diff --git a/.forgejo/scripts/notify-chart-bump.sh b/.forgejo/scripts/notify-chart-bump.sh
index b9a34ce..2720650 100755
--- a/.forgejo/scripts/notify-chart-bump.sh
+++ b/.forgejo/scripts/notify-chart-bump.sh
@@ -78,7 +78,20 @@ case "$CHANNEL" in
             cat "$VERSIONS_FILE" >&2
             exit 1
         fi
-        TARGET_VERSION="${NEXT_STABLE}-beta-${SHORT_SHA}"
+        # Expand the short SHA from versions.txt to its full 40-char
+        # form. The chart's downstream Dockerfile fetches the SHA via
+        # `git fetch --depth=1 origin <sha>` against Forgejo, and
+        # Forgejo's uploadpack.allowAnySHA1InWant only matches FULL
+        # SHAs — a 7-char abbreviation returns "couldn't find remote
+        # ref". Resolving here (where we have the full local clone
+        # via actions/checkout@v4 fetch-depth: 0) keeps the chart's
+        # downstream consumers free of git plumbing.
+        FULL_SHA=$(git rev-parse "$SHORT_SHA" 2>/dev/null)
+        if [ -z "$FULL_SHA" ]; then
+            echo "::error::could not resolve $SHORT_SHA to a full SHA via git rev-parse" >&2
+            exit 1
+        fi
+        TARGET_VERSION="${NEXT_STABLE}-beta-${FULL_SHA}"
         BRANCHES="develop"
         TRIGGER_DESC="ZDDC beta cut"
         TRAILER="Triggered by push to git.varasys.io/VARASYS/ZDDC main with embedded/* changes (a ./build beta cut). Bumps appVersion so the dev Docker image is tagged zddc:$TARGET_VERSION, ensuring kubelet pulls a fresh image on the next helm upgrade."