diff --git a/Makefile b/Makefile
index 706fd7171..baaf1a949 100644
--- a/Makefile
+++ b/Makefile
@@ -40,6 +40,10 @@ CLI_PLATFORMS ?= linux-amd64 linux-arm linux-arm64 darwin-amd64 windows-amd64 li
 CONTAINER_PLATFORMS ?= linux-amd64 linux-ppc64le linux-arm linux-arm64
 MANIFEST_PLATFORMS ?= amd64 ppc64le arm arm64
 
+# set git sha and tree state
+GIT_SHA = $(shell git rev-parse HEAD)
+GIT_DIRTY = $(shell git status --porcelain 2> /dev/null)
+
 ###
 ### These variables should not need tweaking.
 ###
@@ -113,6 +117,8 @@ local: build-dirs
 	VERSION=$(VERSION) \
 	PKG=$(PKG) \
 	BIN=$(BIN) \
+	GIT_SHA=$(GIT_SHA) \
+	GIT_DIRTY="$(GIT_DIRTY)" \
 	OUTPUT_DIR=$$(pwd)/_output/bin/$(GOOS)/$(GOARCH) \
 	./hack/build.sh
 
@@ -126,6 +132,8 @@ _output/bin/$(GOOS)/$(GOARCH)/$(BIN): build-dirs
 		VERSION=$(VERSION) \
 		PKG=$(PKG) \
 		BIN=$(BIN) \
+		GIT_SHA=$(GIT_SHA) \
+		GIT_DIRTY=\"$(GIT_DIRTY)\" \
 		OUTPUT_DIR=/output/$(GOOS)/$(GOARCH) \
 		./hack/build.sh'"
 
diff --git a/hack/build.sh b/hack/build.sh
index bdbfcdb73..641e27d28 100755
--- a/hack/build.sh
+++ b/hack/build.sh
@@ -39,10 +39,13 @@ if [ -z "${VERSION}" ]; then
     exit 1
 fi
 
+if [ -z "${GIT_SHA}" ]; then
+    echo "GIT_SHA must be set"
+    exit 1
+fi
+
 export CGO_ENABLED=0
 
-GIT_SHA=$(git rev-parse HEAD)
-GIT_DIRTY=$(git status --porcelain 2> /dev/null)
 if [[ -z "${GIT_DIRTY}" ]]; then
   GIT_TREE_STATE=clean
 else