-scripts
 
 COPY . .
 
+# CI passes the git commit so Settings > About shows "<version> (<sha>)";
+# the inject script is a no-op when BUILD_COMMIT is empty (local builds).
+ARG BUILD_COMMIT=""
+RUN node tools/build/inject-build-commit.mjs
+
 RUN pnpm nx build web --configuration=pwa
 RUN pnpm nx build web-backend