diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 82452990c9..82628b90ae 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -34,7 +34,9 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }} 
 
       - name: Build image
-        run: docker build . --file Dockerfile --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: |
+          SHORT_SHA=$(echo ${GITHUB_SHA} | cut -c1-12)
+          docker build . --file Dockerfile --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}" --build-arg GIT_SHA=${SHORT_SHA}
 
       - name: Push image to GitHub Container Registry
         run: |
diff --git a/Dockerfile b/Dockerfile
index 5590cdab25..02b1d0fbdc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -58,6 +58,9 @@ COPY db/ ./db
 
 RUN $HOME/.cargo/bin/cargo fetch
 
+ARG GIT_SHA
+RUN echo -n ${GIT_SHA} > GIT_SHA
+
 # Run all of the tests
 RUN SQLX_OFFLINE=true \
   LD_LIBRARY_PATH=/usr/lib:${LD_LIBRARY_PATH} \
@@ -157,6 +160,7 @@ COPY --from=rust-build /tmp/target/release/w2l-download-job /
 COPY --from=rust-build /tmp/target/release/w2l-inference-job /
 COPY --from=rust-build /tmp/target/release/websocket-gateway /
 COPY --from=rust-build /tmp/target/release/twitch-pubsub-subscriber /
+COPY --from=rust-build /tmp/GIT_SHA /
 
 # SSL certs are required for crypto
 COPY --from=rust-build /etc/ssl /etc/ssl
diff --git a/crates/service/storyteller_web/src/main.rs b/crates/service/storyteller_web/src/main.rs
index f9fa06d5ed..9a6c83263b 100644
--- a/crates/service/storyteller_web/src/main.rs
+++ b/crates/service/storyteller_web/src/main.rs
@@ -143,7 +143,6 @@ use twitch_common::twitch_secrets::TwitchSecrets;
 
 // TODO TODO -- also this: https://material-ui.com
 
-
 const DEFAULT_BIND_ADDRESS : &'static str = "0.0.0.0:12345";
 
 // Buckets (shared config)
@@ -434,13 +433,14 @@ pub async fn serve(server_state: ServerState) -> AnyhowResult<()>
   HttpServer::new(move || {
     // NB: Safe to clone due to internal arc
     let ip_banlist = server_state_arc.ip_banlist.clone();
+    let build_sha = std::fs::read_to_string("/GIT_SHA").unwrap_or(String::from("unknown"));
 
     let app = App::new()
       .app_data(server_state_arc.clone())
       .wrap(build_common_cors_config())
       .wrap(DefaultHeaders::new()
         .header("X-Backend-Hostname", &hostname)
-        .header("X-Build-Sha", ""))
+        .header("X-Build-Sha", build_sha.trim()))
       .wrap(IpFilter::new(ip_banlist))
       .wrap(Logger::new(&log_format)
         .exclude("/liveness")