diff --git a/backend/tests/test_rc_runtime_observability.py b/backend/tests/test_rc_runtime_observability.py
index a9bd01a1..8ad644f4 100644
--- a/backend/tests/test_rc_runtime_observability.py
+++ b/backend/tests/test_rc_runtime_observability.py
@@ -32,3 +32,17 @@ def test_runtime_report_is_read_only_by_default_and_requires_confirmation() -> N
     assert "if args.reconcile and args.confirm != RECONCILE_CONFIRMATION" in source
     assert "RuntimeReconciliationService.reconcile(db)" in source
     assert "COPY scripts/runtime_state_report.py /app/scripts/runtime_state_report.py" in dockerfile
+
+
+def test_all_in_one_deploy_embeds_immutable_build_identity() -> None:
+    dockerfile = (ROOT / "deploy" / "unraid" / "Dockerfile.all-in-one").read_text(encoding="utf-8")
+    deploy_powershell = (ROOT / "scripts" / "deploy_tower.ps1").read_text(encoding="utf-8")
+    deploy_shell = (ROOT / "scripts" / "deploy_tower.sh").read_text(encoding="utf-8")
+
+    assert "ARG GEOINTEL_BUILD_SHA=unknown" in dockerfile
+    assert 'GEOINTEL_BUILD_SHA="${GEOINTEL_BUILD_SHA}"' in dockerfile
+    assert 'GEOINTEL_BUILD_TIME="${GEOINTEL_BUILD_TIME}"' in dockerfile
+    for deploy_source in (deploy_powershell, deploy_shell):
+        assert 'GEOINTEL_BUILD_SHA="$(git rev-parse HEAD)"' in deploy_source
+        assert "--build-arg GEOINTEL_BUILD_SHA=" in deploy_source
+        assert "--build-arg GEOINTEL_BUILD_TIME=" in deploy_source
diff --git a/deploy/unraid/Dockerfile.all-in-one b/deploy/unraid/Dockerfile.all-in-one
index 266f4c4c..ff9a64dc 100644
--- a/deploy/unraid/Dockerfile.all-in-one
+++ b/deploy/unraid/Dockerfile.all-in-one
@@ -12,9 +12,13 @@ ARG GEOINTEL_INSTALL_AI=false
 ARG GEOINTEL_TORCH_INDEX_URL=https://download.pytorch.org/whl/cpu
 ARG GEOINTEL_TORCH_VERSION=2.13.0
 ARG GEOINTEL_TORCHVISION_VERSION=0.28.0
+ARG GEOINTEL_BUILD_SHA=unknown
+ARG GEOINTEL_BUILD_TIME=unknown
 
 ENV GEOINTEL_ENV=production \
     GEOINTEL_API_PREFIX=/api/v1 \
+    GEOINTEL_BUILD_SHA="${GEOINTEL_BUILD_SHA}" \
+    GEOINTEL_BUILD_TIME="${GEOINTEL_BUILD_TIME}" \
     GEOINTEL_STORAGE_ROOT=/app/storage \
     STORAGE_ROOT=/app/storage \
     GEOINTEL_ALL_IN_ONE=1 \
diff --git a/scripts/deploy_tower.ps1 b/scripts/deploy_tower.ps1
index 1c9778b0..b63014a5 100644
--- a/scripts/deploy_tower.ps1
+++ b/scripts/deploy_tower.ps1
@@ -44,9 +44,17 @@ if [ -n "${DEPLOY_GEOINTEL_INSTALL_AI:-}" ]; then
   GEOINTEL_INSTALL_AI="$DEPLOY_GEOINTEL_INSTALL_AI"
 fi
 GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-false}"
+GEOINTEL_BUILD_SHA="$(git rev-parse HEAD)"
+GEOINTEL_BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 
 docker compose -f docker-compose.unraid.yml config >/dev/null
-docker build --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" -f deploy/unraid/Dockerfile.all-in-one -t geointel-all-in-one:latest .
+docker build \
+  --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" \
+  --build-arg GEOINTEL_BUILD_SHA="$GEOINTEL_BUILD_SHA" \
+  --build-arg GEOINTEL_BUILD_TIME="$GEOINTEL_BUILD_TIME" \
+  -f deploy/unraid/Dockerfile.all-in-one \
+  -t geointel-all-in-one:latest \
+  .
 bash deploy/unraid/run-dockerman-container.sh
 
 wait_for_geointel_health() {
diff --git a/scripts/deploy_tower.sh b/scripts/deploy_tower.sh
index 863205b0..9b72ef93 100755
--- a/scripts/deploy_tower.sh
+++ b/scripts/deploy_tower.sh
@@ -46,9 +46,17 @@ if [ -n "${DEPLOY_GEOINTEL_INSTALL_AI:-}" ]; then
   GEOINTEL_INSTALL_AI="$DEPLOY_GEOINTEL_INSTALL_AI"
 fi
 GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-false}"
+GEOINTEL_BUILD_SHA="$(git rev-parse HEAD)"
+GEOINTEL_BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 
 docker compose -f docker-compose.unraid.yml config >/dev/null
-docker build --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" -f deploy/unraid/Dockerfile.all-in-one -t geointel-all-in-one:latest .
+docker build \
+  --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" \
+  --build-arg GEOINTEL_BUILD_SHA="$GEOINTEL_BUILD_SHA" \
+  --build-arg GEOINTEL_BUILD_TIME="$GEOINTEL_BUILD_TIME" \
+  -f deploy/unraid/Dockerfile.all-in-one \
+  -t geointel-all-in-one:latest \
+  .
 bash deploy/unraid/run-dockerman-container.sh
 
 wait_for_geointel_health() {