diff --git a/docker-compose.yml b/docker-compose.yml
index 80738c2..bf24b63 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,9 +1,10 @@
 services:
   web:
     build:
-      context: ./web
-      args:
-        SOURCE_COMMIT: ${SOURCE_COMMIT:-dev}
+      # Context is the repo root so the Dockerfile can read .git for the
+      # SHA stamp — Coolify doesn't expose the commit as an env var.
+      context: .
+      dockerfile: web/Dockerfile
     container_name: lazyflat-web
     restart: unless-stopped
     depends_on:
diff --git a/web/Dockerfile b/web/Dockerfile
index ba5000c..7c2077c 100644
--- a/web/Dockerfile
+++ b/web/Dockerfile
@@ -3,17 +3,30 @@ FROM python:3.12-slim
 ENV PYTHONUNBUFFERED=1
 WORKDIR /app
 
-COPY requirements.txt .
+# Deps first so a code-only change doesn't bust the pip-install cache.
+COPY web/requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY . .
+# App code.
+COPY web/ .
 
-# Stamp the image with the git SHA so the web footer can show which commit is
-# live. Coolify passes SOURCE_COMMIT as a build arg on every deploy; outside
-# Coolify the ARG defaults to "dev". Placed after COPY so only this thin layer
-# rebuilds when the SHA changes — pip install stays cached.
-ARG SOURCE_COMMIT=dev
-ENV GIT_COMMIT=${SOURCE_COMMIT}
+# Stamp with the git SHA read from the build context's .git dir. Kept last so
+# only this thin layer invalidates per commit. Coolify doesn't expose the SHA
+# as an env/build-arg, but it does leave .git intact in the checkout — so we
+# parse HEAD ourselves. Build context must be the repo root for .git to be
+# visible (see docker-compose.yml).
+COPY .git /tmp/.git
+RUN set -eu; \
+    HEAD=$(cat /tmp/.git/HEAD 2>/dev/null || echo ""); \
+    case "$HEAD" in \
+      "ref: "*) REF=$(printf '%s' "$HEAD" | awk '{print $2}'); \
+                SHA=$(cat "/tmp/.git/$REF" 2>/dev/null || \
+                      awk -v r="$REF" '$2==r {print $1}' /tmp/.git/packed-refs 2>/dev/null || \
+                      echo "");; \
+      *) SHA="$HEAD";; \
+    esac; \
+    printf '%s\n' "${SHA:-dev}" > /git_commit; \
+    rm -rf /tmp/.git
 
 EXPOSE 8000
 
diff --git a/web/settings.py b/web/settings.py
index 6c3db0c..dd11e86 100644
--- a/web/settings.py
+++ b/web/settings.py
@@ -61,6 +61,19 @@ ANTHROPIC_API_KEY: str = getenv("ANTHROPIC_API_KEY", "")
 ANTHROPIC_MODEL: str = getenv("ANTHROPIC_MODEL", "claude-haiku-4-5-20251001")
 
 # --- Build info --------------------------------------------------------------
-# Baked into the image at docker build time via the Dockerfile ARG; rendered in
-# the site footer so the running commit is visible at a glance.
-GIT_COMMIT: str = getenv("GIT_COMMIT", "dev")
+# The Dockerfile writes /git_commit at build time by parsing the repo's .git
+# dir (Coolify doesn't expose the SHA as an env var). Env GIT_COMMIT overrides
+# the file so local dev can fake a value. Rendered in the site footer so the
+# running commit is visible at a glance.
+def _read_git_commit() -> str:
+    env_val = getenv("GIT_COMMIT", "").strip()
+    if env_val:
+        return env_val
+    try:
+        with open("/git_commit") as _f:
+            return _f.read().strip() or "dev"
+    except OSError:
+        return "dev"
+
+
+GIT_COMMIT: str = _read_git_commit()