diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index f9d6e848..8d961b7e 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -46,6 +46,10 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Write commit hash to file
+        run: |
+          echo $GITHUB_SHA > GITHUB_SHA
+
       - name: Extract metadata (tags, labels) for Docker
         id: meta
         uses: docker/metadata-action@v4.4.0
diff --git a/.github/workflows/edge.yml b/.github/workflows/edge.yml
index 11d78395..e8d35e5d 100644
--- a/.github/workflows/edge.yml
+++ b/.github/workflows/edge.yml
@@ -16,6 +16,7 @@ jobs:
           deno-version: v2.4.3
       - name: Compile for all platforms
         run: |
+          echo $GITHUB_SHA > GITHUB_SHA
           deno task build
           deno task server:zip:linux-x86_64
           deno task server:zip:linux-aarch64
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9d778d60..658a0c97 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,7 +21,9 @@ jobs:
         with:
           deno-version: v2.4.5
       - name: Run build
-        run: deno task build
+        run: |
+          echo $GITHUB_SHA > GITHUB_SHA
+          deno task build
       - name: Publish to JSR
         run: deno publish --allow-dirty
       - name: Release
diff --git a/.github/workflows/server.yml b/.github/workflows/server.yml
index 34c5cf9b..ec0c5ef8 100644
--- a/.github/workflows/server.yml
+++ b/.github/workflows/server.yml
@@ -23,6 +23,7 @@ jobs:
 
       - name: Build bundles
         run: |
+          echo $GITHUB_SHA > GITHUB_SHA
           deno task build
 
       - name: Compile for all platforms
diff --git a/Dockerfile b/Dockerfile
index 5ccc89f1..3360455d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,11 +5,8 @@ RUN apt update && apt install -y git
 WORKDIR /app
 ADD . /app
 
-# Inject the github sha if available
-ARG GITHUB_SHA
-
 # This will produce the `silverbullet` self-contained binary in /app/silverbullet
-RUN GITHUB_SHA=${GITHUB_SHA} deno task build
+RUN deno task build
 
 # Stage 2: Create the runtime from the build
 FROM ubuntu:noble
diff --git a/cmd/update_version.ts b/cmd/update_version.ts
index b2e2cdac..8cd8af28 100644
--- a/cmd/update_version.ts
+++ b/cmd/update_version.ts
@@ -11,8 +11,8 @@ export async function updateVersionFile() {
   let commitVersion = new TextDecoder().decode(stdout).trim();
 
   if (!commitVersion) {
-    // Probably in CI, let's pull from Github environment variables instead
-    commitVersion = `${version}-${Deno.env.get("GITHUB_SHA")}`;
+    // Probably in CI, let's pull from the GITHUB_SHA file
+    commitVersion = `${version}-${Deno.readTextFileSync("GITHUB_SHA")}`;
   }
 
   const versionFilePath = "./public_version.ts";