diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index df4572ae6..0b083d887 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -55,6 +55,10 @@ jobs:
       image-name: eduide/eduide-cloud/${{ matrix.component }}
       docker-context: .
       image-tag: ${{ github.event_name == 'release' && github.event.release.tag_name || github.event_name == 'workflow_dispatch' && inputs.image_tag || '' }}
+      # The Java build stamps the version into the jar manifest, so the version
+      # inside the image should match the tag on the outside. The shared workflow
+      # derives the tag (stripping any leading v) and passes it as APP_VERSION.
+      stamp-app-version: true
       no-cache: ${{ github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.disable_layer_cache) || false }}
       # These are small Java images; the disk-reclaim step is not worth the time.
       free-disk-space: false
diff --git a/.gitignore b/.gitignore
index 0cab4cd17..30413fb30 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,3 +18,4 @@ openapitools.json
 target/
 node_modules
 node/e2e-tests/test-results/.last-run.json
+.flattened-pom.xml
diff --git a/dockerfiles/conversion-webhook/Dockerfile b/dockerfiles/conversion-webhook/Dockerfile
index 6a2fcebee..dbf41a291 100644
--- a/dockerfiles/conversion-webhook/Dockerfile
+++ b/dockerfiles/conversion-webhook/Dockerfile
@@ -1,4 +1,5 @@
 FROM eclipse-temurin:21-jdk AS builder
+ARG APP_VERSION=1.2.0-SNAPSHOT
 # Accept APT_HTTP_PROXY build-arg for caching
 ARG APT_HTTP_PROXY
 # Configure apt proxy if provided (hybrid: works on ARC and GitHub runners)
@@ -17,17 +18,18 @@ COPY java/common ./common
 COPY java/conversion ./conversion
 RUN --mount=type=cache,target=/root/.m2 \
     cd /conversion/common/maven-conf && \
-    mvn clean install --no-transfer-progress && \
+    mvn clean install --no-transfer-progress -Drevision=${APP_VERSION} && \
     cd /conversion/common/org.eclipse.theia.cloud.common && \
-    mvn clean install --no-transfer-progress && \
+    mvn clean install --no-transfer-progress -Drevision=${APP_VERSION} && \
     cd /conversion/conversion/org.eclipse.theia.cloud.conversion && \
-    mvn clean package -Dmaven.test.skip=true -Dquarkus.package.type=uber-jar --no-transfer-progress
+    mvn clean package -Drevision=${APP_VERSION} -Dmaven.test.skip=true -Dquarkus.package.type=uber-jar --no-transfer-progress
 
 FROM eclipse-temurin:21-jre-alpine
+ARG APP_VERSION=1.2.0-SNAPSHOT
 WORKDIR /conversion
-COPY --from=builder /conversion/conversion/org.eclipse.theia.cloud.conversion/target/conversion-webhook-1.2.0-SNAPSHOT-runner.jar .
+COPY --from=builder /conversion/conversion/org.eclipse.theia.cloud.conversion/target/conversion-webhook-${APP_VERSION}-runner.jar ./conversion-webhook.jar
 
 ENV CERT_RELOAD_PERIOD=604800
 
-ENTRYPOINT ["java", "-Dquarkus.http.ssl.certificate.reload-period=${CERT_RELOAD_PERIOD}", "-jar", "./conversion-webhook-1.2.0-SNAPSHOT-runner.jar"]
+ENTRYPOINT ["java", "-Dquarkus.http.ssl.certificate.reload-period=${CERT_RELOAD_PERIOD}", "-jar", "./conversion-webhook.jar"]
 CMD [ "" ]
diff --git a/dockerfiles/operator/Dockerfile b/dockerfiles/operator/Dockerfile
index 5190e4a3f..6a18c366d 100644
--- a/dockerfiles/operator/Dockerfile
+++ b/dockerfiles/operator/Dockerfile
@@ -1,4 +1,5 @@
 FROM eclipse-temurin:21-jdk AS builder
+ARG APP_VERSION=1.2.0-SNAPSHOT
 # Accept APT_HTTP_PROXY build-arg for caching
 ARG APT_HTTP_PROXY
 # Configure apt proxy if provided (hybrid: works on ARC and GitHub runners)
@@ -27,15 +28,16 @@ RUN --mount=type=secret,id=SENTRY_AUTH_TOKEN \
       echo "No SENTRY_AUTH_TOKEN provided, skipping Sentry build integration"; \
     fi && \
     cd /operator/common/maven-conf && \
-    mvn clean install --no-transfer-progress $MAVEN_SENTRY_ARGS && \
+    mvn clean install --no-transfer-progress -Drevision=${APP_VERSION} $MAVEN_SENTRY_ARGS && \
     cd /operator/common/org.eclipse.theia.cloud.common && \
-    mvn clean install --no-transfer-progress $MAVEN_SENTRY_ARGS && \
+    mvn clean install --no-transfer-progress -Drevision=${APP_VERSION} $MAVEN_SENTRY_ARGS && \
     cd /operator/operator/org.eclipse.theia.cloud.operator && \
-    mvn clean install --no-transfer-progress $MAVEN_SENTRY_ARGS && \
+    mvn clean install --no-transfer-progress -Drevision=${APP_VERSION} $MAVEN_SENTRY_ARGS && \
     cd /operator/operator/org.eclipse.theia.cloud.defaultoperator && \
-    mvn clean verify --no-transfer-progress $MAVEN_SENTRY_ARGS
+    mvn clean verify --no-transfer-progress -Drevision=${APP_VERSION} $MAVEN_SENTRY_ARGS
 
 FROM eclipse-temurin:21-jre-alpine
+ARG APP_VERSION=1.2.0-SNAPSHOT
 RUN apk add --no-cache curl unzip
 RUN mkdir /templates
 WORKDIR /log-config
@@ -44,7 +46,7 @@ WORKDIR /operator
 RUN curl -fsSL -o sentry-agent.zip https://github.com/getsentry/sentry-java/releases/download/8.29.0/sentry-opentelemetry-agent-8.29.0.zip && \
     unzip -j sentry-agent.zip -d . && \
     rm sentry-agent.zip
-COPY --from=builder /operator/operator/org.eclipse.theia.cloud.defaultoperator/target/defaultoperator-1.2.0-SNAPSHOT-jar-with-dependencies.jar .
+COPY --from=builder /operator/operator/org.eclipse.theia.cloud.defaultoperator/target/defaultoperator-${APP_VERSION}-jar-with-dependencies.jar ./operator.jar
 COPY --from=builder /operator/operator/org.eclipse.theia.cloud.defaultoperator/sentry.properties ./sentry.properties
 
 # If set to true, enables Sentry Java agent flags.
@@ -67,7 +69,7 @@ fi
 
 exec java $JAVA_OPTS \
   -Dlog4j2.configurationFile=/log-config/log4j2.xml \
-  -jar ./defaultoperator-1.2.0-SNAPSHOT-jar-with-dependencies.jar \
+  -jar ./operator.jar \
   "$@"
 EOF_ENTRYPOINT
 
diff --git a/dockerfiles/service/Dockerfile b/dockerfiles/service/Dockerfile
index b4530792d..481da2efd 100644
--- a/dockerfiles/service/Dockerfile
+++ b/dockerfiles/service/Dockerfile
@@ -1,4 +1,5 @@
 FROM eclipse-temurin:21-jdk AS builder
+ARG APP_VERSION=1.2.0-SNAPSHOT
 # Accept APT_HTTP_PROXY build-arg for caching
 ARG APT_HTTP_PROXY
 # Configure apt proxy if provided (hybrid: works on ARC and GitHub runners)
@@ -27,19 +28,20 @@ RUN --mount=type=secret,id=SENTRY_AUTH_TOKEN \
       echo "No SENTRY_AUTH_TOKEN provided, skipping Sentry build integration"; \
     fi && \
     cd /service/common/maven-conf && \
-    mvn clean install --no-transfer-progress $MAVEN_SENTRY_ARGS && \
+    mvn clean install --no-transfer-progress -Drevision=${APP_VERSION} $MAVEN_SENTRY_ARGS && \
     cd /service/common/org.eclipse.theia.cloud.common && \
-    mvn clean install --no-transfer-progress $MAVEN_SENTRY_ARGS && \
+    mvn clean install --no-transfer-progress -Drevision=${APP_VERSION} $MAVEN_SENTRY_ARGS && \
     cd /service/service/org.eclipse.theia.cloud.service && \
-    mvn clean package -Dmaven.test.skip=true -Dquarkus.package.type=uber-jar --no-transfer-progress $MAVEN_SENTRY_ARGS
+    mvn clean package -Drevision=${APP_VERSION} -Dmaven.test.skip=true -Dquarkus.package.type=uber-jar --no-transfer-progress $MAVEN_SENTRY_ARGS
 
 FROM eclipse-temurin:21-jre-alpine
+ARG APP_VERSION=1.2.0-SNAPSHOT
 RUN apk add --no-cache curl unzip
 WORKDIR /service
 RUN curl -fsSL -o sentry-agent.zip https://github.com/getsentry/sentry-java/releases/download/8.29.0/sentry-opentelemetry-agent-8.29.0.zip && \
     unzip -j sentry-agent.zip -d . && \
     rm sentry-agent.zip
-COPY --from=builder /service/service/org.eclipse.theia.cloud.service/target/service-1.2.0-SNAPSHOT-runner.jar .
+COPY --from=builder /service/service/org.eclipse.theia.cloud.service/target/service-${APP_VERSION}-runner.jar ./service.jar
 COPY --from=builder /service/service/org.eclipse.theia.cloud.service/sentry.properties ./sentry.properties
 
 ENV SERVICE_PORT=8081
@@ -84,7 +86,7 @@ exec java $JAVA_OPTS \
   -Dquarkus.oidc.auth-server-url="${KEYCLOAK_SERVERURL}" \
   -Dquarkus.oidc.client-id="${KEYCLOAK_CLIENTID}" \
   -Dquarkus.oidc.credentials.secret="${KEYCLOAK_CLIENTSECRET}" \
-  -jar ./service-1.2.0-SNAPSHOT-runner.jar \
+  -jar ./service.jar \
   "$@"
 EOF_ENTRYPOINT
 
diff --git a/java/common/maven-conf/pom.xml b/java/common/maven-conf/pom.xml
index 8944bcae2..f9d0c217a 100644
--- a/java/common/maven-conf/pom.xml
+++ b/java/common/maven-conf/pom.xml
@@ -5,12 +5,14 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.eclipse.theia.cloud</groupId>
     <artifactId>conf</artifactId>
-    <version>1.2.0-SNAPSHOT</version>
+    <version>${revision}</version>
     <packaging>pom</packaging>
     <name>Theia Cloud Maven Configuration</name>
     <description>Common properties and configuration</description>
 
     <properties>
+        <!-- CI overrides this: mvn -Drevision=2.3.0 -->
+        <revision>1.2.0-SNAPSHOT</revision>
         <failsafe.useModulePath>false</failsafe.useModulePath>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
@@ -42,6 +44,39 @@
         </pluginRepository>
     </pluginRepositories>
 
+    <build>
+        <plugins>
+            <!--
+              Required by the ${revision} versioning above. Without it the pom
+              installed into the local repository still contains the literal
+              ${revision}, and the next module cannot resolve this parent.
+              resolveCiFriendliesOnly rewrites only revision/sha1/changelist
+              and leaves the rest of the pom untouched.
+            -->
+            <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>flatten-maven-plugin</artifactId>
+                <version>1.6.0</version>
+                <configuration>
+                    <updatePomFile>true</updatePomFile>
+                    <flattenMode>resolveCiFriendliesOnly</flattenMode>
+                </configuration>
+                <executions>
+                    <execution>
+                        <id>flatten</id>
+                        <phase>process-resources</phase>
+                        <goals><goal>flatten</goal></goals>
+                    </execution>
+                    <execution>
+                        <id>flatten.clean</id>
+                        <phase>clean</phase>
+                        <goals><goal>clean</goal></goals>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+
     <profiles>
         <profile>
             <id>github</id>
diff --git a/java/common/org.eclipse.theia.cloud.common/pom.xml b/java/common/org.eclipse.theia.cloud.common/pom.xml
index 3af633dc6..97a74d97d 100644
--- a/java/common/org.eclipse.theia.cloud.common/pom.xml
+++ b/java/common/org.eclipse.theia.cloud.common/pom.xml
@@ -11,7 +11,7 @@
     <parent>
         <groupId>org.eclipse.theia.cloud</groupId>
         <artifactId>conf</artifactId>
-        <version>1.2.0-SNAPSHOT</version>
+        <version>${revision}</version>
         <relativePath>../../common/maven-conf/</relativePath>
     </parent>
 
diff --git a/java/conversion/org.eclipse.theia.cloud.conversion/pom.xml b/java/conversion/org.eclipse.theia.cloud.conversion/pom.xml
index 07d136338..26dea5138 100644
--- a/java/conversion/org.eclipse.theia.cloud.conversion/pom.xml
+++ b/java/conversion/org.eclipse.theia.cloud.conversion/pom.xml
@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.eclipse.theia.cloud</groupId>
         <artifactId>conf</artifactId>
-        <version>1.2.0-SNAPSHOT</version>
+        <version>${revision}</version>
         <relativePath>../../common/maven-conf/</relativePath>
     </parent>
 
@@ -45,7 +45,7 @@
         <dependency>
             <groupId>org.eclipse.theia.cloud</groupId>
             <artifactId>common</artifactId>
-            <version>1.2.0-SNAPSHOT</version>
+            <version>${revision}</version>
         </dependency>
         <!-- Webhooks -->
         <dependency>
diff --git a/java/operator/org.eclipse.theia.cloud.defaultoperator/pom.xml b/java/operator/org.eclipse.theia.cloud.defaultoperator/pom.xml
index b1ecdece2..0168b2719 100644
--- a/java/operator/org.eclipse.theia.cloud.defaultoperator/pom.xml
+++ b/java/operator/org.eclipse.theia.cloud.defaultoperator/pom.xml
@@ -11,7 +11,7 @@
     <parent>
         <groupId>org.eclipse.theia.cloud</groupId>
         <artifactId>conf</artifactId>
-        <version>1.2.0-SNAPSHOT</version>
+        <version>${revision}</version>
         <relativePath>../../common/maven-conf/</relativePath>
     </parent>
 
@@ -19,12 +19,12 @@
         <dependency>
             <groupId>org.eclipse.theia.cloud</groupId>
             <artifactId>operator</artifactId>
-            <version>1.2.0-SNAPSHOT</version>
+            <version>${revision}</version>
         </dependency>
         <dependency>
             <groupId>org.eclipse.theia.cloud</groupId>
             <artifactId>common</artifactId>
-            <version>1.2.0-SNAPSHOT</version>
+            <version>${revision}</version>
         </dependency>
         <dependency>
             <groupId>org.json</groupId>
diff --git a/java/operator/org.eclipse.theia.cloud.operator/pom.xml b/java/operator/org.eclipse.theia.cloud.operator/pom.xml
index c49a34589..d575434b3 100644
--- a/java/operator/org.eclipse.theia.cloud.operator/pom.xml
+++ b/java/operator/org.eclipse.theia.cloud.operator/pom.xml
@@ -11,7 +11,7 @@
     <parent>
         <groupId>org.eclipse.theia.cloud</groupId>
         <artifactId>conf</artifactId>
-        <version>1.2.0-SNAPSHOT</version>
+        <version>${revision}</version>
         <relativePath>../../common/maven-conf/</relativePath>
     </parent>
 
@@ -19,7 +19,7 @@
         <dependency>
             <groupId>org.eclipse.theia.cloud</groupId>
             <artifactId>common</artifactId>
-            <version>1.2.0-SNAPSHOT</version>
+            <version>${revision}</version>
         </dependency>
         <dependency>
             <groupId>org.json</groupId>
diff --git a/java/service/org.eclipse.theia.cloud.service/pom.xml b/java/service/org.eclipse.theia.cloud.service/pom.xml
index ff4d31ffe..7ab94ff50 100644
--- a/java/service/org.eclipse.theia.cloud.service/pom.xml
+++ b/java/service/org.eclipse.theia.cloud.service/pom.xml
@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.eclipse.theia.cloud</groupId>
         <artifactId>conf</artifactId>
-        <version>1.2.0-SNAPSHOT</version>
+        <version>${revision}</version>
         <relativePath>../../common/maven-conf/</relativePath>
     </parent>
 
@@ -76,7 +76,7 @@
         <dependency>
             <groupId>org.eclipse.theia.cloud</groupId>
             <artifactId>common</artifactId>
-            <version>1.2.0-SNAPSHOT</version>
+            <version>${revision}</version>
         </dependency>
         <dependency>
             <groupId>io.fabric8</groupId>