diff --git a/.dockerignore b/.dockerignore
index de5ff91..5b2701b 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,11 +1,8 @@
-.git
+# .git is sent so that `make build` in the Dockerfile can stamp the commit into
+# upaas. List no tracked file here: git would see it as deleted in the build and
+# the version would end in -dirty.
 .env
 bin/
-.editorconfig
 .vscode/
 .idea/
 *.test
-LICENSE
-CONVENTIONS.md
-REPO_POLICIES.md
-README.md
diff --git a/Dockerfile b/Dockerfile
index 1a996e8..572ef99 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -31,6 +31,7 @@ RUN go mod download
 COPY . .
 
 RUN make test
+# Takes the version from `git describe` on the .git copied in above.
 RUN make build
 
 # Runtime stage
diff --git a/README.md b/README.md
index c7bce0f..785aab2 100644
--- a/README.md
+++ b/README.md
@@ -226,6 +226,10 @@ This recipe serves plain HTTP, so `UPAAS_PLAINTEXT_HTTP=true` is required for
 setup and every other form to pass the CSRF origin check. Behind a
 TLS-terminating reverse proxy, drop that line.
 
+The image shows the commit it was built from (the `git describe` output) in the
+page footer, the startup log and `/health`. Build it from a git clone: without
+the `.git` directory it shows `dev`.
+
 ### Deploying with Docker Compose
 
 [`docker-compose.yml`](docker-compose.yml) builds the image from this repo and
diff --git a/TODO.md b/TODO.md
index ff43640..5657433 100644
--- a/TODO.md
+++ b/TODO.md
@@ -20,6 +20,11 @@ regress.
 
 # Completed Steps
 
+- 2026-09-29: An image built from the `Dockerfile` now shows the commit it was
+  built from (the `git describe` output) in the footer, the startup log and
+  `/health` instead of `dev`: `.dockerignore` no longer leaves out `.git`, nor
+  any tracked file, which git would count as deleted and mark `-dirty` (#236).
+
 - 2026-09-29: `docker-compose.yml` now sets `UPAAS_PORT` to 8080 as well as
   `PORT`, since upaas reads `UPAAS_PORT` first and a `UPAAS_PORT` in `.env` made
   it listen away from the port mapping and healthcheck; the README's Compose