diff --git a/.github/workflows/build-adhoc.yml b/.github/workflows/build-adhoc.yml
index 327c449fc4..a85065ad74 100644
--- a/.github/workflows/build-adhoc.yml
+++ b/.github/workflows/build-adhoc.yml
@@ -34,6 +34,11 @@ jobs:
     secrets: inherit
     with:
       gh_ref: ${{ inputs.gh_ref }}
+      # Pin the exact commit build-bundle already resolved and uploaded to
+      # S3, instead of letting build-docker re-resolve gh_ref on its own
+      # checkout minutes later, which can land on a newer commit than the
+      # one actually bundled if gh_ref names a branch that moved meanwhile.
+      sha: ${{ needs.build-bundle.outputs.sha }}
       force: ${{ inputs.force }}
 
   build-docker-admin-console:
diff --git a/.github/workflows/build-bundle.yml b/.github/workflows/build-bundle.yml
index 5a956cca28..64683a902c 100644
--- a/.github/workflows/build-bundle.yml
+++ b/.github/workflows/build-bundle.yml
@@ -26,6 +26,15 @@ on:
         type: boolean
         required: false
         default: false
+    outputs:
+      sha:
+        description: >-
+          The exact commit this run resolved gh_ref to and bundled. Callers
+          that also trigger build-docker.yml should pass it through as that
+          workflow's `sha` input, so both pipelines agree on one commit
+          instead of each re-resolving gh_ref independently at a different
+          time.
+        value: ${{ jobs.check.outputs.sha }}
 
 # Literal group name: under `workflow_call`, `github.workflow` resolves to the
 # caller's workflow, which put this workflow and the other reusable one called
diff --git a/.github/workflows/build-develop.yml b/.github/workflows/build-develop.yml
index 7346450831..d947cb1741 100644
--- a/.github/workflows/build-develop.yml
+++ b/.github/workflows/build-develop.yml
@@ -32,6 +32,11 @@ jobs:
     secrets: inherit
     with:
       gh_ref: "develop"
+      # Pin the exact commit build-bundle already resolved and uploaded to
+      # S3, instead of letting build-docker re-resolve "develop" on its own
+      # checkout minutes later, which can land on a newer commit than the
+      # one actually bundled.
+      sha: ${{ needs.build-bundle.outputs.sha }}
       force: ${{ inputs.force || false }}
 
   build-docker-admin-console:
diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index a97b163439..c55d437c5f 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -20,6 +20,17 @@ on:
         type: string
         required: true
         default: 'develop'
+      sha:
+        description: >-
+          Exact commit to check out and build, e.g. from build-bundle.yml's
+          `sha` output. gh_ref is still used to resolve the checkout when
+          this is empty, and always names the branch tag to move — passing
+          both avoids the checkout re-resolving gh_ref on its own, possibly
+          to a newer commit than the one build-bundle.yml already bundled
+          and uploaded to S3 under its own resolved sha.
+        type: string
+        required: false
+        default: ''
       force:
         description: 'Rebuild and overwrite even if this sha is already promoted'
         type: boolean
@@ -60,7 +71,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          ref: ${{ inputs.gh_ref }}
+          ref: ${{ inputs.sha != '' && inputs.sha || inputs.gh_ref }}
 
       - name: Extract some useful variables
         id: vars
@@ -148,7 +159,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.gh_ref }}
+          ref: ${{ inputs.sha != '' && inputs.sha || inputs.gh_ref }}
 
       - name: Login to Docker Registry
         uses: docker/login-action@v4
diff --git a/.github/workflows/build-staging.yml b/.github/workflows/build-staging.yml
index c2e3dad823..a14f4e3714 100644
--- a/.github/workflows/build-staging.yml
+++ b/.github/workflows/build-staging.yml
@@ -32,6 +32,11 @@ jobs:
     secrets: inherit
     with:
       gh_ref: "staging"
+      # Pin the exact commit build-bundle already resolved and uploaded to
+      # S3, instead of letting build-docker re-resolve "staging" on its own
+      # checkout minutes later, which can land on a newer commit than the
+      # one actually bundled.
+      sha: ${{ needs.build-bundle.outputs.sha }}
       force: ${{ inputs.force || false }}
 
   build-docker-admin-console: