diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 3bb1f5c7e..4d1edd8b9 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -99,6 +99,8 @@ jobs:
         uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
         env:
           GIT_SHA: ${{ github.sha }}
+          GIT_REF: ${{ github.ref_name }}
+          BUILD_DATE: ${{ env.BUILD_DATE }}
         with:
           source: .
           targets: app-profiling
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 9f5ce8b60..3f7a937bb 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -155,6 +155,14 @@ target "app-e2e" {
 target "app-profiling" {
   inherits = ["_common"]
   target   = "profiling"
+  # Bake the build provenance into the profiling image too (like the `app` target),
+  # so /ui/admin/status shows the deployed commit/ref/date — the prod hot-deploy runs
+  # :profiling-<sha>, not the release image, so without this the page reads "unknown".
+  args = {
+    APP_BUILD_REVISION = GIT_SHA
+    APP_BUILD_REF      = GIT_REF
+    APP_BUILD_DATE     = BUILD_DATE
+  }
   tags = compact([
     "${REGISTRY}/${IMAGE_NAME}:profiling",
     GIT_SHA != "" ? "${REGISTRY}/${IMAGE_NAME}:profiling-${GIT_SHA}" : "",