diff --git a/.dockerignore b/.dockerignore
index 3907951d3..433260016 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,15 +1,21 @@
-# Ignore everything that starts with a dot
-.*
-# Readme files and docs
-README.rst
-README_template.rst
-generate_readme.sh
-docs
-COPYING
-# Build file
-Dockerfile*
-makefile
-nuts-node
-development
+# Only untracked and local files are excluded. Tracked files must stay in the
+# build context: go build runs "git status" to stamp the module version from
+# the checked-out tag, and marks the version "+dirty" when tracked files are
+# missing (see Dockerfile).
+# .claude/commands is tracked; only the local parts are excluded.
+.claude/worktrees
+.claude/settings.local.json
+.idea
+.run
+.DS_Store
+**/.DS_Store
+CLAUDE-*
 data
-e2e-tests
+**/data
+docs/_build
+*.pem
+*.key
+*.db
+nuts
+nuts-node
+nuts.yaml
diff --git a/.github/workflows/build-binaries.yaml b/.github/workflows/build-binaries.yaml
index 6528e5043..49034b737 100644
--- a/.github/workflows/build-binaries.yaml
+++ b/.github/workflows/build-binaries.yaml
@@ -55,7 +55,7 @@ jobs:
 
       - name: Build
         run: |
-          GOOS=linux GOARCH=${{ matrix.arch }} go build -o nuts-linux-${{ matrix.arch }}  -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/v6/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitVersion=${GIT_VERSION}'" -o nuts-linux-${{ matrix.arch }}
+          MODULE=$(go list -m) && GOOS=linux GOARCH=${{ matrix.arch }} go build -ldflags="-w -s -X '${MODULE}/core.GitCommit=${GIT_COMMIT}' -X '${MODULE}/core.GitBranch=${GIT_BRANCH}' -X '${MODULE}/core.GitVersion=${GIT_VERSION}'" -o nuts-linux-${{ matrix.arch }}
       - name:  Upload binary
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/build-images.yaml b/.github/workflows/build-images.yaml
index e8ed4951a..ddc839121 100644
--- a/.github/workflows/build-images.yaml
+++ b/.github/workflows/build-images.yaml
@@ -29,6 +29,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+          # go build stamps the module version from git. A tag build only needs
+          # the tagged commit. An untagged branch push (the :master image) needs
+          # the history back to the nearest tag, otherwise the stamp becomes
+          # v6.0.0-<time>-<rev>, which sorts below every release and trips image
+          # scanners. Pull request builds are not pushed, so they stay shallow.
+          fetch-depth: ${{ github.event_name == 'push' && github.ref_type == 'branch' && 0 || 1 }}
 
       - name: Set version params
         id: version
diff --git a/Dockerfile b/Dockerfile
index d9ac33eae..8a793144f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,10 +18,18 @@ COPY go.sum .
 RUN go mod download && go mod verify
 
 COPY . .
-RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/v6/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitVersion=${GIT_VERSION}'" -o /opt/nuts/nuts
+# git is needed so go build can stamp the module version from the checked-out tag
+# DL3018 (pin apk versions) is ignored: Alpine keeps only the current version
+# of a package in its repositories, so a pinned version breaks the build as soon
+# as the package is updated. The pinned base image tag anchors reproducibility.
+# hadolint ignore=DL3018
+RUN apk add --no-cache git
+RUN MODULE=$(go list -m) && GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="-w -s -X '${MODULE}/core.GitCommit=${GIT_COMMIT}' -X '${MODULE}/core.GitBranch=${GIT_BRANCH}' -X '${MODULE}/core.GitVersion=${GIT_VERSION}'" -o /opt/nuts/nuts
 
 # alpine
 FROM alpine:3.24.1
+# DL3018 ignored for the same reason as in the builder stage above.
+# hadolint ignore=DL3018
 RUN apk update \
   && apk add --no-cache \
              tzdata \
diff --git a/makefile b/makefile
index b47f10c68..ff518c492 100644
--- a/makefile
+++ b/makefile
@@ -125,11 +125,13 @@ e2e-test:
 	cd e2e-tests && IMAGE_NODE_A=nutsfoundation/nuts-node:e2e IMAGE_NODE_B=nutsfoundation/nuts-node:e2e ./run-tests.sh
 
 OUTPUT ?= "$(shell pwd)/nuts"
-GIT_COMMIT ?= "$(shell git rev-list -1 HEAD)"
-GIT_BRANCH ?= "$(shell git symbolic-ref --short HEAD)"
-GIT_VERSION ?= "$(shell git name-rev --tags --name-only $(shell git rev-parse HEAD))"
+GIT_COMMIT ?= $(shell git rev-list -1 HEAD)
+GIT_BRANCH ?= $(shell git symbolic-ref --short HEAD)
+GIT_VERSION ?= $(shell git name-rev --tags --name-only $(shell git rev-parse HEAD))
+# Module path including the major version suffix (e.g. .../nuts-node/v6).
+MODULE := $(shell go list -m)
 build:
-	go build -tags jwx_es256k -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/v6/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitVersion=${GIT_VERSION}'" -o ${OUTPUT}
+	go build -tags jwx_es256k -ldflags="-w -s -X '$(MODULE)/core.GitCommit=${GIT_COMMIT}' -X '$(MODULE)/core.GitBranch=${GIT_BRANCH}' -X '$(MODULE)/core.GitVersion=${GIT_VERSION}'" -o ${OUTPUT}
 
 docker:
 	docker build --build-arg GIT_COMMIT=${GIT_COMMIT} --build-arg GIT_BRANCH=${GIT_BRANCH} --build-arg GIT_VERSION=${GIT_VERSION} -t nutsfoundation/nuts-node:master .
@@ -137,3 +139,12 @@ docker:
 docker-dev: docker
 	docker build -t nutsfoundation/nuts-node:dev development/dev-image
 
+
+# Bump the major version in the module path (e.g. /v6 -> /v7). Run once on the
+# commit that starts a new major and commit the result. gomajor rewrites go.mod
+# and every import; the .proto go_package options are rewritten here because
+# gomajor does not touch them. Build files read the path from "go list -m".
+bump-major:
+	go run github.com/icholy/gomajor@v0.15.0 path -next
+	perl -pi -e 's#"github.com/nuts-foundation/nuts-node(/v\d+)?/#"'"$$(go list -m)"'/#' $$(git ls-files '*.proto')
+	go mod tidy