diff --git a/crates/heph-core/build.rs b/crates/heph-core/build.rs
index f0fe636..7f52741 100644
--- a/crates/heph-core/build.rs
+++ b/crates/heph-core/build.rs
@@ -35,10 +35,14 @@ fn git_short_sha() -> Option<String> {
     if sha.is_empty() {
         return None;
     }
-    let dirty = Command::new("git")
-        .args(["status", "--porcelain"])
-        .output()
-        .map(|o| !o.stdout.is_empty())
-        .unwrap_or(false);
+    // Tracked changes only. `git status --porcelain` would also count
+    // untracked files — including cargo's own `.cargo-ok` marker in a
+    // `cargo install --git` checkout — and falsely tag a clean release build
+    // `-dirty`. `git diff --quiet HEAD` exits non-zero only on tracked edits.
+    let dirty = !Command::new("git")
+        .args(["diff", "--quiet", "HEAD"])
+        .status()
+        .map(|s| s.success())
+        .unwrap_or(true);
     Some(if dirty { format!("{sha}-dirty") } else { sha })
 }
diff --git a/docs/changelog.d/+version-no-false-dirty.bugfix.md b/docs/changelog.d/+version-no-false-dirty.bugfix.md
new file mode 100644
index 0000000..2b0bd04
--- /dev/null
+++ b/docs/changelog.d/+version-no-false-dirty.bugfix.md
@@ -0,0 +1 @@
+Fix `heph`/`hephd` `--version` falsely showing a `-dirty` suffix on clean release installs. The build-time dirty check now considers only tracked modifications (`git diff --quiet HEAD`) instead of counting untracked files such as cargo's own `.cargo-ok` marker in a `cargo install --git` checkout.