diff --git a/Makefile b/Makefile
index b28270f..3bcc7d9 100644
--- a/Makefile
+++ b/Makefile
@@ -24,7 +24,10 @@ ARCHS	  = linux/amd64 linux/arm64 linux/arm/v7 darwin/amd64 darwin/arm64 windows
 # Override on the command line or in CI (matches reusable release workflow ldflags).
 VERSION    ?= $(shell git describe --tags --exact-match 2>/dev/null)
 TAG        ?= $(shell git describe --tags --exact-match 2>/dev/null)
-COMMIT     ?= $(shell git rev-parse HEAD 2>/dev/null || echo "unknown")
+# -dirty when the working tree has changes, as Go itself marks vcs.modified
+# (git status --porcelain, untracked files included); empty outside git.
+DIRTY := $(shell [ -z "$$(git status --porcelain 2>/dev/null)" ] || echo -dirty)
+COMMIT     ?= $(shell git rev-parse HEAD 2>/dev/null || echo "unknown")$(DIRTY)
 BUILD_DATE ?= $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
 
 LDFLAGS := -ldflags "-s -w -X 'main.version=$(VERSION)' -X 'main.tag=$(TAG)' -X 'main.commit=$(COMMIT)' -X 'main.buildDate=$(BUILD_DATE)'"