diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8b8d3d6bb..af41c34c0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -49,15 +49,21 @@ jobs:
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Build
+        env:
+          CELLD_BUILD_COMMIT: ${{ github.sha }}
         run: |
           set -euo pipefail
           rustup toolchain install "$RUST_VERSION" --profile minimal
           rustup default "$RUST_VERSION"
           cargo build --release --locked
           version=$(sed -n 's/^version = "\(.*\)"$/\1/p' crates/celld/Cargo.toml | head -1)
-          target/release/celld --version | grep -F "$version"
+          build_identity=$(target/release/celld --version)
+          grep -F "$version" <<< "$build_identity"
+          grep -F "$GITHUB_SHA" <<< "$build_identity"
 
       - name: Package
         run: |
@@ -86,6 +92,8 @@ jobs:
       packages: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - uses: docker/setup-buildx-action@v3
 
@@ -120,6 +128,8 @@ jobs:
       attestations: write
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - uses: actions/download-artifact@v4
         with:
@@ -209,6 +219,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.release.tag_name }}
+          persist-credentials: false
 
       - name: Resolve and validate the release tag
         run: |
@@ -261,6 +272,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.release.tag_name }}
+          persist-credentials: false
 
       - name: Resolve and validate the release tag
         run: |
diff --git a/Cargo.lock b/Cargo.lock
index e64eefc62..e9505e2a2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -288,7 +288,7 @@ dependencies = [
 
 [[package]]
 name = "celld"
-version = "0.2.1-coderabbit.1"
+version = "0.2.1-coderabbit.2"
 dependencies = [
  "aes",
  "aes-gcm",
diff --git a/crates/celld/Cargo.toml b/crates/celld/Cargo.toml
index e7e239494..33a3912b9 100644
--- a/crates/celld/Cargo.toml
+++ b/crates/celld/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "celld"
-version = "0.2.1-coderabbit.1"
+version = "0.2.1-coderabbit.2"
 edition = "2021"
 rust-version = "1.94.1"
 license = "Apache-2.0"
diff --git a/crates/celld/main.rs b/crates/celld/main.rs
index 567c34cee..75ef5e03f 100644
--- a/crates/celld/main.rs
+++ b/crates/celld/main.rs
@@ -4133,7 +4133,11 @@ async fn async_main(telemetry_config: Option<celld::telemetry::Config>) -> anyho
             } else {
                 ""
             };
-            println!("celld {}{profile}", env!("CARGO_PKG_VERSION"));
+            let commit = option_env!("CELLD_BUILD_COMMIT").unwrap_or("unknown");
+            println!(
+                "celld {}{profile} (commit {commit})",
+                env!("CARGO_PKG_VERSION")
+            );
             return Ok(());
         }
         Action::Diagnose {