diff --git a/podman-privatebin/ci_build-images.sh b/podman-privatebin/ci_build-images.sh
index 175ac37..2b53a64 100755
--- a/podman-privatebin/ci_build-images.sh
+++ b/podman-privatebin/ci_build-images.sh
@@ -11,9 +11,18 @@ buildfolder=/tmp/privatebin-$$
 
 if ! podman image exists ${privatebin_image}:${privatebin_version}; then
     if git clone -b ${privatebin_version} --depth=1 https://github.com/PrivateBin/docker-nginx-fpm-alpine ${buildfolder} ; then
+        arg_release=$(grep 'ARG RELEASE' ${buildfolder}/Dockerfile | cut -d= -f2)
+        read type tag_sha < <(echo $(curl -s "https://api.github.com/repos/PrivateBin/PrivateBin/git/ref/tags/${arg_release}" | jq -r '.object.type,.object.sha'))
+        if [ $type == "commit" ]; then
+            sha=$tag_sha
+            echo "commit sha: $tag_sha"
+        else
+            sha=$(curl -s "https://api.github.com/repos/PrivateBin/PrivateBin/git/tags/$tag_sha" | jq '.object.sha')
+            echo "commit sha: $sha"
+        fi
 	sed -i "s#mv cfg lib tpl vendor /srv#mv cfg lib tpl vendor /srv \&\& sed -i \\'/Content-Security-Policy\\\|X-XSS-Protection\\\|X-Frame-Options\\\|X-Content-Type-Options/d\\' /srv/lib/Controller.php#" ${buildfolder}/Dockerfile &&
         TMPDIR=${HOME} podman image build \
-		--label "org.opencontainers.image.revision=$(cd ${buildfolder} ; git rev-parse HEAD)" \
+		--label "org.opencontainers.image.revision=${tag_sha}" \
 		-t "${privatebin_image}":"${privatebin_version}" \
 		${buildfolder} || retval=false
 	podman image prune -a -f --filter dangling=true