diff --git a/docker/Dockerfile.bot b/docker/Dockerfile.bot
index fccf98acf..deb4235b7 100644
--- a/docker/Dockerfile.bot
+++ b/docker/Dockerfile.bot
@@ -1,5 +1,8 @@
 # Build context must be the repo root. Full tree + .dockerignore (see repo root).
-# docker build -f docker/Dockerfile.bot .
+# docker build -f docker/Dockerfile.bot \
+#   --build-arg COMMIT_HASH="$(git rev-parse --short HEAD)" \
+#   --build-arg BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+#   .
 
 FROM oven/bun:alpine AS base
 WORKDIR /app
@@ -25,10 +28,22 @@ RUN bun build \
 # --- prod: nothing but the binary ---
 FROM alpine:3.21 AS prod
 
+ARG COMMIT_HASH
+ARG BUILD_TIME
+# Fail the build if any arg is omitted (Docker has no required-ARG syntax).
+RUN set -eu; \
+	: "${COMMIT_HASH:?Dockerfile.bot: COMMIT_HASH build-arg is required}"; \
+	: "${BUILD_TIME:?Dockerfile.bot: BUILD_TIME build-arg is required}";
+
 RUN apk add --no-cache curl libstdc++ libgcc
 
 COPY --from=build /bot /bot
 
+LABEL service="tachi-bot" \
+      org.opencontainers.image.source="https://github.com/zkldi/Tachi3" \
+      org.opencontainers.image.revision="${COMMIT_HASH}" \
+      org.opencontainers.image.created="${BUILD_TIME}"
+
 HEALTHCHECK --interval=15s --timeout=5s \
   CMD curl -sf http://localhost:${PORT:-8080}/.deploy/up || exit 1
 
diff --git a/docker/Dockerfile.ghbot b/docker/Dockerfile.ghbot
index ca5f6ff12..d19b88334 100644
--- a/docker/Dockerfile.ghbot
+++ b/docker/Dockerfile.ghbot
@@ -1,5 +1,8 @@
 # Build context must be the repo root. Full tree + .dockerignore (see repo root).
-# docker build -f docker/Dockerfile.ghbot .
+# docker build -f docker/Dockerfile.ghbot \
+#   --build-arg COMMIT_HASH="$(git rev-parse --short HEAD)" \
+#   --build-arg BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+#   .
 
 FROM oven/bun:alpine AS base
 WORKDIR /app
@@ -25,10 +28,22 @@ RUN bun build \
 # --- prod: nothing but the binary ---
 FROM alpine:3.21 AS prod
 
+ARG COMMIT_HASH
+ARG BUILD_TIME
+# Fail the build if any arg is omitted (Docker has no required-ARG syntax).
+RUN set -eu; \
+	: "${COMMIT_HASH:?Dockerfile.ghbot: COMMIT_HASH build-arg is required}"; \
+	: "${BUILD_TIME:?Dockerfile.ghbot: BUILD_TIME build-arg is required}";
+
 RUN apk add --no-cache curl libstdc++ libgcc
 
 COPY --from=build /ghbot /ghbot
 
+LABEL service="tachi-ghbot" \
+      org.opencontainers.image.source="https://github.com/zkldi/Tachi3" \
+      org.opencontainers.image.revision="${COMMIT_HASH}" \
+      org.opencontainers.image.created="${BUILD_TIME}"
+
 HEALTHCHECK --interval=15s --timeout=5s \
   CMD curl -sf http://localhost:${PORT:-8080}/.deploy/up || exit 1
 
diff --git a/docker/Dockerfile.server b/docker/Dockerfile.server
index a996ddd6a..eee58d542 100644
--- a/docker/Dockerfile.server
+++ b/docker/Dockerfile.server
@@ -2,7 +2,9 @@
 # Respects .dockerignore (see repo root). Full tree copy keeps workspace installs correct.
 # docker build -f docker/Dockerfile.server \
 #   --build-arg VERSION="$(jq -r .version typescript/server/package.json)" \
-#   --build-arg COMMIT_HASH="$(git rev-parse --short HEAD)" -t tachi-server:local .
+#   --build-arg COMMIT_HASH="$(git rev-parse --short HEAD)" \
+#   --build-arg BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+#   -t tachi-server:local .
 #
 # Default CMD runs the API server. Override to run a worker:
 #   docker run tachi-server:local bun run ./typescript/server/src/job-queue-worker.ts
@@ -23,10 +25,12 @@ FROM oven/bun:alpine AS prod
 
 ARG VERSION
 ARG COMMIT_HASH
-# Fail the build if either arg is omitted (Docker has no required-ARG syntax).
+ARG BUILD_TIME
+# Fail the build if any arg is omitted (Docker has no required-ARG syntax).
 RUN set -eu; \
 	: "${VERSION:?Dockerfile.server: VERSION build-arg is required}"; \
-	: "${COMMIT_HASH:?Dockerfile.server: COMMIT_HASH build-arg is required}";
+	: "${COMMIT_HASH:?Dockerfile.server: COMMIT_HASH build-arg is required}"; \
+	: "${BUILD_TIME:?Dockerfile.server: BUILD_TIME build-arg is required}";
 
 ENV VERSION=${VERSION}
 ENV COMMIT_HASH=${COMMIT_HASH}
@@ -39,6 +43,12 @@ RUN apk add --no-cache curl
 WORKDIR /app
 COPY --from=deps /app .
 
+LABEL service="tachi-server" \
+      org.opencontainers.image.source="https://github.com/zkldi/Tachi3" \
+      org.opencontainers.image.revision="${COMMIT_HASH}" \
+      org.opencontainers.image.version="${VERSION}" \
+      org.opencontainers.image.created="${BUILD_TIME}"
+
 EXPOSE 8080
 
 # Matches the default CMD (API server). Worker deployments must override this.