diff --git a/docker-compose.yml b/docker-compose.yml
index bf24b63..d7895d7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,16 +1,15 @@
 services:
   web:
-    build:
-      # Context is the repo root so the Dockerfile can read .git for the
-      # SHA stamp — Coolify doesn't expose the commit as an env var.
-      context: .
-      dockerfile: web/Dockerfile
+    build: ./web
     container_name: lazyflat-web
     restart: unless-stopped
     depends_on:
       apply:
         condition: service_started
     environment:
+      # Coolify injects SOURCE_COMMIT at runtime on every deploy; settings.py
+      # reads GIT_COMMIT and renders it in the footer.
+      - GIT_COMMIT=${SOURCE_COMMIT:-dev}
       - AUTH_USERNAME=${AUTH_USERNAME}
       - AUTH_PASSWORD_HASH=${AUTH_PASSWORD_HASH}
       - SESSION_SECRET=${SESSION_SECRET}
diff --git a/web/Dockerfile b/web/Dockerfile
index 7c2077c..ce77176 100644
--- a/web/Dockerfile
+++ b/web/Dockerfile
@@ -4,29 +4,11 @@ ENV PYTHONUNBUFFERED=1
 WORKDIR /app
 
 # Deps first so a code-only change doesn't bust the pip-install cache.
-COPY web/requirements.txt .
+COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
 # App code.
-COPY web/ .
-
-# Stamp with the git SHA read from the build context's .git dir. Kept last so
-# only this thin layer invalidates per commit. Coolify doesn't expose the SHA
-# as an env/build-arg, but it does leave .git intact in the checkout — so we
-# parse HEAD ourselves. Build context must be the repo root for .git to be
-# visible (see docker-compose.yml).
-COPY .git /tmp/.git
-RUN set -eu; \
-    HEAD=$(cat /tmp/.git/HEAD 2>/dev/null || echo ""); \
-    case "$HEAD" in \
-      "ref: "*) REF=$(printf '%s' "$HEAD" | awk '{print $2}'); \
-                SHA=$(cat "/tmp/.git/$REF" 2>/dev/null || \
-                      awk -v r="$REF" '$2==r {print $1}' /tmp/.git/packed-refs 2>/dev/null || \
-                      echo "");; \
-      *) SHA="$HEAD";; \
-    esac; \
-    printf '%s\n' "${SHA:-dev}" > /git_commit; \
-    rm -rf /tmp/.git
+COPY . .
 
 EXPOSE 8000
 
diff --git a/web/settings.py b/web/settings.py
index dd11e86..dfed3e9 100644
--- a/web/settings.py
+++ b/web/settings.py
@@ -61,19 +61,7 @@ ANTHROPIC_API_KEY: str = getenv("ANTHROPIC_API_KEY", "")
 ANTHROPIC_MODEL: str = getenv("ANTHROPIC_MODEL", "claude-haiku-4-5-20251001")
 
 # --- Build info --------------------------------------------------------------
-# The Dockerfile writes /git_commit at build time by parsing the repo's .git
-# dir (Coolify doesn't expose the SHA as an env var). Env GIT_COMMIT overrides
-# the file so local dev can fake a value. Rendered in the site footer so the
-# running commit is visible at a glance.
-def _read_git_commit() -> str:
-    env_val = getenv("GIT_COMMIT", "").strip()
-    if env_val:
-        return env_val
-    try:
-        with open("/git_commit") as _f:
-            return _f.read().strip() or "dev"
-    except OSError:
-        return "dev"
-
-
-GIT_COMMIT: str = _read_git_commit()
+# Coolify injects SOURCE_COMMIT into the container's runtime env on every
+# deploy; docker-compose.yml maps it to GIT_COMMIT. Rendered in the site
+# footer so the running commit is visible at a glance.
+GIT_COMMIT: str = getenv("GIT_COMMIT", "").strip() or "dev"