diff --git a/.gitignore b/.gitignore
index 0914809..8df4587 100644
--- a/.gitignore
+++ b/.gitignore
@@ -42,4 +42,5 @@ npm-debug.log*
 # Misc
 *.tgz
 *.tsbuildinfo
-/old-python/
\ No newline at end of file
+# RAUC signing keys (generated locally, secrets set in GitHub Actions)
+rauc-signing/
diff --git a/deploy/docker/Dockerfile.server b/deploy/docker/Dockerfile.server
index bae9db8..c3aeb24 100644
--- a/deploy/docker/Dockerfile.server
+++ b/deploy/docker/Dockerfile.server
@@ -5,9 +5,9 @@ FROM node:24-trixie-slim AS builder
 
 WORKDIR /app
 
-# Build deps for argon2 + bsb-plugin-cli
+# Build deps for argon2 + bsb-plugin-cli + git for version stamping
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    build-essential python3 \
+    build-essential python3 git \
     && rm -rf /var/lib/apt/lists/*
 
 COPY package.json package-lock.json ./
@@ -21,11 +21,20 @@ COPY server ./server
 WORKDIR /app/server
 RUN npm run build
 
+# Derive version from git. Coolify clones the repo with .git intact so
+# git describe / rev-parse work. Falls back to package.json version if
+# .git is missing (e.g. if a .dockerignore later excludes it).
+COPY .git /app/.git
+RUN cd /app && \
+    GIT_VER="$(git describe --tags --always --dirty 2>/dev/null || echo '')" && \
+    if [ -z "$GIT_VER" ]; then GIT_VER="$(git rev-parse --short HEAD 2>/dev/null || echo '')"; fi && \
+    if [ -z "$GIT_VER" ]; then GIT_VER="$(node -p 'require("./package.json").version' 2>/dev/null || echo 'dev')"; fi && \
+    echo "$GIT_VER" > /app/server/.bf-version && \
+    echo "Baked version: $GIT_VER"
+
 # ---- Runtime image ----
 FROM node:24-trixie-slim
 
-ARG BF_SERVER_VERSION=
-
 # ffmpeg for camera snapshot capture (optional but needed for /admin/entities/:id/snapshot)
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates ffmpeg wget \
@@ -53,6 +62,5 @@ USER betterframe
 WORKDIR /app/server
 
 ENV NODE_OPTIONS=--import=tsx
-ENV BF_SERVER_VERSION=${BF_SERVER_VERSION}
 
 CMD ["node", "--import", "tsx", "/app/node_modules/@bsb/base/lib/scripts/bsb-plugin-cli.js", "start"]
diff --git a/docker-compose.coolify.yml b/docker-compose.coolify.yml
index 9796c46..6931f8d 100644
--- a/docker-compose.coolify.yml
+++ b/docker-compose.coolify.yml
@@ -18,8 +18,7 @@ services:
       context: .
       dockerfile: deploy/docker/Dockerfile.server
       args:
-        BF_SERVER_VERSION: ${BF_SERVER_VERSION:-${SOURCE_COMMIT:-dev}}
-        SOURCE_COMMIT: ${SOURCE_COMMIT:-}
+        BF_SERVER_VERSION: ${BF_SERVER_VERSION:-${COOLIFY_GIT_COMMIT:-${SOURCE_COMMIT:-dev}}}
     container_name: betterframe-server
     restart: unless-stopped
     environment:
@@ -28,8 +27,7 @@ services:
       - BF_SQLITE_PATH=/var/lib/betterframe/betterframe.db
       - BF_NODERED_URL=http://nodered:1880
       - BF_SELF_URL=http://server:18080
-      - BF_SERVER_VERSION=${BF_SERVER_VERSION:-${SOURCE_COMMIT:-dev}}
-      - SOURCE_COMMIT=${SOURCE_COMMIT:-}
+      - BF_SERVER_VERSION=${BF_SERVER_VERSION:-${COOLIFY_GIT_COMMIT:-${SOURCE_COMMIT:-dev}}}
     volumes:
       - betterframe-data:/var/lib/betterframe
     expose:
diff --git a/server/src/shared/version.ts b/server/src/shared/version.ts
index 7fa3fc6..c74aa99 100644
--- a/server/src/shared/version.ts
+++ b/server/src/shared/version.ts
@@ -1,7 +1,19 @@
+import { readFileSync } from "node:fs";
+
+const BAKED_VERSION = (() => {
+  try {
+    const v = readFileSync("/app/server/.bf-version", "utf8").trim();
+    return v && v !== "dev" ? v : null;
+  } catch {
+    return null;
+  }
+})();
+
 export function serverVersion(): string {
   return (
     process.env.BF_SERVER_VERSION
     || process.env.BF_BUILD_VERSION
+    || BAKED_VERSION
     || process.env.COOLIFY_GIT_COMMIT
     || process.env.SOURCE_COMMIT
     || "dev"