diff --git a/build.sh b/build.sh
index f7a1f09..b014837 100755
--- a/build.sh
+++ b/build.sh
@@ -4,7 +4,10 @@ set -euo pipefail
 cd "$(dirname "$0")"
 
 APP=sshkeeper
-VERSION=$(git describe --tags --always --dirty 2>/dev/null || echo "dev")
+# --match 'v*' keeps the rolling `nightly` tag from hijacking the version: a
+# plain `git describe --tags` picks whichever tag is nearest, so a nightly build
+# would otherwise stamp binaries "nightly" instead of v<last release>-N-g<sha>.
+VERSION=$(git describe --tags --match 'v*' --always --dirty 2>/dev/null || echo "dev")
 LDFLAGS="-s -w -X main.version=${VERSION}"
 
 echo "==> Building ${APP} ${VERSION}..."
diff --git a/docs/release.md b/docs/release.md
index fec51dc..1fc6503 100644
--- a/docs/release.md
+++ b/docs/release.md
@@ -12,8 +12,11 @@ git tag -a v0.2.0 -m "sshkeeper v0.2.0"
 git push origin v0.2.0
 ```
 
-The release script uses `git describe --tags --always --dirty` by default. You
-can also pass the version explicitly:
+The release script uses `git describe --tags --match 'v*' --always --dirty` by
+default. The `--match 'v*'` filter matters: nightly builds move a `nightly` tag
+across `main`, and without the filter `git describe` would pick that tag and
+stamp binaries `nightly` instead of `v<last release>-<n>-g<sha>`. You can also
+pass the version explicitly:
 
 ```bash
 ./release.sh v0.2.0
diff --git a/release.sh b/release.sh
index 8327381..0a482c6 100755
--- a/release.sh
+++ b/release.sh
@@ -4,7 +4,8 @@ set -euo pipefail
 cd "$(dirname "$0")"
 
 APP=sshkeeper
-VERSION=${VERSION:-${1:-$(git describe --tags --always --dirty 2>/dev/null || echo "dev")}}
+# --match 'v*' ignores the rolling `nightly` tag; see build.sh for the details.
+VERSION=${VERSION:-${1:-$(git describe --tags --match 'v*' --always --dirty 2>/dev/null || echo "dev")}}
 LDFLAGS="-s -w -X main.version=${VERSION}"
 DIST_DIR="dist"
 SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-$(git log -1 --format=%ct 2>/dev/null || date +%s)}