diff --git a/.github/workflows/build-book.yml b/.github/workflows/build-book.yml
index 026aa556..48c9a7a6 100644
--- a/.github/workflows/build-book.yml
+++ b/.github/workflows/build-book.yml
@@ -23,7 +23,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          fetch_depth: 0
+          fetch-depth: 0
 
       - name: Restore mtimes from git history
         run: |
diff --git a/conf.py b/conf.py
index 076bafca..beedf3ee 100644
--- a/conf.py
+++ b/conf.py
@@ -54,18 +54,18 @@
 else:
     build_languages = ["en"] + languages
 
-# Get the latest Git tag - there might be a prettier way to do this but...
+# Use only the Git SHA for the Sphinx "release" string.
+# (Sphinx doesn't require PEP 440 here, but we keep it well-formed and stable.)
 try:
     release_value = (
-        subprocess.check_output(["git", "describe", "--tags"])
+        subprocess.check_output(["git", "rev-parse", "--short=12", "HEAD"])
         .decode("utf-8")
         .strip()
     )
-    release_value = release_value[:4]
-except subprocess.CalledProcessError:
-    release_value = "0.1"  # Default value in case there's no tag
+except (subprocess.CalledProcessError, FileNotFoundError, ValueError):
+    # Fallback when building from a source archive or without git available
+    release_value = "unknown"
 
-# Update the release value
 release = release_value
 
 # -- General configuration ---------------------------------------------------
@@ -181,7 +181,8 @@
     ".venv",
     "venv",
     "env",
-    "LICENSE.rst"
+    "LICENSE.rst",
+    "SECURITY.md"
 ]
 
 # For sitemap generation