diff --git a/build b/build
index b4ed219..24e80f0 100755
--- a/build
+++ b/build
@@ -2,6 +2,9 @@
 
 set -eu
 
+# cd to location of script
+cd "$(dirname "$(readlink -f "$0")")"
+
 # Builds the docker images.
 # Usage: ./build {COMPONENTS}, or just ./build to build all.
 # The resulting images are named wubloader-COMPONENT.
@@ -17,10 +20,7 @@ PUSH=${PUSH:-}
 BASE="quay.io/ekimekim"
 
 # The docker image tag, derived from the git commit + whether working tree is clean
-TAG=$(git rev-parse --short HEAD)
-if [ -n "$(git status --porcelain --untracked-files=no)" ]; then
-	TAG="$TAG-wip"
-fi
+TAG=$(./get-build-tag)
 
 if [ "$#" -gt 0 ]; then
 	COMPONENTS=("$@")
diff --git a/docker-compose.jsonnet b/docker-compose.jsonnet
index 16d3f05..297e5cb 100644
--- a/docker-compose.jsonnet
+++ b/docker-compose.jsonnet
@@ -7,9 +7,11 @@
   // Change these to configure the services.
 
   // Image tag (application version) to use.
+  // By default, will use the current commit, ie. the same thing that ./build would tag
+  // things it builds with.
   // Note: "latest" is not recommended in production, as you can't be sure what version
   // you're actually running, and must manually re-pull to get an updated copy.
-  image_tag:: "latest",
+  image_tag:: std.extVar("tag"),
 
   // For each service, whether to deploy that service.
   enabled:: {
diff --git a/generate-docker-compose b/generate-docker-compose
index 108d190..b30a62a 100755
--- a/generate-docker-compose
+++ b/generate-docker-compose
@@ -2,9 +2,12 @@
 
 set -eu
 
+# cd to location of script
+cd "$(dirname "$(readlink -f "$0")")"
+
 # We generate first, and capture the output, to avoid overwriting the file on error.
 # To avoid jsonnet needing to exist locally, we run it in a container.
-output=$(docker run --rm -i sparkprime/jsonnet - < docker-compose.jsonnet)
+output=$(docker run --rm -i sparkprime/jsonnet -V tag="$(./get-build-tag)" - < docker-compose.jsonnet)
 
 {
 	echo "# DO NOT EDIT THIS FILE!"
diff --git a/get-build-tag b/get-build-tag
new file mode 100755
index 0000000..95cc564
--- /dev/null
+++ b/get-build-tag
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# cd to location of script
+cd "$(dirname "$(readlink -f "$0")")"
+
+TAG=$(git rev-parse --short HEAD)
+if [ -n "$(git status --porcelain --untracked-files=no)" ]; then
+	TAG="$TAG-wip"
+fi
+
+echo "$TAG"