diff --git a/docker/build.sh b/docker/build.sh
index 85369368..49c9a39b 100755
--- a/docker/build.sh
+++ b/docker/build.sh
@@ -5,5 +5,5 @@
 # .git/ is excluded from the build context (.dockerignore) so the hash
 # must be passed as a build arg from the host.
 
-export GIT_HASH=$(git rev-parse --short HEAD)
+export GIT_HASH=$(git rev-parse HEAD)
 exec docker compose build "$@"
diff --git a/docker/chatmail_relay.dockerfile b/docker/chatmail_relay.dockerfile
index b4a63a5b..92ecb21f 100644
--- a/docker/chatmail_relay.dockerfile
+++ b/docker/chatmail_relay.dockerfile
@@ -64,6 +64,9 @@ RUN rm -f /tmp/chatmail.ini
 # Record image version (used in deploy fingerprint at runtime).
 # GIT_HASH is passed as a build arg (from docker-compose or CI) so that
 # .git/ can be excluded from the build context via .dockerignore.
+# Two files: chatmail-image-version is the immutable build hash (survives
+# deploys); chatmail-version is overwritten by cmdeploy run and restored
+# from the image version after each deploy in chatmail-init.sh.
 ARG GIT_HASH=unknown
 RUN echo "$GIT_HASH" > /etc/chatmail-image-version && \
     echo "$GIT_HASH" > /etc/chatmail-version