diff --git a/README.md b/README.md
index d2800df..6e2778e 100644
--- a/README.md
+++ b/README.md
@@ -55,7 +55,8 @@ either one is broken. We provide:
 - `script/build` — build the frontend for production into `dist/`, then the
   static `netwatch-server` binary into the repo root with its version stamped
   in: `VERSION` from the environment, or when that is unset or empty,
-  `git describe` inside a git checkout, then `dev`
+  `git describe --tags --always --dirty` inside a git checkout, as
+  `script/docker` does, then `dev`
 - `script/run` — build with `script/build`, then run `netwatch-server` with its
   defaults (see [Settings](#settings))
 - `script/clean` — remove what `script/build` writes
diff --git a/TODO.md b/TODO.md
index 02ddbb6..9f120e6 100644
--- a/TODO.md
+++ b/TODO.md
@@ -22,6 +22,12 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-19: when `VERSION` is unset or empty, `script/build` stamps the
+  version from `git describe --tags --always --dirty`, as `script/docker` does
+  ([#156](https://git.eeqj.de/sneak/netwatch/issues/156)). Without `--tags` it
+  skipped lightweight tags, so `make run` could report a commit where the image
+  built from the same tree reported the tag. Checked once with a lightweight tag
+  on a scratch clone: `make build` stamped it
 - 2026-10-19: `.dockerignore` keeps Go test binaries and coverage output at the
   root out of the build context, with `/*.test` and `/*.out` in the repository's
   own section ([#155](https://git.eeqj.de/sneak/netwatch/issues/155)). Such
diff --git a/script/build b/script/build
index 1c5ff4f..599369e 100755
--- a/script/build
+++ b/script/build
@@ -10,9 +10,10 @@ main() {
     cd "$ROOT"
     "$ROOT/script/yarn" build
 
-    # VERSION comes from the environment. Unset or empty, it is git
-    # describe, or "dev" where there is no git or no repository history.
-    version="${VERSION:-$(git describe --always --dirty 2>/dev/null || echo dev)}"
+    # VERSION comes from the environment. Unset or empty, it is
+    # `git describe --tags --always --dirty`, as in script/docker, or
+    # "dev" where there is no git or no repository history.
+    version="${VERSION:-$(git describe --tags --always --dirty 2>/dev/null || echo dev)}"
 
     CGO_ENABLED=0 go build -trimpath \
         -ldflags "-s -w -X main.Version=$version" \