diff --git a/.github/workflows/deployment.yaml b/.github/workflows/deployment.yaml
index 27f3fd7..60e9862 100644
--- a/.github/workflows/deployment.yaml
+++ b/.github/workflows/deployment.yaml
@@ -165,6 +165,7 @@ jobs:
           tags: ${{ env.GCP_REGISTRY }}/${{ env.GCP_PROJECT }}/${{ inputs.image_path }}:latest
           build-args: |
             GH_ACCESS_TOKEN=${{ env.GH_ACCESS_TOKEN }}
+            GIT_SHA=${{ github.sha }}
 
       - name: Run Trivy vulnerability scanner on image
         if: ${{ inputs.deploy_type != 'release-only' }}
@@ -187,6 +188,7 @@ jobs:
           tags: ${{ env.GCP_REGISTRY }}/${{ env.GCP_PROJECT }}/${{ inputs.image_path }}:latest
           build-args: |
             GH_ACCESS_TOKEN=${{ env.GH_ACCESS_TOKEN }}
+            GIT_SHA=${{ github.sha }}
 
       # --- GKE deploy ---
       - name: Get GKE Credentials
diff --git a/.github/workflows/shared-registry-push.yaml b/.github/workflows/shared-registry-push.yaml
index f29c5dc..827ade7 100644
--- a/.github/workflows/shared-registry-push.yaml
+++ b/.github/workflows/shared-registry-push.yaml
@@ -129,6 +129,7 @@ jobs:
             ${{ env.GCP_REGISTRY_SHARED }}/${{ env.GCP_PROJECT_SHARED }}/wanaware-platform/${{ inputs.image_path }}:${{ steps.timestamp.outputs.value }}
           build-args: |
             GH_ACCESS_TOKEN=${{ env.GH_ACCESS_TOKEN }}
+            GIT_SHA=${{ github.sha }}
 
       # Surface the result. Because the push is best-effort, the job goes green
       # even when it fails, so without an explicit warning a stale shared