diff --git a/hack/release.sh b/hack/release.sh
index fdc48b710..29303f54d 100755
--- a/hack/release.sh
+++ b/hack/release.sh
@@ -11,7 +11,9 @@ echo "$REGISTRY_PASSWORD" | ko login -u "$REGISTRY_USERNAME" --password-stdin "$
 
 echo "Building container image"
 
+echo "Adding io.shipwright.vcs-ref label with value: ${GITHUB_SHA}"
+
 # Using defaults, this pushes to:
 # quay.io/shipwright/shipwright-build-controller:latest
-KO_DOCKER_REPO="$IMAGE_HOST/$IMAGE" GOFLAGS="${GO_FLAGS}" ko resolve -t "$TAG" --bare --platform=all -R -f deploy/ > release.yaml
-KO_DOCKER_REPO="$IMAGE_HOST/$IMAGE" GOFLAGS="${GO_FLAGS} -tags=pprof_enabled" ko resolve -t "$TAG-debug" --bare --platform=all -R -f deploy/ > release-debug.yaml
+KO_DOCKER_REPO="$IMAGE_HOST/$IMAGE" GOFLAGS="${GO_FLAGS}" ko resolve -t "$TAG" --image-label "io.shipwright.vcs-ref=${GITHUB_SHA}" --bare --platform=all -R -f deploy/ > release.yaml
+KO_DOCKER_REPO="$IMAGE_HOST/$IMAGE" GOFLAGS="${GO_FLAGS} -tags=pprof_enabled" ko resolve -t "$TAG-debug" --image-label "io.shipwright.vcs-ref=${GITHUB_SHA}" --bare --platform=all -R -f deploy/ > release-debug.yaml