diff --git a/.dockerignore b/.dockerignore
index 9b75277..3850038 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,4 +1,5 @@
-.git
+# .git is sent so the build can stamp the version, without its config.
+.git/config
 *.md
 !README.md
 neoircd
diff --git a/Dockerfile b/Dockerfile
index 32acda7..b90d0ca 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -39,8 +39,19 @@ COPY --from=web-builder /web/dist/ web/dist/
 RUN make test
 
 # Build static binaries (no cgo needed at runtime — modernc.org/sqlite is pure Go)
-ARG VERSION=dev
-RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.Version=${VERSION}" -o /neoircd ./cmd/neoircd/
+#
+# neoircd is stamped with the VERSION build arg when one is given, otherwise
+# with the tag or short commit from the .git in the build context. With .git
+# present, a version that is still empty, dev or unknown fails the build.
+ARG VERSION
+RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
+    if [ -e .git ]; then \
+        case "$VERSION" in ""|dev|unknown) \
+            echo "version is '$VERSION' although .git is present" >&2; \
+            exit 1 ;; \
+        esac; \
+    fi; \
+    CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.Version=${VERSION}" -o /neoircd ./cmd/neoircd/
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /neoirc-cli ./cmd/neoirc-cli/
 
 # Runtime stage
diff --git a/Makefile b/Makefile
index f00e4b7..6758284 100644
--- a/Makefile
+++ b/Makefile
@@ -2,8 +2,7 @@
 
 BINARY := neoircd
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
-BUILDARCH := $(shell go env GOARCH)
-LDFLAGS := -X main.Version=$(VERSION) -X main.Buildarch=$(BUILDARCH)
+LDFLAGS := -X main.Version=$(VERSION)
 
 all: check build