diff --git a/.ci/publish.sh b/.ci/publish.sh
index 50daff0fb8..6091071c9b 100755
--- a/.ci/publish.sh
+++ b/.ci/publish.sh
@@ -71,6 +71,7 @@ publish() {
     export JENKINS_SHA=$sha
     export LATEST_WEEKLY=$latest_weekly
     export LATEST_LTS=$latest_lts
+    export COMMIT_SHA=$(git rev-parse HEAD)
     set -x
     docker buildx bake --file docker-bake.hcl \
                  "${build_opts[@]+"${build_opts[@]}"}" linux
diff --git a/11/almalinux/almalinux8/hotspot/Dockerfile b/11/almalinux/almalinux8/hotspot/Dockerfile
index e2d7db95f8..4bf3e07a12 100644
--- a/11/almalinux/almalinux8/hotspot/Dockerfile
+++ b/11/almalinux/almalinux8/hotspot/Dockerfile
@@ -14,6 +14,7 @@ FROM almalinux:8.4
 ENV LANG C.UTF-8
 
 ARG TARGETARCH
+ARG COMMIT_SHA
 
 RUN dnf --setopt=install_weak_deps=0 --setopt=tsflags=nodocs install -y \
 	fontconfig \
@@ -118,4 +119,5 @@ LABEL \
     org.opencontainers.image.version="${JENKINS_VERSION}" \
     org.opencontainers.image.url="https://www.jenkins.io/" \
     org.opencontainers.image.source="https://github.com/jenkinsci/docker" \
+    org.opencontainers.image.revision="${COMMIT_SHA}" \
     org.opencontainers.image.licenses="MIT"
diff --git a/11/alpine/hotspot/Dockerfile b/11/alpine/hotspot/Dockerfile
index 609dceb297..c127dff836 100644
--- a/11/alpine/hotspot/Dockerfile
+++ b/11/alpine/hotspot/Dockerfile
@@ -28,6 +28,7 @@ RUN apk add --no-cache \
 ENV LANG C.UTF-8
 
 ARG TARGETARCH
+ARG COMMIT_SHA
 ARG GIT_LFS_VERSION=3.0.1
 
 # required for multi-arch support, revert to package cloud after:
@@ -166,4 +167,5 @@ LABEL \
     org.opencontainers.image.version="${JENKINS_VERSION}" \
     org.opencontainers.image.url="https://www.jenkins.io/" \
     org.opencontainers.image.source="https://github.com/jenkinsci/docker" \
+    org.opencontainers.image.revision="${COMMIT_SHA}" \
     org.opencontainers.image.licenses="MIT"
diff --git a/11/centos/centos7/hotspot/Dockerfile b/11/centos/centos7/hotspot/Dockerfile
index 84582bdb23..2f0b3036c8 100644
--- a/11/centos/centos7/hotspot/Dockerfile
+++ b/11/centos/centos7/hotspot/Dockerfile
@@ -14,11 +14,13 @@ FROM centos:centos7.9.2009
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
 ARG TARGETARCH
+ARG COMMIT_SHA
 
 RUN yum install -y git curl freetype fontconfig unzip which && \
     yum clean all
 
 ARG TARGETARCH
+ARG COMMIT_SHA
 ARG GIT_LFS_VERSION=3.0.1
 
 # required for multi-arch support, revert to package cloud after:
@@ -131,4 +133,5 @@ LABEL \
     org.opencontainers.image.version="${JENKINS_VERSION}" \
     org.opencontainers.image.url="https://www.jenkins.io/" \
     org.opencontainers.image.source="https://github.com/jenkinsci/docker" \
+    org.opencontainers.image.revision="${COMMIT_SHA}" \
     org.opencontainers.image.licenses="MIT"
diff --git a/11/debian/bullseye-slim/hotspot/Dockerfile b/11/debian/bullseye-slim/hotspot/Dockerfile
index 366f5af172..93d9688509 100644
--- a/11/debian/bullseye-slim/hotspot/Dockerfile
+++ b/11/debian/bullseye-slim/hotspot/Dockerfile
@@ -17,6 +17,7 @@ RUN apt-get update && \
 ENV LANG C.UTF-8
 
 ARG TARGETARCH
+ARG COMMIT_SHA
 ARG GIT_LFS_VERSION=3.0.1
 
 # required for multi-arch support, revert to package cloud after:
@@ -129,4 +130,5 @@ LABEL \
     org.opencontainers.image.version="${JENKINS_VERSION}" \
     org.opencontainers.image.url="https://www.jenkins.io/" \
     org.opencontainers.image.source="https://github.com/jenkinsci/docker" \
+    org.opencontainers.image.revision="${COMMIT_SHA}" \
     org.opencontainers.image.licenses="MIT"
diff --git a/11/debian/bullseye/hotspot/Dockerfile b/11/debian/bullseye/hotspot/Dockerfile
index 5f5871287f..4efd9d6225 100644
--- a/11/debian/bullseye/hotspot/Dockerfile
+++ b/11/debian/bullseye/hotspot/Dockerfile
@@ -15,6 +15,7 @@ RUN apt-get update && \
 ENV LANG C.UTF-8
 
 ARG TARGETARCH
+ARG COMMIT_SHA
 ARG GIT_LFS_VERSION=3.0.1
 
 # required for multi-arch support, revert to package cloud after:
@@ -127,4 +128,5 @@ LABEL \
     org.opencontainers.image.version="${JENKINS_VERSION}" \
     org.opencontainers.image.url="https://www.jenkins.io/" \
     org.opencontainers.image.source="https://github.com/jenkinsci/docker" \
+    org.opencontainers.image.revision="${COMMIT_SHA}" \
     org.opencontainers.image.licenses="MIT"
diff --git a/11/rhel/ubi8/hotspot/Dockerfile b/11/rhel/ubi8/hotspot/Dockerfile
index 2e4ed3ac97..5091d5aecd 100644
--- a/11/rhel/ubi8/hotspot/Dockerfile
+++ b/11/rhel/ubi8/hotspot/Dockerfile
@@ -14,6 +14,7 @@ FROM registry.access.redhat.com/ubi8/ubi:8.4-211
 ENV LANG C.UTF-8
 
 ARG TARGETARCH
+ARG COMMIT_SHA
 
 RUN dnf install --disableplugin=subscription-manager --setopt=install_weak_deps=0 --setopt=tsflags=nodocs -y \
         git \
@@ -121,4 +122,5 @@ LABEL \
     org.opencontainers.image.version="${JENKINS_VERSION}" \
     org.opencontainers.image.url="https://www.jenkins.io/" \
     org.opencontainers.image.source="https://github.com/jenkinsci/docker" \
+    org.opencontainers.image.revision="${COMMIT_SHA}" \
     org.opencontainers.image.licenses="MIT"
diff --git a/11/windows/windowsservercore-2019/hotspot/Dockerfile b/11/windows/windowsservercore-2019/hotspot/Dockerfile
index 3865648d4f..84ad3e1b2a 100644
--- a/11/windows/windowsservercore-2019/hotspot/Dockerfile
+++ b/11/windows/windowsservercore-2019/hotspot/Dockerfile
@@ -6,6 +6,8 @@ ARG http_port=8080
 ARG agent_port=50000
 ARG JENKINS_HOME=C:/ProgramData/Jenkins/JenkinsHome
 
+ARG COMMIT_SHA
+
 ENV JENKINS_HOME $JENKINS_HOME
 ENV JENKINS_AGENT_PORT ${agent_port}
 
@@ -79,4 +81,5 @@ LABEL `
     org.opencontainers.image.version="${JENKINS_VERSION}" `
     org.opencontainers.image.url="https://www.jenkins.io/" `
     org.opencontainers.image.source="https://github.com/jenkinsci/docker" `
+    org.opencontainers.image.revision="${COMMIT_SHA}" `
     org.opencontainers.image.licenses="MIT"
diff --git a/17/debian/bullseye/hotspot/Dockerfile b/17/debian/bullseye/hotspot/Dockerfile
index a6a6557c9c..0af88215f4 100644
--- a/17/debian/bullseye/hotspot/Dockerfile
+++ b/17/debian/bullseye/hotspot/Dockerfile
@@ -15,6 +15,7 @@ RUN apt-get update && \
 ENV LANG C.UTF-8
 
 ARG TARGETARCH
+ARG COMMIT_SHA
 ARG GIT_LFS_VERSION=3.0.1
 
 # required for multi-arch support, revert to package cloud after:
@@ -128,4 +129,5 @@ LABEL \
     org.opencontainers.image.version="${JENKINS_VERSION}" \
     org.opencontainers.image.url="https://www.jenkins.io/" \
     org.opencontainers.image.source="https://github.com/jenkinsci/docker" \
+    org.opencontainers.image.revision="${COMMIT_SHA}" \
     org.opencontainers.image.licenses="MIT"
diff --git a/8/alpine/hotspot/Dockerfile b/8/alpine/hotspot/Dockerfile
index 1a5cd08343..8540e4686a 100644
--- a/8/alpine/hotspot/Dockerfile
+++ b/8/alpine/hotspot/Dockerfile
@@ -18,6 +18,7 @@ RUN apk add --no-cache \
 ENV LANG C.UTF-8
 
 ARG TARGETARCH
+ARG COMMIT_SHA
 ARG GIT_LFS_VERSION=3.0.1
 
 # required for multi-arch support, revert to package cloud after:
@@ -116,4 +117,5 @@ LABEL \
     org.opencontainers.image.version="${JENKINS_VERSION}" \
     org.opencontainers.image.url="https://www.jenkins.io/" \
     org.opencontainers.image.source="https://github.com/jenkinsci/docker" \
+    org.opencontainers.image.revision="${COMMIT_SHA}" \
     org.opencontainers.image.licenses="MIT"
diff --git a/8/centos/centos7/hotspot/Dockerfile b/8/centos/centos7/hotspot/Dockerfile
index 2e2a047682..3f9d24080b 100644
--- a/8/centos/centos7/hotspot/Dockerfile
+++ b/8/centos/centos7/hotspot/Dockerfile
@@ -3,6 +3,7 @@ FROM centos:centos7.9.2009
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
 ARG TARGETARCH
+ARG COMMIT_SHA
 
 RUN echo -e '[AdoptOpenJDK]\n\
 name=AdoptOpenJDK\n\
@@ -14,6 +15,7 @@ gpgkey=https://adoptopenjdk.jfrog.io/adoptopenjdk/api/gpg/key/public' > /etc/yum
     yum clean all
 
 ARG TARGETARCH
+ARG COMMIT_SHA
 ARG GIT_LFS_VERSION=3.0.1
 
 # required for multi-arch support, revert to package cloud after:
@@ -122,4 +124,5 @@ LABEL \
     org.opencontainers.image.version="${JENKINS_VERSION}" \
     org.opencontainers.image.url="https://www.jenkins.io/" \
     org.opencontainers.image.source="https://github.com/jenkinsci/docker" \
+    org.opencontainers.image.revision="${COMMIT_SHA}" \
     org.opencontainers.image.licenses="MIT"
diff --git a/8/debian/bullseye-slim/hotspot/Dockerfile b/8/debian/bullseye-slim/hotspot/Dockerfile
index 99d7b2ebc1..3886e147e1 100644
--- a/8/debian/bullseye-slim/hotspot/Dockerfile
+++ b/8/debian/bullseye-slim/hotspot/Dockerfile
@@ -9,6 +9,7 @@ RUN apt-get update && \
 ENV LANG C.UTF-8
 
 ARG TARGETARCH
+ARG COMMIT_SHA
 ARG GIT_LFS_VERSION=3.0.1
 
 # required for multi-arch support, revert to package cloud after:
@@ -121,4 +122,5 @@ LABEL \
     org.opencontainers.image.version="${JENKINS_VERSION}" \
     org.opencontainers.image.url="https://www.jenkins.io/" \
     org.opencontainers.image.source="https://github.com/jenkinsci/docker" \
+    org.opencontainers.image.revision="${COMMIT_SHA}" \
     org.opencontainers.image.licenses="MIT"
diff --git a/8/debian/bullseye/hotspot/Dockerfile b/8/debian/bullseye/hotspot/Dockerfile
index e6756d6ff2..601dfd6717 100644
--- a/8/debian/bullseye/hotspot/Dockerfile
+++ b/8/debian/bullseye/hotspot/Dockerfile
@@ -9,6 +9,7 @@ RUN apt-get update && \
 ENV LANG C.UTF-8
 
 ARG TARGETARCH
+ARG COMMIT_SHA
 ARG GIT_LFS_VERSION=3.0.1
 
 # required for multi-arch support, revert to package cloud after:
@@ -121,4 +122,5 @@ LABEL \
     org.opencontainers.image.version="${JENKINS_VERSION}" \
     org.opencontainers.image.url="https://www.jenkins.io/" \
     org.opencontainers.image.source="https://github.com/jenkinsci/docker" \
+    org.opencontainers.image.revision="${COMMIT_SHA}" \
     org.opencontainers.image.licenses="MIT"
diff --git a/Makefile b/Makefile
index 418fe45cf5..46a01d39a1 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,5 @@
 ROOT_DIR="$(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))/"
+COMMIT_SHA=$(shell git rev-parse HEAD)
 
 ## For Docker <=20.04
 export DOCKER_BUILDKIT=1
@@ -25,7 +26,7 @@ check_cli = type "$(1)" >/dev/null 2>&1 || { echo "Error: command '$(1)' require
 ## Check if a given image exists in the current manifest docker-bake.hcl
 check_image = make --silent list | grep -w '$(1)' >/dev/null 2>&1 || { echo "Error: the image '$(1)' does not exist in manifest for the platform 'linux/$(ARCH)'. Please check the output of 'make list'. Exiting." ; exit 1 ; }
 ## Base "docker buildx base" command to be reused everywhere
-bake_base_cli := docker buildx bake -f docker-bake.hcl --load
+bake_base_cli := COMMIT_SHA=$(COMMIT_SHA) docker buildx bake -f docker-bake.hcl --load
 
 check-reqs:
 ## Build requirements
diff --git a/docker-bake.hcl b/docker-bake.hcl
index d0a280f860..7d8ca5d25c 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -65,12 +65,17 @@ variable "PLUGIN_CLI_VERSION" {
   default = "2.11.0"
 }
 
+variable "COMMIT_SHA" {
+  default = ""
+}
+
 target "almalinux_jdk11" {
   dockerfile = "11/almalinux/almalinux8/hotspot/Dockerfile"
   context = "."
   args = {
     JENKINS_VERSION = JENKINS_VERSION
     JENKINS_SHA = JENKINS_SHA
+	COMMIT_SHA = COMMIT_SHA
   }
   tags = [
     "${REGISTRY}/${JENKINS_REPO}:${JENKINS_VERSION}-almalinux",
@@ -86,6 +91,7 @@ target "alpine_jdk8" {
   args = {
     JENKINS_VERSION = JENKINS_VERSION
     JENKINS_SHA = JENKINS_SHA
+	COMMIT_SHA = COMMIT_SHA
     GIT_LFS_VERSION = GIT_LFS_VERSION
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
   }
@@ -103,6 +109,7 @@ target "alpine_jdk11" {
   args = {
     JENKINS_VERSION = JENKINS_VERSION
     JENKINS_SHA = JENKINS_SHA
+	COMMIT_SHA = COMMIT_SHA
     GIT_LFS_VERSION = GIT_LFS_VERSION
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
   }
@@ -123,6 +130,7 @@ target "centos7_jdk8" {
   args = {
     JENKINS_VERSION = JENKINS_VERSION
     JENKINS_SHA = JENKINS_SHA
+	COMMIT_SHA = COMMIT_SHA
     GIT_LFS_VERSION = GIT_LFS_VERSION
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
   }
@@ -140,6 +148,7 @@ target "centos7_jdk11" {
   args = {
     JENKINS_VERSION = JENKINS_VERSION
     JENKINS_SHA = JENKINS_SHA
+	COMMIT_SHA = COMMIT_SHA
     GIT_LFS_VERSION = GIT_LFS_VERSION
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
   }
@@ -160,6 +169,7 @@ target "debian_jdk8" {
   args = {
     JENKINS_VERSION = JENKINS_VERSION
     JENKINS_SHA = JENKINS_SHA
+	COMMIT_SHA = COMMIT_SHA
     GIT_LFS_VERSION = GIT_LFS_VERSION
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
   }
@@ -177,6 +187,7 @@ target "debian_jdk11" {
   args = {
     JENKINS_VERSION = JENKINS_VERSION
     JENKINS_SHA = JENKINS_SHA
+	COMMIT_SHA = COMMIT_SHA
     GIT_LFS_VERSION = GIT_LFS_VERSION
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
   }
@@ -200,6 +211,7 @@ target "debian_slim_jdk8" {
   args = {
     JENKINS_VERSION = JENKINS_VERSION
     JENKINS_SHA = JENKINS_SHA
+	COMMIT_SHA = COMMIT_SHA
     GIT_LFS_VERSION = GIT_LFS_VERSION
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
   }
@@ -217,6 +229,7 @@ target "debian_slim_jdk11" {
   args = {
     JENKINS_VERSION = JENKINS_VERSION
     JENKINS_SHA = JENKINS_SHA
+	COMMIT_SHA = COMMIT_SHA
     GIT_LFS_VERSION = GIT_LFS_VERSION
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
   }
@@ -237,6 +250,7 @@ target "rhel_ubi8_jdk11" {
   args = {
     JENKINS_VERSION = JENKINS_VERSION
     JENKINS_SHA = JENKINS_SHA
+	COMMIT_SHA = COMMIT_SHA
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
   }
   tags = [
@@ -253,6 +267,7 @@ target "debian_jdk17" {
   args = {
     JENKINS_VERSION = JENKINS_VERSION
     JENKINS_SHA = JENKINS_SHA
+	COMMIT_SHA = COMMIT_SHA
     GIT_LFS_VERSION = GIT_LFS_VERSION
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
   }
diff --git a/tests/runtime.Tests.ps1 b/tests/runtime.Tests.ps1
index 5fa8f689bb..212ac39743 100644
--- a/tests/runtime.Tests.ps1
+++ b/tests/runtime.Tests.ps1
@@ -40,6 +40,7 @@ Describe "[$TEST_TAG] test jenkins arguments" {
   BeforeEach {
     $folder = Get-EnvOrDefault 'FOLDER' ''
     $version=Get-Content $(Join-Path $folder 'Dockerfile') | Select-String -Pattern 'ENV JENKINS_VERSION.*' | %{$_ -replace '.*:-(.*)}','$1'} | Select-Object -First 1
+    $revision=Get-Content $(Join-Path $folder 'Dockerfile') | Select-String -Pattern 'ENV COMMIT_SHA.*' | %{$_ -replace '.*:-(.*)}','$1'} | Select-Object -First 1
   }
 
   It 'running --help --version should return the version, not the help' {
@@ -54,6 +55,12 @@ Describe "[$TEST_TAG] test jenkins arguments" {
     $exitCode | Should -Be 0
     $stdout.Trim() | Should -Match $version
   }
+
+  It 'commit SHA in docker metadata' {
+    $exitCode, $stdout, $stderr = Run-Program 'docker.exe' "inspect -f `"{{index .Config.Labels \`"org.opencontainers.image.revision\`"}}`" $SUT_IMAGE"
+    $exitCode | Should -Be 0
+    $stdout.Trim() | Should -Match $revision
+  }
 }
 
 Describe "[$TEST_TAG] create test container" {
diff --git a/tests/runtime.bats b/tests/runtime.bats
index d27f4914b5..0856741ee9 100644
--- a/tests/runtime.bats
+++ b/tests/runtime.bats
@@ -13,6 +13,11 @@ SUT_DESCRIPTION="${IMAGE}-runtime"
   assert "${version}" docker inspect --format '{{ index .Config.Labels "org.opencontainers.image.version"}}' $SUT_IMAGE
 }
 
+@test "[${SUT_DESCRIPTION}] test commit SHA in docker metadata" {
+  local revision=$(get_commit_sha)
+  assert "${revision}" docker inspect --format '{{ index .Config.Labels "org.opencontainers.image.revision"}}' $SUT_IMAGE
+}
+
 @test "[${SUT_DESCRIPTION}] test multiple JENKINS_OPTS" {
   local container_name version
   # running --help --version should return the version, not the help
diff --git a/tests/test_helpers.bash b/tests/test_helpers.bash
index 08f786a131..f8347f133a 100644
--- a/tests/test_helpers.bash
+++ b/tests/test_helpers.bash
@@ -49,6 +49,12 @@ function get_jenkins_version() {
   make --silent show | jq -r ".target.${IMAGE}.args.JENKINS_VERSION"
 }
 
+function get_commit_sha() {
+  test -n "${IMAGE:?"[sut_image] Please set the variable 'IMAGE' to the name of the image to test in 'docker-bake.hcl'."}"
+
+  make --silent show | jq -r ".target.${IMAGE}.args.COMMIT_SHA"
+}
+
 function get_test_image {
     test -n "${BATS_TEST_NUMBER:?"[get_test_image] Please set the variable BATS_TEST_NUMBER."}"
     test -n "${SUT_DESCRIPTION:?"[get_test_image] Please set the variable SUT_DESCRIPTION."}"