diff --git a/CLAUDE.md b/CLAUDE.md
index aeb6b98..3fd9ff1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -20,7 +20,7 @@ hyperwheel.html           # built artifact — gitignored, generated by build.py
 public/index.html         # built artifact for Vercel — gitignored, built on deploy
 build.py                  # assembler (concatenates src/ → hyperwheel.html);
                           # also injects {{VERSION}} / {{VERSION_CLEAN}} from
-                          # `git describe --tags --always --dirty`
+                          # `git describe --tags --always`
 api/sync.js               # Vercel serverless: KV-backed cloud sync of HOLDINGs
 api/chain-sync.js         # Vercel serverless: CORS proxy to Rysk + Hypersurface
 src/
diff --git a/CONTEXT.md b/CONTEXT.md
index b316c69..ba3577a 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -133,12 +133,15 @@ where the wheel-strategy invariants are written prose-style.
 
 ### Version
 The git tag of the deployed build, displayed in the footer and the first-visit
-wallet popup. Source of truth is `git describe --tags --always --dirty`,
-substituted into a `{{VERSION}}` placeholder by `build.py`. A `-dirty` suffix
-means the build contains uncommitted changes — useful for spotting
-not-from-a-clean-tag deploys. Tags are created automatically by a GitHub Action
-on every merge to `main` (see ADR 0001), so the footer always reflects current
-shipped code without manual bookkeeping.
+wallet popup. Source of truth is `git describe --tags --always`, substituted
+into a `{{VERSION}}` placeholder by `build.py`. The `--dirty` flag was
+deliberately dropped: Vercel's build environment auto-runs `npm install` and
+rewrites tracked files mid-build, so every deploy looked `-dirty` regardless
+of source state — the signal was noise, not a "not-from-a-clean-tag" tell.
+Tags are created automatically by a GitHub Action on every merge to `main`
+(see ADR 0001), and `vercel.json` runs `git fetch --tags` before the build so
+the deploy can resolve them. The footer always reflects current shipped code
+without manual bookkeeping.
 
 ### Trade accounting snapshot
 A per-trade record of the lot state **at the moment that trade was processed**
diff --git a/build.py b/build.py
index 52489cf..9d51845 100644
--- a/build.py
+++ b/build.py
@@ -35,12 +35,12 @@ def resolve_version(cwd=BASE):
     """Return git-tag version string for the repo at *cwd*.
 
     Order of preference:
-      1. ``git describe --tags --always --dirty`` (tag, or short SHA if no tag).
+      1. ``git describe --tags --always`` (tag, or short SHA if no tag).
       2. ``unknown`` if git is unavailable or *cwd* is not a repo.
     """
     try:
         result = subprocess.run(
-            ['git', 'describe', '--tags', '--always', '--dirty'],
+            ['git', 'describe', '--tags', '--always'],
             cwd=cwd, capture_output=True, text=True,
         )
     except (FileNotFoundError, OSError):
@@ -80,11 +80,11 @@ def build():
         + '</html>\n'
     )
 
-    # Inject git-tag version. {{VERSION}} keeps the -dirty suffix for display;
-    # {{VERSION_CLEAN}} strips it so release links resolve to a real tag.
+    # Inject git-tag version. {{VERSION}} and {{VERSION_CLEAN}} are now
+    # identical (we no longer surface the -dirty suffix); kept as separate
+    # placeholders so existing template references still resolve.
     version = resolve_version()
-    version_clean = version[:-len('-dirty')] if version.endswith('-dirty') else version
-    output = output.replace('{{VERSION_CLEAN}}', version_clean)
+    output = output.replace('{{VERSION_CLEAN}}', version)
     output = output.replace('{{VERSION}}', version)
 
     # Write local copy
diff --git a/test/build/test_resolve_version.py b/test/build/test_resolve_version.py
index b3a4112..eb51801 100644
--- a/test/build/test_resolve_version.py
+++ b/test/build/test_resolve_version.py
@@ -54,12 +54,15 @@ def test_commits_past_tag(self):
             v = build.resolve_version(d)
             self.assertTrue(v.startswith('v1.2.3-1-g'), f'got {v!r}')
 
-    def test_dirty_tree(self):
+    def test_dirty_tree_does_not_append_suffix(self):
+        # We deliberately don't surface -dirty: Vercel checkouts can dirty
+        # tracked files mid-build (e.g. npm install rewriting package-lock),
+        # which has nothing to do with the source the user is looking at.
         with tempfile.TemporaryDirectory() as d:
             init_repo(d)
             git(d, 'tag', 'v1.2.3')
             open(os.path.join(d, 'a.txt'), 'w').write('changed')
-            self.assertEqual(build.resolve_version(d), 'v1.2.3-dirty')
+            self.assertEqual(build.resolve_version(d), 'v1.2.3')
 
     def test_no_tags_returns_short_sha(self):
         with tempfile.TemporaryDirectory() as d:
diff --git a/vercel.json b/vercel.json
index 0d14497..c1d3f9c 100644
--- a/vercel.json
+++ b/vercel.json
@@ -1,5 +1,5 @@
 {
-  "buildCommand": "python3 build.py --check",
+  "buildCommand": "git fetch --tags --depth=1 origin || true; python3 build.py --check",
   "outputDirectory": "public",
   "framework": null,
   "headers": [