diff --git a/Dockerfile.compat b/Dockerfile.compat
index 873c3d394..fc35cc26e 100644
--- a/Dockerfile.compat
+++ b/Dockerfile.compat
@@ -27,6 +27,17 @@ RUN rm -rf /build/depends/built /build/depends/work \
     && rm -rf /build/src/cc/*.o /build/src/cc/*.a \
     && rm -f /build/config.status /build/config.log
 
+# The build context excludes .git (see .dockerignore), so genbuild.sh cannot derive
+# a version and would stamp the binaries "-unk". build.sh computes the real one
+# on the host and passes it in here.
+ARG BUILD_DESC=
+ENV DRAGONX_BUILD_DESC=${BUILD_DESC}
+
+RUN if [ -z "$DRAGONX_BUILD_DESC" ]; then \
+      echo "WARNING: no BUILD_DESC build-arg -- binaries will be stamped -unk." >&2; \
+      echo "         Prefer ./build.sh --linux-compat, or pass --build-arg BUILD_DESC=..." >&2; \
+    fi
+
 RUN cd /build && ./util/build.sh --disable-tests -j$(nproc)
 
 # Strip binaries inside the container so extracted files are already small
diff --git a/build.sh b/build.sh
index d780a641b..e39c4a400 100755
--- a/build.sh
+++ b/build.sh
@@ -164,7 +164,34 @@ if [ $BUILD_LINUX_COMPAT -eq 1 ] || [ $BUILD_LINUX_RELEASE -eq 1 ] || [ $BUILD_W
         COMPAT_RELEASE_DIR="$RELEASE_DIR/dragonx-$VERSION-$COMPAT_PLATFORM"
 
         echo "Building Docker image (Ubuntu 20.04 base)..."
-        $DOCKER_CMD build -f Dockerfile.compat -t "$DOCKER_IMAGE" .
+        # .dockerignore excludes .git, so genbuild.sh inside the container cannot
+        # derive the version and would stamp the binaries "-unk". Compute it on the
+        # host, mirroring util/genbuild.sh exactly, and pass it in via --build-arg.
+        # NB: build.sh runs under `set -eu -o pipefail`, so every git call here must be
+        # non-fatal -- a source tarball, a machine without git, or a branch whose only
+        # reachable tags are lightweight (v1.0.1-v1.0.3) would otherwise abort the build.
+        git diff >/dev/null 2>&1 || true   # refresh index: touched-but-unmodified are not dirty
+        COMPAT_BUILD_DESC=""
+        COMPAT_RAWDESC=$(git describe --abbrev=0 2>/dev/null || true)
+        if [ -n "$COMPAT_RAWDESC" ] \
+           && [ "$(git rev-parse HEAD 2>/dev/null)" = "$(git rev-list -1 "$COMPAT_RAWDESC" 2>/dev/null)" ] \
+           && git diff-index --quiet HEAD -- 2>/dev/null; then
+            COMPAT_BUILD_DESC="$COMPAT_RAWDESC"
+        else
+            COMPAT_SUFFIX=$(git rev-parse --short HEAD 2>/dev/null || true)
+            if [ -n "$COMPAT_SUFFIX" ]; then
+                git diff-index --quiet HEAD -- 2>/dev/null || COMPAT_SUFFIX="$COMPAT_SUFFIX-dirty"
+                COMPAT_BUILD_DESC="v$VERSION-$COMPAT_SUFFIX"
+            fi
+        fi
+        if [ -n "$COMPAT_BUILD_DESC" ]; then
+            echo "Stamping container build as: $COMPAT_BUILD_DESC"
+        else
+            echo "Warning: no usable git metadata; container binaries will be stamped -unk"
+        fi
+        $DOCKER_CMD build -f Dockerfile.compat \
+            --build-arg BUILD_DESC="$COMPAT_BUILD_DESC" \
+            -t "$DOCKER_IMAGE" .
 
         echo "Extracting binaries from Docker image..."
         CONTAINER_ID=$($DOCKER_CMD create "$DOCKER_IMAGE")
diff --git a/util/genbuild.sh b/util/genbuild.sh
index 08fb91dc5..49c870287 100755
--- a/util/genbuild.sh
+++ b/util/genbuild.sh
@@ -18,7 +18,12 @@ fi
 
 DESC=""
 SUFFIX=""
-if [ -e "$(which git 2>/dev/null)" -a "$(git rev-parse --is-inside-work-tree 2>/dev/null)" = "true" ]; then
+# Allow the build system to supply the version when git metadata is unavailable:
+# container builds exclude .git, and a linked worktree's .git file points outside
+# the build context. Without this such builds are stamped "-unk".
+if [ -n "${DRAGONX_BUILD_DESC:-}" ]; then
+    DESC="$DRAGONX_BUILD_DESC"
+elif [ -e "$(which git 2>/dev/null)" -a "$(git rev-parse --is-inside-work-tree 2>/dev/null)" = "true" ]; then
     # clean 'dirty' status of touched files that haven't been modified
     git diff >/dev/null 2>/dev/null