diff --git a/scripts/get-latest-version.sh b/scripts/get-latest-version.sh
index 9af16c6..840bf5e 100755
--- a/scripts/get-latest-version.sh
+++ b/scripts/get-latest-version.sh
@@ -1,10 +1,14 @@
 #!/usr/bin/env bash
 # Resolve which HeiniRemote revision to package. Prints eval-able output:
-#   version=<x.y.z or 0.0.0-git.<date>.<sha>>
+#   version=<x.y.z or 0.0.0-git.<sha>>
 #   ref=<tag name or commit sha>
 #
 # Prefers the newest v* release tag on the upstream repo; while no release tag
-# exists yet, falls back to the tip of main (version derived from the commit).
+# exists yet, falls back to the tip of main. The fallback version is derived
+# ONLY from the commit sha, NOT the build date: the version must be a pure
+# function of the source, so the nightly cron rebuilds when main actually
+# moves — not every day just because the wall clock advanced (which would spawn
+# a new tag/release/bundle daily).
 # UPSTREAM_URL may carry credentials (CI injects the actions token for private
 # repos); only derived values are printed.
 set -euo pipefail
@@ -22,6 +26,6 @@ if [ -n "$tag" ]; then
 else
   sha=$(git ls-remote "$UPSTREAM_URL" refs/heads/main | cut -c1-12)
   [ -n "$sha" ] || { echo "ERROR: cannot resolve upstream main" >&2; exit 1; }
-  echo "version=0.0.0-git.$(date +%Y%m%d).$sha"
+  echo "version=0.0.0-git.$sha"
   echo "ref=$sha"
 fi