diff --git a/Dockerfile b/Dockerfile
index 0a1db83..3b8d29e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -83,6 +83,16 @@ COPY --from=builder /app/server ./server
 # Copy compiled native modules from native-deps stage (no build tools in final image)
 COPY --from=native-deps /app/node_modules ./node_modules
 
+# Image metadata. org.opencontainers.image.version is the one that matters
+# operationally: scripts/status.sh --deployed-version reads exactly this label,
+# and without it the honest answer to "which version is running?" is "unknown" —
+# which is what it reported on 2026-08-18, leaving the digest as the only way to
+# tell one deploy from another. docs/OPERATIONS.md step 3 depends on it.
+ARG APP_VERSION=0.9.3
+LABEL org.opencontainers.image.version="$APP_VERSION" \
+      org.opencontainers.image.title="Queue North Website" \
+      org.opencontainers.image.source="https://dream.scheller.ltd/null/Queue-North-Website"
+
 # Expose backend port
 EXPOSE 3001
 
diff --git a/docs/OPERATIONS.md b/docs/OPERATIONS.md
index d0790aa..7dc2b69 100644
--- a/docs/OPERATIONS.md
+++ b/docs/OPERATIONS.md
@@ -180,18 +180,22 @@ change anything.
    not a healthy service, and reads as "running" in every tool that shows only a
    state.
 2. **What is it saying?** `bash scripts/status.sh --logs 200`.
-3. **Is the deployed version the one you think?** `bash scripts/status.sh`
-   prints the image digest. **`--deployed-version` cannot answer here** — the
-   image carries no `org.opencontainers.image.version` label, so the script
-   correctly reports the version as unknown rather than guessing. Compare the
-   **digest** against the registry instead:
+3. **Is the deployed version the one you think?**
 
    ```bash
+   bash scripts/status.sh --deployed-version
    bash scripts/status.sh | grep digest
    ```
 
-   Adding that label at build time would make this step a one-liner and is worth
-   doing next time the Dockerfile is touched.
+   **The image running today carries no `org.opencontainers.image.version`
+   label**, so the first command correctly reports the version as unknown rather
+   than guessing, and the digest is the only way to tell one deploy from
+   another. The label was added to the `Dockerfile` on 2026-08-18 and takes
+   effect on the next build — until an image built after that date is deployed,
+   use the digest.
+
+   Non-zero from `--deployed-version` means it could not be read at all. Stop
+   there rather than assuming.
 4. **Is it the database?** `/api/health` returns 503 with `db: error` when the
    `SELECT 1` fails. That is a real answer and not an outage of the whole site:
    the marketing pages keep serving while every form submission is failing.