diff --git a/tools/image-tag b/tools/image-tag
index 389a1bd7e3..e85affbf59 100755
--- a/tools/image-tag
+++ b/tools/image-tag
@@ -1,21 +1,34 @@
 #!/usr/bin/env bash
+#
+# image-tag determines which version to embed into a built image.
+#
+# It prefers the following in precedence order:
+#
+# 1. RELEASE_TAG environment variable
+# 2. The Git tag of the current commit (if any)
+# 3. The version in the VERSION file, suffixed with -devel plus build
+#    information.
 set -o errexit
 set -o pipefail
 
+VERSION=$(sed -e '/^#/d' -e '/^$/d' VERSION | tr -d '\n')
+DETECTED_TAG=$(git describe --match 'v*' --exact-match 2>/dev/null || echo -n "")
+
 if [ ! -z "${RELEASE_TAG}" ]; then
   echo ${RELEASE_TAG}
   exit 0
+elif [ ! -z "${DETECTED_TAG}" ]; then
+  echo ${DETECTED_TAG}
+  exit 0
 fi
 
 set -o nounset
 
-WIP=$(git diff --quiet || echo '-WIP')
-BRANCH=$(git rev-parse --abbrev-ref HEAD | sed 's#/#-#g')
-
-# When 7 chars are not enough to be unique, git automatically uses more.
-# We are forcing to 7 here, as we are doing for grafana/grafana as well.
-SHA=$(git rev-parse --short=7 HEAD | head -c7)
-
-# If this is a tag, use it, otherwise use <branch>-<hash>
-TAG=$(git describe --exact-match 2> /dev/null || echo "${BRANCH}-${SHA}")
-echo ${TAG}${WIP}
+if [[ -z $(git status -s) ]]; then
+  # There are no changes; report version as VERSION-devel+SHA.
+  SHA=$(git rev-parse --short HEAD)
+  echo ${VERSION}-devel+${SHA}
+else
+  # Git is dirty; tag as VERSION-devel+wip.
+  echo ${VERSION}-devel+wip
+fi