diff --git a/.tangled/workflows/deploy-gcp-dev.yml b/.tangled/workflows/deploy-gcp-dev.yml
index 0864707e5..7f5f423af 100644
--- a/.tangled/workflows/deploy-gcp-dev.yml
+++ b/.tangled/workflows/deploy-gcp-dev.yml
@@ -86,6 +86,7 @@ steps:
         --file=web/Containerfile \
         --build-arg VITE_OAUTH_CLIENT_ID="$VITE_OAUTH_CLIENT_ID" \
         --build-arg VITE_OAUTH_REDIRECT_URI="$VITE_OAUTH_REDIRECT_URI" \
+        --build-arg APP_VERSION="$(git rev-parse HEAD:web)" \
         --tag="$REGISTRY/svfe-next:$tag" \
         --tag="$REGISTRY/svfe-next:dev" \
         --provenance=false \
diff --git a/web/Containerfile b/web/Containerfile
index 42614ad98..a0eb04044 100644
--- a/web/Containerfile
+++ b/web/Containerfile
@@ -19,6 +19,7 @@ COPY . .
 # vite.config.ts falls back to the prod oauth client when these are unset
 ARG VITE_OAUTH_CLIENT_ID
 ARG VITE_OAUTH_REDIRECT_URI
+ARG APP_VERSION
 RUN corepack pnpm run build
 
 FROM node:24-slim
diff --git a/web/svelte.config.js b/web/svelte.config.js
index 2f00e92be..c5974d5a5 100644
--- a/web/svelte.config.js
+++ b/web/svelte.config.js
@@ -29,6 +29,9 @@ const config = {
 			$storybook: ".storybook",
 			"$storybook/*": ".storybook/*"
 		},
+		// defaults to the build's clock, which makes every build of the same source
+		// differ. the deploys pass the web tree's git hash, so it only changes with the app
+		version: { name: process.env.APP_VERSION || undefined },
 		paths: {
 			// GFE is evil and rewrites // to /
 			// so we do this to have /_app/ be at root always which means it doesnt break