diff --git a/Makefile b/Makefile
index dffcaf4..7627438 100644
--- a/Makefile
+++ b/Makefile
@@ -22,7 +22,10 @@ RELEASE_DIR = release
 # Override on the command line or in CI (matches the ldflags of the release workflow).
 VERSION    ?= $(shell git describe --tags --exact-match 2>/dev/null)
 TAG        ?= $(shell git describe --tags --exact-match 2>/dev/null)
-COMMIT     ?= $(shell git rev-parse HEAD 2>/dev/null || echo "")
+# -dirty when the working tree has changes, as Go itself marks vcs.modified
+# (git status --porcelain, untracked files included); empty outside git.
+DIRTY := $(shell [ -z "$$(git status --porcelain 2>/dev/null)" ] || echo -dirty)
+COMMIT     ?= $(shell git rev-parse HEAD 2>/dev/null || echo "")$(DIRTY)
 BUILD_DATE ?= $(shell date -u '+%Y-%m-%dT%H:%M:%SZ')
 LDFLAGS     = -ldflags "-s -w -X main.version=$(VERSION) -X main.tag=$(TAG) -X main.commit=$(COMMIT) -X main.buildDate=$(BUILD_DATE)"