diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 6d2b6923414..91e1ba0991d 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -96,6 +96,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
           submodules: recursive
+          fetch-tags: true
 
       - name: Install Linux deps
         if: runner.os == 'Linux'
diff --git a/.github/workflows/publish-docker.yaml b/.github/workflows/publish-docker.yaml
index 893a72ca204..c7b01b9141c 100644
--- a/.github/workflows/publish-docker.yaml
+++ b/.github/workflows/publish-docker.yaml
@@ -47,6 +47,7 @@ jobs:
         with:
           ref: ${{ inputs.tag }}
           submodules: recursive
+          fetch-tags: true
 
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
@@ -57,6 +58,11 @@ jobs:
       - name: Push to Docker Hub
         uses: docker/build-push-action@v5
         with:
+          # Important: use actions/checkout source, which has the right tags!
+          # Without context: ., this action will try to fetch git source
+          # itself, and it will be unable to determine the correct version
+          # number.
+          context: .
           push: true
           tags: ${{ secrets.DOCKERHUB_PACKAGE_NAME }}:${{ inputs.tag }}
 
@@ -64,5 +70,10 @@ jobs:
         if: ${{ inputs.latest }}
         uses: docker/build-push-action@v5
         with:
+          # Important: use actions/checkout source, which has the right tags!
+          # Without context: ., this action will try to fetch git source
+          # itself, and it will be unable to determine the correct version
+          # number.
+          context: .
           push: true
           tags: ${{ secrets.DOCKERHUB_PACKAGE_NAME }}:latest
diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml
index ac679fccc62..9c55857de77 100644
--- a/.github/workflows/release-please.yaml
+++ b/.github/workflows/release-please.yaml
@@ -55,7 +55,6 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-tags: true
-          persist-credentials: false
 
       - name: Compute latest
         id: compute
diff --git a/packager/version/generate_version_string.py b/packager/version/generate_version_string.py
index aaa76df397a..8d525a83709 100755
--- a/packager/version/generate_version_string.py
+++ b/packager/version/generate_version_string.py
@@ -8,23 +8,37 @@
 """This script is used to generate version string for packager."""
 
 import subprocess
+import sys
 
 if __name__ == '__main__':
   try:
     version_tag = subprocess.check_output('git tag --points-at HEAD',
         stderr=subprocess.STDOUT, shell=True).decode().rstrip()
+    if version_tag:
+      print('Found version tag: {}'.format(version_tag), file=sys.stderr)
+    else:
+      print('Cannot find version tag!', file=sys.stderr)
   except subprocess.CalledProcessError as e:
     # git tag --points-at is not supported in old versions of git. Just ignore
     # version_tag in this case.
     version_tag = None
+    print('Old version of git, cannot determine version tag!', file=sys.stderr)
 
   try:
     version_hash = subprocess.check_output('git rev-parse --short HEAD',
         stderr=subprocess.STDOUT, shell=True).decode().rstrip()
+    print('Version hash: {}'.format(version_hash), file=sys.stderr)
   except subprocess.CalledProcessError as e:
     version_hash = 'unknown-version'
+    print('Cannot find version hasah!', file=sys.stderr)
 
   if version_tag:
-    print('{0}-{1}'.format(version_tag, version_hash))
+    output = '{0}-{1}'.format(version_tag, version_hash)
   else:
-    print(version_hash)
+    output = version_hash
+
+  # Final debug message, mirroring what is used to generate the source file:
+  print('Final output: {}'.format(output), file=sys.stderr)
+
+  # Actually used to generate the source file:
+  print(output)