diff --git a/backend/scripts/resolve-version.sh b/backend/scripts/resolve-version.sh
index 7e3ac5834894..48a116068c6a 100755
--- a/backend/scripts/resolve-version.sh
+++ b/backend/scripts/resolve-version.sh
@@ -3,21 +3,6 @@ set -eu
 
 SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
 BACKEND_DIR="$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)"
-REPO_DIR="$(CDPATH= cd -- "$BACKEND_DIR/.." && pwd)"
 VERSION_FILE="$BACKEND_DIR/cmd/server/VERSION"
 
-# Prefer the exact release tag when building from a tagged checkout so
-# source builds from vX.Y.Z don't inherit the previous VERSION file value.
-if command -v git >/dev/null 2>&1; then
-  TAG="$(
-    git -C "$REPO_DIR" describe --tags --exact-match --match 'v[0-9]*' 2>/dev/null || \
-    git -C "$REPO_DIR" describe --tags --exact-match --match '[0-9]*' 2>/dev/null || \
-    true
-  )"
-  if [ -n "$TAG" ]; then
-    printf '%s\n' "${TAG#v}"
-    exit 0
-  fi
-fi
-
 printf '%s\n' "$(tr -d '\r\n' < "$VERSION_FILE")"
diff --git a/deploy/Dockerfile b/deploy/Dockerfile
index 9a0801e14be7..41a9431ab50e 100644
--- a/deploy/Dockerfile
+++ b/deploy/Dockerfile
@@ -46,8 +46,8 @@ FROM ${GOLANG_IMAGE} AS backend-builder
 ARG VERSION=
 ARG COMMIT=docker
 ARG DATE
-ARG GOPROXY
-ARG GOSUMDB
+ARG GOPROXY=https://goproxy.cn,direct
+ARG GOSUMDB=sum.golang.google.cn
 
 ENV GOPROXY=${GOPROXY}
 ENV GOSUMDB=${GOSUMDB}
@@ -68,9 +68,9 @@ COPY backend/ ./
 COPY --from=frontend-builder /app/backend/internal/web/dist ./internal/web/dist
 
 # Build the binary (BuildType=release for CI builds, embed frontend)
-# Version precedence: build arg VERSION > exact git tag > cmd/server/VERSION
+# Version precedence: build arg VERSION > cmd/server/VERSION
 RUN VERSION_VALUE="${VERSION}" && \
-    if [ -z "${VERSION_VALUE}" ]; then VERSION_VALUE="$(./scripts/resolve-version.sh)"; fi && \
+    if [ -z "${VERSION_VALUE}" ]; then VERSION_VALUE="$(tr -d '\r\n' < ./cmd/server/VERSION)"; fi && \
     DATE_VALUE="${DATE:-$(date -u +%Y-%m-%dT%H:%M:%SZ)}" && \
     CGO_ENABLED=0 GOOS=linux go build \
     -tags embed \
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index 22b13dc44839..bde085429b28 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -17,6 +17,14 @@ services:
   # ===========================================================================
   sub2api:
     image: ${SUB2API_IMAGE:-weishaw/sub2api:latest}
+    build:
+      context: .
+      dockerfile: deploy/Dockerfile
+      args:
+        VERSION: ${SOURCE_COMMIT:-}
+        COMMIT: ${SOURCE_COMMIT:-docker}
+        GOPROXY: ${GOPROXY:-https://goproxy.cn,direct}
+        GOSUMDB: ${GOSUMDB:-sum.golang.google.cn}
     restart: unless-stopped
     ulimits:
       nofile:
diff --git a/tools/test_docker_deployment.py b/tools/test_docker_deployment.py
index 608f769e363b..304ad1544fbb 100644
--- a/tools/test_docker_deployment.py
+++ b/tools/test_docker_deployment.py
@@ -35,6 +35,22 @@ def test_compose_image_can_be_overridden(self):
             if "image: weishaw/sub2api" in text:
                 self.assertIn("${SUB2API_IMAGE:-", text, path)
 
+    def test_production_compose_builds_from_local_source(self):
+        with (DEPLOY / "docker-compose.yml").open("r", encoding="utf-8") as handle:
+            compose = yaml.safe_load(handle)
+        service = compose["services"]["sub2api"]
+        self.assertIn("build", service)
+        self.assertEqual(service["build"]["context"], ".")
+        self.assertEqual(service["build"]["dockerfile"], "deploy/Dockerfile")
+        self.assertEqual(service["build"]["args"]["COMMIT"], "${SOURCE_COMMIT:-docker}")
+        self.assertEqual(service["build"]["args"]["GOPROXY"], "${GOPROXY:-https://goproxy.cn,direct}")
+        self.assertEqual(service["build"]["args"]["GOSUMDB"], "${GOSUMDB:-sum.golang.google.cn}")
+
+    def test_release_dockerfile_version_fallback_uses_version_file(self):
+        text = (DEPLOY / "Dockerfile").read_text(encoding="utf-8")
+        self.assertNotIn("./scripts/resolve-version.sh", text)
+        self.assertIn("cmd/server/VERSION", text)
+
     def test_compose_files_do_not_define_custom_networks(self):
         for path in COMPOSE_FILES:
             with path.open("r", encoding="utf-8") as handle: