diff --git a/Dockerfile b/Dockerfile
index 31d17df..07670fa 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,9 +9,11 @@ RUN go mod download
 
 COPY . .
 
-# Build both binaries as static.
-RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /tunnel-server ./cmd/server/
-RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /tunnel-client ./cmd/client/
+ARG GIT_COMMIT=unknown
+
+# Build both binaries as static; Commit matches ship.sh / local -ldflags.
+RUN CGO_ENABLED=0 go build -ldflags="-s -w -X github.com/nixc/reverse-ssh-traefik/internal/buildinfo.Commit=${GIT_COMMIT}" -o /tunnel-server ./cmd/server/
+RUN CGO_ENABLED=0 go build -ldflags="-s -w -X github.com/nixc/reverse-ssh-traefik/internal/buildinfo.Commit=${GIT_COMMIT}" -o /tunnel-client ./cmd/client/
 
 # --- Server image ---
 FROM alpine:3.21 AS server
diff --git a/cmd/client/main.go b/cmd/client/main.go
index 9837b30..48dc8f9 100644
--- a/cmd/client/main.go
+++ b/cmd/client/main.go
@@ -6,6 +6,7 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/nixc/reverse-ssh-traefik/internal/buildinfo"
 	"github.com/nixc/reverse-ssh-traefik/internal/client"
 )
 
@@ -26,7 +27,7 @@ func envOr(key, fallback string) string {
 
 func main() {
 	log.SetFlags(log.LstdFlags | log.Lshortfile)
-	log.Println("tunnel-client starting")
+	log.Printf("tunnel-client starting commit=%s", buildinfo.Commit)
 
 	serverAddr := envRequired("TUNNEL_SERVER")
 	domain := envRequired("TUNNEL_DOMAIN")
diff --git a/cmd/server/main.go b/cmd/server/main.go
index 4053c24..3c1612f 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -7,6 +7,7 @@ import (
 	"strconv"
 	"syscall"
 
+	"github.com/nixc/reverse-ssh-traefik/internal/buildinfo"
 	"github.com/nixc/reverse-ssh-traefik/internal/server"
 )
 
@@ -40,7 +41,7 @@ func envInt(key string, fallback int) int {
 
 func main() {
 	log.SetFlags(log.LstdFlags | log.Lshortfile)
-	log.Println("tunnel-server starting")
+	log.Printf("tunnel-server starting commit=%s", buildinfo.Commit)
 
 	// SSH server config (for accepting tunnel clients).
 	sshPort := envOr("SSH_PORT", "2222")