diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index de592d4..89c754b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -121,6 +121,7 @@ jobs:
         run: |
           VERSION="${TAG#v}"
           make build-docker \
+            VERSION="$VERSION" \
             DOCKER_REGISTRY="ghcr.io/${{ github.repository_owner }}" \
             DOCKER_TAG="$VERSION"
         env:
diff --git a/Dockerfile b/Dockerfile
index d43d63c..bcf6490 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -24,6 +24,13 @@ COPY src ./src
 
 COPY --from=ui /build/ui/dist ./src/agentevals/_static
 
+# hatch-vcs reads the version from .git, which the docker build context omits.
+# Pass it in as a build arg. We use the generic SETUPTOOLS_SCM_PRETEND_VERSION
+# because hatch-vcs does not forward dist_name to setuptools-scm, so the
+# per-package SETUPTOOLS_SCM_PRETEND_VERSION_FOR_<DIST> form is never consulted.
+ARG VERSION
+ENV SETUPTOOLS_SCM_PRETEND_VERSION=${VERSION}
+
 RUN uv sync --frozen --no-dev --extra live --extra postgres \
     && groupadd --gid 1000 app \
     && useradd --uid 1000 --gid app --home-dir /app --no-log-init app \
diff --git a/Makefile b/Makefile
index 27c91d4..8eb30ee 100644
--- a/Makefile
+++ b/Makefile
@@ -28,7 +28,8 @@ build:
 	uv build
 
 build-docker:
-	docker buildx build --platform $(PLATFORMS) -t $(DOCKER_IMAGE_REF):$(DOCKER_TAG) --push .
+	@test -n "$(VERSION)" || { echo "ERROR: VERSION is empty. Pass VERSION=x.y.z explicitly, or install uv so hatch-vcs can resolve it."; exit 1; }
+	docker buildx build --platform $(PLATFORMS) --build-arg VERSION=$(VERSION) -t $(DOCKER_IMAGE_REF):$(DOCKER_TAG) --push .
 
 build-ui:
 	cd ui && npm ci && npm run build