diff --git a/.forgejo/actions/build-release/action.yml b/.forgejo/actions/build-release/action.yml
index ad9818e9f0..01fdfdedfc 100644
--- a/.forgejo/actions/build-release/action.yml
+++ b/.forgejo/actions/build-release/action.yml
@@ -130,7 +130,7 @@ runs:
           binary="${{ inputs.binary-name }}-${{ inputs.tag-version }}-linux"
           docker cp forgejo-$arch:${{ inputs.binary-path }} $binary-$arch
           chmod +x $binary-$arch
-          # the displayed version is converted with - sometime changed into +, deal with it
+          # the displayed version has a + instead of the first -, deal with it
           pattern=$(echo "${{ inputs.tag-version }}" | tr - .)
           if ! ./$binary-$arch --version | grep "$pattern" ; then
             echo "ERROR: expected version pattern $pattern not found in the output of $binary-$arch --version"
diff --git a/.forgejo/testdata/build-release/Dockerfile b/.forgejo/testdata/build-release/Dockerfile
new file mode 100644
index 0000000000..4b6933845c
--- /dev/null
+++ b/.forgejo/testdata/build-release/Dockerfile
@@ -0,0 +1,3 @@
+FROM public.ecr.aws/docker/library/alpine:3.18
+RUN mkdir -p /app/gitea
+RUN ( echo '#!/bin/sh' ; echo "echo forgejo v1.2.3" ) > /app/gitea/gitea ; chmod +x /app/gitea/gitea
diff --git a/.forgejo/testdata/build-release/Makefile b/.forgejo/testdata/build-release/Makefile
new file mode 100644
index 0000000000..406acd06d2
--- /dev/null
+++ b/.forgejo/testdata/build-release/Makefile
@@ -0,0 +1,5 @@
+VERSION ?= $(shell cat VERSION 2>/dev/null)
+sources-tarbal:
+	mkdir -p dist/release
+	echo $(VERSION) > VERSION
+	sources=forgejo-src-$(VERSION).tar.gz ; tar --transform 's|^./|forgejo-src-$(VERSION)/|' -czf dist/release/forgejo-src-$(VERSION).tar.gz . ; cd dist/release ; shasum -a 256 $$sources > $$sources.sha256
diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml
index 476ce93282..d893bd39af 100644
--- a/.forgejo/workflows/build-release-integration.yml
+++ b/.forgejo/workflows/build-release-integration.yml
@@ -49,17 +49,11 @@ jobs:
           #
           # Create a new project with a fake forgejo and the release workflow only
           #
+          cp -a .forgejo/testdata/build-release/* $dir
           mkdir -p $dir/.forgejo/workflows
           cp .forgejo/workflows/build-release.yml $dir/.forgejo/workflows
           cp -a .forgejo/actions $dir/.forgejo/actions
-          cat > $dir/Dockerfile <<EOF
-          FROM docker.io/library/alpine:3.18
-          RUN mkdir -p /app/gitea
-          RUN ( echo '#!/bin/sh' ; echo "echo forgejo v$version" ) > /app/gitea/gitea ; chmod +x /app/gitea/gitea
-          EOF
           cp $dir/Dockerfile $dir/Dockerfile.rootless
-          sources=forgejo-src-$version.tar.gz
-          ( echo 'sources-tarbal:' ; echo -e '\tmkdir -p dist/release ; cd dist/release ; sources=forgejo-src-$(VERSION).tar.gz ; echo sources > $$sources ; shasum -a 256 $$sources > $$sources.sha256' ) > $dir/Makefile
 
           forgejo-test-helper.sh push $dir $url root forgejo |& tee $dir/pushed
           eval $(grep '^sha=' < $dir/pushed)
@@ -96,6 +90,7 @@ jobs:
             done
           done
 
+          sources=forgejo-src-$version.tar.gz
           curl --fail -L -sS $url/root/forgejo/releases/download/v$version/$sources > $sources
           curl --fail -L -sS $url/root/forgejo/releases/download/v$version/$sources.sha256 > $sources.sha256
           shasum -a 256 --check $sources.sha256
diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml
index ffae76f23c..80be728a8f 100644
--- a/.forgejo/workflows/build-release.yml
+++ b/.forgejo/workflows/build-release.yml
@@ -66,10 +66,31 @@ jobs:
 
       - name: Build sources
         run: |
+          set -x
           apt-get -qq install -y make
-          make VERSION=${{ steps.tag-version.outputs.value }} sources-tarbal
+          version=${{ steps.tag-version.outputs.value }}
+          make VERSION=$version sources-tarbal
           mv dist/release release
-          find release | grep tar.gz # sanity check to fail fast
+
+          #
+          # Sanity check to verify that the source tarbal knows the
+          # version and is able to rebuild itself from it.
+          #
+          # When in sources the version is determined with git.
+          # When in the tarbal the version is determined from a VERSION file.
+          #
+          (
+            tmp=$(mktemp -d)
+            tar --directory $tmp -zxvf release/*$version*.tar.gz
+            cd $tmp/*
+            make sources-tarbal
+            tarbal=$(echo dist/release/*$version*.tar.gz)
+            if ! test -f $tarbal ; then
+              echo $tarbal does not exist
+              find dist release
+              exit 1
+            fi
+          )
 
       - name: build container & release (when TOKEN secret is not set)
         if: ${{ secrets.TOKEN == '' }}
diff --git a/Makefile b/Makefile
index 77ace24916..9d7b001266 100644
--- a/Makefile
+++ b/Makefile
@@ -79,7 +79,13 @@ endif
 STORED_VERSION_FILE := VERSION
 HUGO_VERSION ?= 0.111.3
 
-GITEA_VERSION ?= $(shell git describe --tags --always | sed 's/-/+/' | sed 's/^v//')
+
+STORED_VERSION=$(shell cat $(STORED_VERSION_FILE) 2>/dev/null)
+ifneq ($(STORED_VERSION),)
+  GITEA_VERSION ?= $(STORED_VERSION)
+else
+  GITEA_VERSION ?= $(shell git describe --tags --always | sed 's/-/+/' | sed 's/^v//')
+endif
 VERSION = ${GITEA_VERSION}
 
 LDFLAGS := $(LDFLAGS) -X "main.MakeVersion=$(MAKE_VERSION)" -X "main.Version=$(GITEA_VERSION)" -X "main.Tags=$(TAGS)"