diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 99519582..783d1d90 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,6 +27,8 @@ jobs:
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Build and push multi-arch container images
+      env:
+        VERSION_TAG: ${GITHUB_REF_NAME#v}
       run: |
         set -euo pipefail
         tag="$(git describe --tag --always --dirty)"
diff --git a/.goreleaser.yml b/.goreleaser.yml
index 810b95fc..4292a173 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -5,7 +5,7 @@ builds:
 - main: .
   binary: grpc_health_probe
   flags: ["-tags=netgo"] # sync changes to .ko.yml
-  ldflags: ["-w"]        # sync changes to .ko.yml
+  ldflags: ["-w -X main.versionTag={{.Version}}"] # sync changes to .ko.yml
   env:
   - CGO_ENABLED=0
   goos:
diff --git a/.ko.yaml b/.ko.yaml
index c8f120be..f4bdd603 100644
--- a/.ko.yaml
+++ b/.ko.yaml
@@ -1,4 +1,4 @@
 builds:
 - id: grpc_health_probe
   flags: ["-tags=netgo"] # sync changes to .goreleaser.yml
-  ldflags: ["-w"]        # sync changes to .goreleaser.yml
+  ldflags: ["-w -X main.versionTag={{.Env.VERSION_TAG}}"] # sync changes to .goreleaser.yml
diff --git a/main.go b/main.go
index 4cca90a3..7a30f72c 100644
--- a/main.go
+++ b/main.go
@@ -214,6 +214,8 @@ func buildCredentials(skipVerify bool, caCerts, clientCert, clientKey, serverNam
 	return credentials.NewTLS(&cfg), nil
 }
 
+var versionTag = "" // set from git tag via ldflags during build
+
 func probeVersion() string {
 	version := "vcs info was not included in build"
 	dirty := ""
@@ -232,6 +234,10 @@ func probeVersion() string {
 	if dirty == "true" {
 		version = version + " (dirty)"
 	}
+
+	if versionTag != "" {
+		version = fmt.Sprintf("%s; %s", versionTag, version)
+	}
 	return version
 }