diff --git a/Makefile b/Makefile
index 5d25b44..ad86715 100644
--- a/Makefile
+++ b/Makefile
@@ -26,7 +26,10 @@ ARCHS	  = linux/amd64 linux/arm64 linux/arm/v7 darwin/amd64 darwin/arm64 windows
 # VERSION has no leading v (the tag has it), as the release workflow passes it.
 TAG        ?= $(shell git describe --tags --exact-match 2>/dev/null || echo "")
 VERSION    ?= $(if $(TAG),$(patsubst v%,%,$(TAG)),dev)
-COMMIT     ?= $(shell git rev-parse HEAD 2>/dev/null || echo "unknown")
+# -dirty when the working tree has changes, as Go itself marks vcs.modified
+# (git status --porcelain, untracked files included); empty outside git.
+DIRTY := $(shell [ -z "$$(git status --porcelain 2>/dev/null)" ] || echo -dirty)
+COMMIT     ?= $(shell git rev-parse HEAD 2>/dev/null || echo "unknown")$(DIRTY)
 BUILD_DATE ?= $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
 
 LDFLAGS := -ldflags "-s -w -X 'main.version=$(VERSION)' -X 'main.tag=$(TAG)' -X 'main.commit=$(COMMIT)' -X 'main.buildDate=$(BUILD_DATE)'"