diff --git a/.github/workflows/build-binaries.yaml b/.github/workflows/build-binaries.yaml
index 6528e5043..694e64c3c 100644
--- a/.github/workflows/build-binaries.yaml
+++ b/.github/workflows/build-binaries.yaml
@@ -55,7 +55,7 @@ jobs:
 
       - name: Build
         run: |
-          GOOS=linux GOARCH=${{ matrix.arch }} go build -o nuts-linux-${{ matrix.arch }}  -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/v6/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitVersion=${GIT_VERSION}'" -o nuts-linux-${{ matrix.arch }}
+          GOOS=linux GOARCH=${{ matrix.arch }} go build -buildvcs=false -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/v6/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/v6/core.Version=${GIT_VERSION}'" -o nuts-linux-${{ matrix.arch }}
       - name:  Upload binary
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/build-images.yaml b/.github/workflows/build-images.yaml
index e8ed4951a..0d7208b30 100644
--- a/.github/workflows/build-images.yaml
+++ b/.github/workflows/build-images.yaml
@@ -36,7 +36,14 @@ jobs:
         run: |
           echo "git_commit=$(echo ${GITHUB_SHA})" >> $GITHUB_OUTPUT
           echo "git_branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT
-          echo "git_version=$(git name-rev --tags --name-only $(git rev-parse HEAD))" >> $GITHUB_OUTPUT
+          # Only tag builds get a version. It must be a clean semver tag
+          # (vX.Y.Z): Docker image scanners read it from the -ldflags recorded
+          # in the binary to match the main module against advisories.
+          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
+            echo "git_version=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT
+          else
+            echo "git_version=undefined" >> $GITHUB_OUTPUT
+          fi
 
       - uses: actions-ecosystem/action-get-latest-tag@b7c32daec3395a9616f88548363a42652b22d435 # v1
         id: get-latest-tag
diff --git a/Dockerfile b/Dockerfile
index d9ac33eae..4022ff8a7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,7 +18,11 @@ COPY go.sum .
 RUN go mod download && go mod verify
 
 COPY . .
-RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/v6/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitVersion=${GIT_VERSION}'" -o /opt/nuts/nuts
+# -buildvcs=false: the module path has no /v6 suffix, so Go cannot derive the
+# version from the v6.x tags and would stamp a misleading pseudo-version that
+# scanners match against old advisories. Scanners take the version from the
+# core.Version ldflag below instead; the key must end in ".Version" for Trivy.
+RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go build -buildvcs=false -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/v6/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/v6/core.Version=${GIT_VERSION}'" -o /opt/nuts/nuts
 
 # alpine
 FROM alpine:3.24.1
diff --git a/auth/api/iam/metadata_test.go b/auth/api/iam/metadata_test.go
index 2fc22e380..5dbbbe32a 100644
--- a/auth/api/iam/metadata_test.go
+++ b/auth/api/iam/metadata_test.go
@@ -55,7 +55,7 @@ func Test_authorizationServerMetadata(t *testing.T) {
 }
 
 func Test_clientMetadata(t *testing.T) {
-	core.GitVersion = "testVersion"
+	core.Version = "testVersion"
 	expected := OAuthClientMetadata{
 		RedirectURIs:            nil,
 		TokenEndpointAuthMethod: "none",
diff --git a/core/build_vars.go b/core/build_vars.go
index 8a8d86973..8ccd1a757 100644
--- a/core/build_vars.go
+++ b/core/build_vars.go
@@ -28,16 +28,16 @@ import (
 // GitCommit holds the latest git commit hash for this build.
 var GitCommit = "0"
 
-// GitVersion holds the tagged version belonging to the git commit.
-var GitVersion string
+// Version holds the tagged version belonging to the git commit.
+var Version string
 
 // GitBranch holds the branch from where the binary is built.
 var GitBranch = "development"
 
-// Version gives the current version according to the git tag or the branch if there's no tag.
-func Version() string {
-	if GitVersion != "" && GitVersion != "undefined" {
-		return GitVersion
+// VersionOrBranch gives the current version according to the git tag or the branch if there's no tag.
+func VersionOrBranch() string {
+	if Version != "" && Version != "undefined" {
+		return Version
 	}
 	return GitBranch
 }
@@ -51,7 +51,7 @@ func OSArch() string {
 func BuildInfo() string {
 	b := strings.Builder{}
 	b.WriteString("Git version: ")
-	b.WriteString(Version())
+	b.WriteString(VersionOrBranch())
 	b.WriteString("\n")
 
 	b.WriteString("Git commit: ")
@@ -67,7 +67,7 @@ func BuildInfo() string {
 
 // UserAgent returns a string that can be used as HTTP user agent, containing the version of the node (e.g. nuts-node-refimpl/5.0.0)
 func UserAgent() string {
-	version := GitVersion
+	version := Version
 	if version == "" {
 		version = "unknown"
 	}
diff --git a/core/build_vars_test.go b/core/build_vars_test.go
index 6a3db0826..7edad29f4 100644
--- a/core/build_vars_test.go
+++ b/core/build_vars_test.go
@@ -34,11 +34,11 @@ func TestBuildInfo(t *testing.T) {
 }
 
 func TestUserAgent(t *testing.T) {
-	t.Run("GitVersion not set", func(t *testing.T) {
+	t.Run("Version not set", func(t *testing.T) {
 		assert.Equal(t, "nuts-node-refimpl/unknown", UserAgent())
 	})
-	t.Run("GitVersion set", func(t *testing.T) {
-		GitVersion = "abc"
+	t.Run("Version set", func(t *testing.T) {
+		Version = "abc"
 		assert.Equal(t, "nuts-node-refimpl/abc", UserAgent())
 	})
 }
diff --git a/core/http_client_test.go b/core/http_client_test.go
index 81b743332..30f8093e7 100644
--- a/core/http_client_test.go
+++ b/core/http_client_test.go
@@ -92,7 +92,7 @@ func TestHTTPClient(t *testing.T) {
 }
 
 func TestUserAgentRequestEditor(t *testing.T) {
-	GitVersion = ""
+	Version = ""
 	req := &stdHttp.Request{Header: map[string][]string{}}
 
 	err := UserAgentRequestEditor(context.TODO(), req)
diff --git a/core/status/engine.go b/core/status/engine.go
index 2a8b93b26..e207ca5dc 100644
--- a/core/status/engine.go
+++ b/core/status/engine.go
@@ -99,7 +99,7 @@ func (s *status) diagnosticsSummaryAsMap(diagnostics map[string][]core.Diagnosti
 func (s *status) Diagnostics() []core.DiagnosticResult {
 	return []core.DiagnosticResult{
 		&core.GenericDiagnosticResult{Title: "uptime", Outcome: time.Since(s.startTime).Truncate(time.Second)},
-		&core.GenericDiagnosticResult{Title: "software_version", Outcome: core.Version()},
+		&core.GenericDiagnosticResult{Title: "software_version", Outcome: core.VersionOrBranch()},
 		&core.GenericDiagnosticResult{Title: "git_commit", Outcome: core.GitCommit},
 		&core.GenericDiagnosticResult{Title: "os_arch", Outcome: core.OSArch()},
 	}
diff --git a/core/status/engine_test.go b/core/status/engine_test.go
index 24f471e60..e0081f3ad 100644
--- a/core/status/engine_test.go
+++ b/core/status/engine_test.go
@@ -57,7 +57,7 @@ func TestNewStatusEngine_Diagnostics(t *testing.T) {
 		// SoftwareVersion
 		idx++
 		assert.Equal(t, "software_version", ds[idx].Name())
-		assert.Equal(t, core.Version(), ds[idx].String())
+		assert.Equal(t, core.VersionOrBranch(), ds[idx].String())
 		// Commit
 		idx++
 		assert.Equal(t, "git_commit", ds[idx].Name())
diff --git a/makefile b/makefile
index b47f10c68..3fda61a32 100644
--- a/makefile
+++ b/makefile
@@ -129,7 +129,7 @@ GIT_COMMIT ?= "$(shell git rev-list -1 HEAD)"
 GIT_BRANCH ?= "$(shell git symbolic-ref --short HEAD)"
 GIT_VERSION ?= "$(shell git name-rev --tags --name-only $(shell git rev-parse HEAD))"
 build:
-	go build -tags jwx_es256k -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/v6/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitVersion=${GIT_VERSION}'" -o ${OUTPUT}
+	go build -buildvcs=false -tags jwx_es256k -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/v6/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/v6/core.Version=${GIT_VERSION}'" -o ${OUTPUT}
 
 docker:
 	docker build --build-arg GIT_COMMIT=${GIT_COMMIT} --build-arg GIT_BRANCH=${GIT_BRANCH} --build-arg GIT_VERSION=${GIT_VERSION} -t nutsfoundation/nuts-node:master .
diff --git a/tracing/engine.go b/tracing/engine.go
index 4617e09f3..588570431 100644
--- a/tracing/engine.go
+++ b/tracing/engine.go
@@ -287,7 +287,7 @@ func setupStandaloneTracing(cfg Config) (shutdown func(context.Context) error, e
 	if serviceName == "" {
 		serviceName = defaultServiceName
 	}
-	version := core.Version()
+	version := core.VersionOrBranch()
 	res, err := resource.New(ctx,
 		resource.WithAttributes(
 			semconv.ServiceNameKey.String(serviceName),