diff --git a/.tangled/workflows/build-image.yml b/.tangled/workflows/build-image.yml
index ec8d2ca..b41841f 100644
--- a/.tangled/workflows/build-image.yml
+++ b/.tangled/workflows/build-image.yml
@@ -25,7 +25,11 @@ steps:
       set -euo pipefail
 
       image="atcr.io/graham.systems/quantum"
-      version="$TANGLED_REF_NAME"
+      # Version is the project's source of truth (package.json); at a release
+      # tag's commit it equals the ChronVer tag name. Read it from the tree
+      # rather than a CI ref variable, whose name/availability we can't rely on.
+      version="$(sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' package.json | head -1)"
+      test -n "$version" || { echo "could not read version from package.json"; exit 1; }
 
       echo "$REGISTRY_TOKEN" | docker login atcr.io -u "$REGISTRY_USER" --password-stdin