diff --git a/.github/workflows/aws-deployment.yml b/.github/workflows/aws-deployment.yml
index ecff5de2ac..7fc56beccb 100644
--- a/.github/workflows/aws-deployment.yml
+++ b/.github/workflows/aws-deployment.yml
@@ -76,6 +76,8 @@ jobs:
           file: ./contracts/dockerfile-actions
           push: true
           ssh: default
+          build-args: |
+            GIT_COMMIT_SHA=${{ github.sha }}
           tags: |
             ${{ env.ECR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
 
diff --git a/contracts/dockerfile-actions b/contracts/dockerfile-actions
index f830d2abb6..45de6f6c7f 100644
--- a/contracts/dockerfile-actions
+++ b/contracts/dockerfile-actions
@@ -69,5 +69,12 @@ ENV MAINNET_PROVIDER_URL="" \
   BEACON_PROVIDER_URL="" \
   HARDHAT_NETWORK=""
 
+# Git commit this image was built from. CI passes
+# --build-arg GIT_COMMIT_SHA=<github.sha>; empty for local builds. @talos/client's
+# runContainer reports it as the runner's `version`, letting the admin announce
+# redeploys to Discord.
+ARG GIT_COMMIT_SHA=""
+ENV GIT_COMMIT_SHA=$GIT_COMMIT_SHA
+
 USER runner
 CMD ["bun", "run", "runner.ts"]