diff --git a/.github/workflows/build-bundle.yml b/.github/workflows/build-bundle.yml
index eb4b335313..7c66eb9fea 100644
--- a/.github/workflows/build-bundle.yml
+++ b/.github/workflows/build-bundle.yml
@@ -80,13 +80,17 @@ jobs:
         env:
           GH_REF: ${{ inputs.gh_ref || github.ref_name }}
         run: |
-          # Same command the build uses to stamp version.txt, so the key
-          # always matches what ends up inside the bundle.
+          # Same command the build uses to stamp version.txt.
           BUNDLE_VERSION=$(./manage.sh version)
           SHORT_SHA=$(git rev-parse --short=12 HEAD)
+          # The key takes only the closest tag (--abbrev=0): the sha already
+          # pins the commit, and the full describe output is not stable
+          # across checkouts (its -g<sha> suffix length depends on the
+          # local object count). Must match build-docker.yml.
+          VERSION_TAG=$(git describe --tags --match '*.*.*' --abbrev=0)
           echo "gh_ref=$GH_REF" >> $GITHUB_OUTPUT
           echo "bundle_version=$BUNDLE_VERSION" >> $GITHUB_OUTPUT
-          echo "build_key=sha-${SHORT_SHA}-${BUNDLE_VERSION}" >> $GITHUB_OUTPUT
+          echo "build_key=sha-${SHORT_SHA}-${VERSION_TAG}" >> $GITHUB_OUTPUT
           echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT
           echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
           echo "commit_title=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT
diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index 9c674eba33..613f806571 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -109,11 +109,12 @@ jobs:
           # Must match the key computed by build-bundle.yml.
           BUNDLE_VERSION=$(./manage.sh version)
           SHORT_SHA=$(git rev-parse --short=12 HEAD)
+          VERSION_TAG=$(git describe --tags --match '*.*.*' --abbrev=0)
           echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
           echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT
           echo "commit_title=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT
           echo "bundle_version=$BUNDLE_VERSION" >> $GITHUB_OUTPUT
-          echo "build_key=sha-${SHORT_SHA}-${BUNDLE_VERSION}" >> $GITHUB_OUTPUT
+          echo "build_key=sha-${SHORT_SHA}-${VERSION_TAG}" >> $GITHUB_OUTPUT
 
       # The image set is a single block, so a single set-level check is
       # enough: `promote` drops a marker object in S3 only after every