diff --git a/apps/broker/src/build-info.ts b/apps/broker/src/build-info.ts
index f41cd2a..13851c0 100644
--- a/apps/broker/src/build-info.ts
+++ b/apps/broker/src/build-info.ts
@@ -2,9 +2,10 @@
  * Build info surfaced on /health.
  *
  * gitSha is resolved lazily:
- *   1. GIT_SHA env var (preferred — baked in at image build time)
- *   2. `git rev-parse --short HEAD` (dev)
- *   3. "unknown" if neither works
+ *   1. GIT_SHA env var (baked in at image build time), unless it's the "unknown" default
+ *   2. SOURCE_COMMIT (Coolify injects it at runtime), short form
+ *   3. `git rev-parse --short HEAD` (dev)
+ *   4. "unknown" if none works
  */
 
 const VERSION = "0.1.0";
@@ -14,8 +15,16 @@ let cachedSha: string | null = null;
 
 function resolveGitSha(): string {
   if (cachedSha !== null) return cachedSha;
-  if (process.env.GIT_SHA) {
-    cachedSha = process.env.GIT_SHA;
+  // The Dockerfile bakes GIT_SHA=unknown as its ARG default, so a literal
+  // "unknown" means "not provided" — fall through to Coolify's runtime
+  // SOURCE_COMMIT (full sha). /health read "unknown" in prod because of this.
+  const baked = process.env.GIT_SHA;
+  if (baked && baked !== "unknown") {
+    cachedSha = baked;
+    return cachedSha;
+  }
+  if (process.env.SOURCE_COMMIT) {
+    cachedSha = process.env.SOURCE_COMMIT.slice(0, 7);
     return cachedSha;
   }
   try {