diff --git a/.forgejo/scripts/notify-chart-bump.sh b/.forgejo/scripts/notify-chart-bump.sh
index 6ab6f53..863d1b6 100755
--- a/.forgejo/scripts/notify-chart-bump.sh
+++ b/.forgejo/scripts/notify-chart-bump.sh
@@ -59,7 +59,25 @@ case "$CHANNEL" in
         MIN=$(echo "${LATEST_STABLE#zddc-server-v}" | cut -d. -f2)
         PAT=$(echo "${LATEST_STABLE#zddc-server-v}" | cut -d. -f3)
         NEXT_STABLE="$MAJ.$MIN.$((PAT + 1))"
-        SHORT_SHA=$(git rev-parse --short=7 HEAD)
+
+        # Use the SHA baked into the embedded files (third field of
+        # versions.txt: "<tool>=<version> · <date> · <sha>"), NOT
+        # `git rev-parse HEAD`. This matters because `./build beta`
+        # runs locally at HEAD=N, then the operator commits the
+        # generated embed files as N+1; the embed label encodes N
+        # while git HEAD on push is N+1. If we used N+1 here, the
+        # chart's appVersion (N+1) wouldn't match the build label
+        # users see in the served website (N) — confusing on its
+        # face when triaging "is this image current?". Reading from
+        # versions.txt guarantees they line up.
+        VERSIONS_FILE="zddc/internal/apps/embedded/versions.txt"
+        SHORT_SHA=$(awk -F' · ' '/^[a-z]+=/ { print $NF; exit }' "$VERSIONS_FILE" \
+                    | tr -d '[:space:]')
+        if [ -z "$SHORT_SHA" ]; then
+            echo "::error::could not parse SHA from $VERSIONS_FILE" >&2
+            cat "$VERSIONS_FILE" >&2
+            exit 1
+        fi
         TARGET_VERSION="${NEXT_STABLE}-beta-${SHORT_SHA}"
         BRANCHES="develop"
         TRIGGER_DESC="ZDDC beta cut"