diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 7f904c59..ed67642a 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -76,7 +76,10 @@ jobs:
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           printf %s "$REGISTRY_TOKEN" | podman login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
-          for t in "$TAG" "$TAG-$(date -u +%Y%m%d)" "${GITHUB_SHA::12}"; do
+          # The commit built, not $GITHUB_SHA: after "Merge upstream" that's
+          # the merge, not the commit the run started from.
+          built=$(git rev-parse HEAD)
+          for t in "$TAG" "$TAG-$(date -u +%Y%m%d)" "${built::12}"; do
             podman tag "localhost/aurora:$TAG" "$IMAGE:$t"
             podman push --retry 5 "$IMAGE:$t"
           done