diff --git a/.github/workflows/_build-image.yaml b/.github/workflows/_build-image.yaml
index 81d7d6bec..4a90cbf6f 100644
--- a/.github/workflows/_build-image.yaml
+++ b/.github/workflows/_build-image.yaml
@@ -104,6 +104,9 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         env:
           GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
       - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
       - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
         with:
@@ -115,11 +118,13 @@ jobs:
           context: ${{ inputs.context }}
           file: ${{ inputs.dockerfile }}
           push: true
-          provenance: false
+          provenance: mode=min
           platforms: linux/${{ matrix.platform }}
           tags: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:${{ needs.meta.outputs.build_version }}-${{ matrix.platform }}
           build-args: |
             BUILD_VERSION=${{ needs.meta.outputs.build_version }}
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
             ${{ inputs.extra-build-args }}
           cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }}
           cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }},mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
diff --git a/fluxer_admin/Dockerfile b/fluxer_admin/Dockerfile
index 0163bb3f5..f8fcf9507 100644
--- a/fluxer_admin/Dockerfile
+++ b/fluxer_admin/Dockerfile
@@ -59,6 +59,20 @@ RUN test "$(ls target/release/build/fluxer_admin-*/out/static/fonts/*.woff2 | wc
 FROM debian:bookworm-slim AS runtime
 
 ARG BUILD_VERSION=""
+ARG SOURCE_SHA=""
+ARG SOURCE_DATE=""
+
+LABEL org.opencontainers.image.title="fluxer-admin"
+LABEL org.opencontainers.image.description="Fluxer admin console"
+LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
+LABEL org.opencontainers.image.vendor="Fluxer"
+LABEL org.opencontainers.image.url="https://fluxer.app"
+LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
+LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
+LABEL org.opencontainers.image.version="${BUILD_VERSION}"
+LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
+LABEL org.opencontainers.image.created="${SOURCE_DATE}"
+LABEL app.fluxer.build-version="${BUILD_VERSION}"
 
 WORKDIR /usr/local/bin
 
diff --git a/fluxer_api/Dockerfile b/fluxer_api/Dockerfile
index a435636ea..ea07ce561 100644
--- a/fluxer_api/Dockerfile
+++ b/fluxer_api/Dockerfile
@@ -29,6 +29,20 @@ RUN pnpm deploy --legacy --filter=fluxer_api --prod --config.allowUnusedPatches=
 FROM node:24-bookworm-slim
 
 ARG BUILD_VERSION
+ARG SOURCE_SHA
+ARG SOURCE_DATE
+
+LABEL org.opencontainers.image.title="fluxer-api"
+LABEL org.opencontainers.image.description="Fluxer HTTP API and background workers"
+LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
+LABEL org.opencontainers.image.vendor="Fluxer"
+LABEL org.opencontainers.image.url="https://fluxer.app"
+LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
+LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
+LABEL org.opencontainers.image.version="${BUILD_VERSION}"
+LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
+LABEL org.opencontainers.image.created="${SOURCE_DATE}"
+LABEL app.fluxer.build-version="${BUILD_VERSION}"
 
 WORKDIR /usr/src/app/fluxer_api
 
diff --git a/fluxer_app_proxy/Dockerfile b/fluxer_app_proxy/Dockerfile
index a5bdd3c04..d04151384 100644
--- a/fluxer_app_proxy/Dockerfile
+++ b/fluxer_app_proxy/Dockerfile
@@ -145,6 +145,20 @@ RUN if [ "${FLUXER_APP_PROXY_TIME_FREEZE_ENABLED}" = "false" ]; then \
 FROM debian:bookworm-slim
 
 ARG BUILD_VERSION=""
+ARG SOURCE_SHA=""
+ARG SOURCE_DATE=""
+
+LABEL org.opencontainers.image.title="fluxer-app-proxy"
+LABEL org.opencontainers.image.description="Fluxer web app and edge proxy"
+LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
+LABEL org.opencontainers.image.vendor="Fluxer"
+LABEL org.opencontainers.image.url="https://fluxer.app"
+LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
+LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
+LABEL org.opencontainers.image.version="${BUILD_VERSION}"
+LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
+LABEL org.opencontainers.image.created="${SOURCE_DATE}"
+LABEL app.fluxer.build-version="${BUILD_VERSION}"
 
 WORKDIR /srv/app
 
diff --git a/fluxer_docs/Dockerfile b/fluxer_docs/Dockerfile
index 8dcafa46a..bbf8e7df3 100644
--- a/fluxer_docs/Dockerfile
+++ b/fluxer_docs/Dockerfile
@@ -16,6 +16,23 @@ RUN zensical build --clean \
 
 FROM nginxinc/nginx-unprivileged:1.29-alpine AS runtime
 
+ARG BUILD_VERSION=""
+ARG SOURCE_SHA=""
+ARG SOURCE_DATE=""
+
+LABEL maintainer="Fluxer"
+LABEL org.opencontainers.image.title="fluxer-docs"
+LABEL org.opencontainers.image.description="Fluxer documentation site"
+LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
+LABEL org.opencontainers.image.vendor="Fluxer"
+LABEL org.opencontainers.image.url="https://fluxer.app"
+LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
+LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
+LABEL org.opencontainers.image.version="${BUILD_VERSION}"
+LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
+LABEL org.opencontainers.image.created="${SOURCE_DATE}"
+LABEL app.fluxer.build-version="${BUILD_VERSION}"
+
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=builder /tmp/security-headers.conf /etc/nginx/conf.d/security-headers.conf
 COPY --from=builder /src/fluxer_docs/site /usr/share/nginx/html
diff --git a/fluxer_gateway/Dockerfile b/fluxer_gateway/Dockerfile
index 32ff1da63..05a330663 100644
--- a/fluxer_gateway/Dockerfile
+++ b/fluxer_gateway/Dockerfile
@@ -35,6 +35,20 @@ RUN LOGGER_LEVEL=${LOGGER_LEVEL} envsubst < config/sys.config.template > config/
 FROM erlang:28-slim
 
 ARG BUILD_VERSION=""
+ARG SOURCE_SHA=""
+ARG SOURCE_DATE=""
+
+LABEL org.opencontainers.image.title="fluxer-gateway"
+LABEL org.opencontainers.image.description="Fluxer realtime gateway"
+LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
+LABEL org.opencontainers.image.vendor="Fluxer"
+LABEL org.opencontainers.image.url="https://fluxer.app"
+LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
+LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
+LABEL org.opencontainers.image.version="${BUILD_VERSION}"
+LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
+LABEL org.opencontainers.image.created="${SOURCE_DATE}"
+LABEL app.fluxer.build-version="${BUILD_VERSION}"
 
 WORKDIR /opt/fluxer_gateway
 
diff --git a/fluxer_gifs/Dockerfile b/fluxer_gifs/Dockerfile
index c8d2f7d7f..393e7f489 100644
--- a/fluxer_gifs/Dockerfile
+++ b/fluxer_gifs/Dockerfile
@@ -11,6 +11,20 @@ RUN cargo build --release -p fluxer-gifs
 FROM debian:bookworm-slim
 
 ARG BUILD_VERSION=""
+ARG SOURCE_SHA=""
+ARG SOURCE_DATE=""
+
+LABEL org.opencontainers.image.title="fluxer-gifs"
+LABEL org.opencontainers.image.description="Fluxer GIF search and proxy service"
+LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
+LABEL org.opencontainers.image.vendor="Fluxer"
+LABEL org.opencontainers.image.url="https://fluxer.app"
+LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
+LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
+LABEL org.opencontainers.image.version="${BUILD_VERSION}"
+LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
+LABEL org.opencontainers.image.created="${SOURCE_DATE}"
+LABEL app.fluxer.build-version="${BUILD_VERSION}"
 
 WORKDIR /usr/local/bin
 
diff --git a/fluxer_media_proxy/Dockerfile b/fluxer_media_proxy/Dockerfile
index 0df7f73a4..1464bd0b6 100644
--- a/fluxer_media_proxy/Dockerfile
+++ b/fluxer_media_proxy/Dockerfile
@@ -27,13 +27,19 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
 
 FROM ${DEBIAN_BASE} AS runtime
 ARG BUILD_VERSION=""
+ARG SOURCE_SHA=""
+ARG SOURCE_DATE=""
 
 LABEL org.opencontainers.image.title="fluxer-media-proxy"
 LABEL org.opencontainers.image.description="High-throughput media transcoding proxy: libvips + libavformat + libcurl"
 LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
-LABEL org.opencontainers.image.source="https://github.com/fluxer/fluxer/tree/main/fluxer_media_proxy"
-LABEL org.opencontainers.image.documentation="https://github.com/fluxer/fluxer/blob/main/fluxer_media_proxy/README.md"
+LABEL org.opencontainers.image.vendor="Fluxer"
+LABEL org.opencontainers.image.url="https://fluxer.app"
+LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
+LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
 LABEL org.opencontainers.image.version="${BUILD_VERSION}"
+LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
+LABEL org.opencontainers.image.created="${SOURCE_DATE}"
 LABEL app.fluxer.build-version="${BUILD_VERSION}"
 
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
diff --git a/fluxer_messages/Dockerfile b/fluxer_messages/Dockerfile
index 4466f6dd9..fd7b75962 100644
--- a/fluxer_messages/Dockerfile
+++ b/fluxer_messages/Dockerfile
@@ -11,6 +11,20 @@ RUN cargo build --release -p fluxer-messages --features scylla
 FROM debian:bookworm-slim
 
 ARG BUILD_VERSION=""
+ARG SOURCE_SHA=""
+ARG SOURCE_DATE=""
+
+LABEL org.opencontainers.image.title="fluxer-messages"
+LABEL org.opencontainers.image.description="Fluxer message storage service"
+LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
+LABEL org.opencontainers.image.vendor="Fluxer"
+LABEL org.opencontainers.image.url="https://fluxer.app"
+LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
+LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
+LABEL org.opencontainers.image.version="${BUILD_VERSION}"
+LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
+LABEL org.opencontainers.image.created="${SOURCE_DATE}"
+LABEL app.fluxer.build-version="${BUILD_VERSION}"
 
 WORKDIR /usr/local/bin
 
diff --git a/fluxer_snowflakes/Dockerfile b/fluxer_snowflakes/Dockerfile
index f2bf6e61b..5efeaea11 100644
--- a/fluxer_snowflakes/Dockerfile
+++ b/fluxer_snowflakes/Dockerfile
@@ -11,6 +11,20 @@ RUN cargo build --release -p fluxer-snowflakes
 FROM debian:bookworm-slim
 
 ARG BUILD_VERSION=""
+ARG SOURCE_SHA=""
+ARG SOURCE_DATE=""
+
+LABEL org.opencontainers.image.title="fluxer-snowflakes"
+LABEL org.opencontainers.image.description="Fluxer snowflake ID service"
+LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
+LABEL org.opencontainers.image.vendor="Fluxer"
+LABEL org.opencontainers.image.url="https://fluxer.app"
+LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
+LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
+LABEL org.opencontainers.image.version="${BUILD_VERSION}"
+LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
+LABEL org.opencontainers.image.created="${SOURCE_DATE}"
+LABEL app.fluxer.build-version="${BUILD_VERSION}"
 
 WORKDIR /usr/local/bin
 
diff --git a/fluxer_static/Dockerfile b/fluxer_static/Dockerfile
index c5e342f67..76880a6e4 100644
--- a/fluxer_static/Dockerfile
+++ b/fluxer_static/Dockerfile
@@ -4,12 +4,19 @@
 FROM caddy:2.10-alpine
 
 ARG BUILD_VERSION=""
+ARG SOURCE_SHA=""
+ARG SOURCE_DATE=""
 
 LABEL org.opencontainers.image.title="fluxer-static"
 LABEL org.opencontainers.image.description="Self-hostable static asset bundle for Fluxer"
 LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
-LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer/tree/main/fluxer_static"
+LABEL org.opencontainers.image.vendor="Fluxer"
+LABEL org.opencontainers.image.url="https://fluxer.app"
+LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
+LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
 LABEL org.opencontainers.image.version="${BUILD_VERSION}"
+LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
+LABEL org.opencontainers.image.created="${SOURCE_DATE}"
 LABEL app.fluxer.build-version="${BUILD_VERSION}"
 
 COPY fluxer_static/Caddyfile /etc/caddy/Caddyfile
diff --git a/fluxer_unfurl/Dockerfile b/fluxer_unfurl/Dockerfile
index 39b27260a..6f02c90d1 100644
--- a/fluxer_unfurl/Dockerfile
+++ b/fluxer_unfurl/Dockerfile
@@ -11,6 +11,20 @@ RUN cargo build --release -p fluxer-unfurl
 FROM debian:bookworm-slim
 
 ARG BUILD_VERSION=""
+ARG SOURCE_SHA=""
+ARG SOURCE_DATE=""
+
+LABEL org.opencontainers.image.title="fluxer-unfurl"
+LABEL org.opencontainers.image.description="Fluxer link unfurl and embed service"
+LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
+LABEL org.opencontainers.image.vendor="Fluxer"
+LABEL org.opencontainers.image.url="https://fluxer.app"
+LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
+LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
+LABEL org.opencontainers.image.version="${BUILD_VERSION}"
+LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
+LABEL org.opencontainers.image.created="${SOURCE_DATE}"
+LABEL app.fluxer.build-version="${BUILD_VERSION}"
 
 WORKDIR /usr/local/bin
 
diff --git a/fluxer_users/Dockerfile b/fluxer_users/Dockerfile
index c33b23984..f276ae2f8 100644
--- a/fluxer_users/Dockerfile
+++ b/fluxer_users/Dockerfile
@@ -11,6 +11,20 @@ RUN cargo build --release -p fluxer-users --features scylla
 FROM debian:bookworm-slim
 
 ARG BUILD_VERSION=""
+ARG SOURCE_SHA=""
+ARG SOURCE_DATE=""
+
+LABEL org.opencontainers.image.title="fluxer-users"
+LABEL org.opencontainers.image.description="Fluxer user storage service"
+LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
+LABEL org.opencontainers.image.vendor="Fluxer"
+LABEL org.opencontainers.image.url="https://fluxer.app"
+LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
+LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
+LABEL org.opencontainers.image.version="${BUILD_VERSION}"
+LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
+LABEL org.opencontainers.image.created="${SOURCE_DATE}"
+LABEL app.fluxer.build-version="${BUILD_VERSION}"
 
 WORKDIR /usr/local/bin
 
diff --git a/tools/ci/src/ci_workflow.rs b/tools/ci/src/ci_workflow.rs
index cf53cbf9c..d670ce17c 100644
--- a/tools/ci/src/ci_workflow.rs
+++ b/tools/ci/src/ci_workflow.rs
@@ -324,4 +324,101 @@ mod tests {
 
         assert_eq!(missing_app_wasm_artifact(root), None);
     }
+
+    #[test]
+    fn image_dockerfiles_carry_the_release_label_block() {
+        const REQUIRED: [&str; 9] = [
+            "LABEL org.opencontainers.image.licenses=\"AGPL-3.0-or-later\"",
+            "LABEL org.opencontainers.image.vendor=\"Fluxer\"",
+            "LABEL org.opencontainers.image.url=\"https://fluxer.app\"",
+            "LABEL org.opencontainers.image.documentation=\"https://docs.fluxer.app\"",
+            "LABEL org.opencontainers.image.source=\"https://github.com/fluxerapp/fluxer\"",
+            "LABEL org.opencontainers.image.version=\"${BUILD_VERSION}\"",
+            "LABEL org.opencontainers.image.revision=\"${SOURCE_SHA}\"",
+            "LABEL org.opencontainers.image.created=\"${SOURCE_DATE}\"",
+            "LABEL app.fluxer.build-version=\"${BUILD_VERSION}\"",
+        ];
+
+        for (name, title, dockerfile) in [
+            (
+                "fluxer_admin",
+                "fluxer-admin",
+                include_str!("../../../fluxer_admin/Dockerfile"),
+            ),
+            (
+                "fluxer_api",
+                "fluxer-api",
+                include_str!("../../../fluxer_api/Dockerfile"),
+            ),
+            (
+                "fluxer_app_proxy",
+                "fluxer-app-proxy",
+                include_str!("../../../fluxer_app_proxy/Dockerfile"),
+            ),
+            (
+                "fluxer_docs",
+                "fluxer-docs",
+                include_str!("../../../fluxer_docs/Dockerfile"),
+            ),
+            (
+                "fluxer_gateway",
+                "fluxer-gateway",
+                include_str!("../../../fluxer_gateway/Dockerfile"),
+            ),
+            (
+                "fluxer_gifs",
+                "fluxer-gifs",
+                include_str!("../../../fluxer_gifs/Dockerfile"),
+            ),
+            (
+                "fluxer_media_proxy",
+                "fluxer-media-proxy",
+                include_str!("../../../fluxer_media_proxy/Dockerfile"),
+            ),
+            (
+                "fluxer_messages",
+                "fluxer-messages",
+                include_str!("../../../fluxer_messages/Dockerfile"),
+            ),
+            (
+                "fluxer_snowflakes",
+                "fluxer-snowflakes",
+                include_str!("../../../fluxer_snowflakes/Dockerfile"),
+            ),
+            (
+                "fluxer_static",
+                "fluxer-static",
+                include_str!("../../../fluxer_static/Dockerfile"),
+            ),
+            (
+                "fluxer_unfurl",
+                "fluxer-unfurl",
+                include_str!("../../../fluxer_unfurl/Dockerfile"),
+            ),
+            (
+                "fluxer_users",
+                "fluxer-users",
+                include_str!("../../../fluxer_users/Dockerfile"),
+            ),
+        ] {
+            assert!(
+                dockerfile.contains("ARG SOURCE_SHA"),
+                "{name}/Dockerfile must declare ARG SOURCE_SHA"
+            );
+            assert!(
+                dockerfile.contains("ARG SOURCE_DATE"),
+                "{name}/Dockerfile must declare ARG SOURCE_DATE"
+            );
+            assert!(
+                dockerfile.contains(&format!("LABEL org.opencontainers.image.title=\"{title}\"")),
+                "{name}/Dockerfile must declare the title {title}"
+            );
+            for label in REQUIRED {
+                assert!(
+                    dockerfile.contains(label),
+                    "{name}/Dockerfile must declare {label}"
+                );
+            }
+        }
+    }
 }