diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 56fd675..d28e3ec 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -54,6 +54,14 @@ jobs:
             fetch --depth 1 origin "${{ gitea.sha }}"
           git checkout -q FETCH_HEAD
 
+      # Read by app.rb at boot and shown (as a hover tooltip on the topbar
+      # brand) so it's possible to tell which commit is actually live
+      # without digging through `tea actions runs list` — written here,
+      # before .git gets dropped below, since that's otherwise the only
+      # place the commit is recorded.
+      - name: Write REVISION
+        run: git rev-parse --short HEAD > REVISION
+
       # Clears out everything in the target except data/ (uploaded GPX
       # files, offline.pmtiles) and copies the fresh checkout over, dropping
       # .git afterwards. Dotfiles like .env (deployment secrets) are left
diff --git a/.gitignore b/.gitignore
index 597e36c..fe3e277 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,3 +29,7 @@
 # Deployment secrets (SESSION_SECRET, Gitea OAuth2 client id/secret) — lives
 # only on the server, see docs/deployment.adoc
 .env
+
+# Written by the CI deploy job with the commit it deployed — never
+# committed itself, see app.rb's REVISION
+/REVISION
diff --git a/app.rb b/app.rb
index 7bd129b..37677eb 100644
--- a/app.rb
+++ b/app.rb
@@ -39,6 +39,20 @@ module Maptool
     # the container) is enough — it doesn't need to survive restarts.
     ASSET_VERSION = Time.now.to_i
 
+    # Written by the CI deploy job (.gitea/workflows/ci.yml) right before it
+    # drops .git from the deployed copy, so this is the only way to tell
+    # which commit is actually live short of asking the deploy job itself —
+    # handy for exactly the kind of "did my push actually deploy, or am I
+    # looking at a stale browser cache" confusion ASSET_VERSION above can't
+    # answer by itself (that only proves *a* deploy happened recently, not
+    # *which* one). Absent outside a real deploy (local dev, CI's own
+    # `check` job), hence the fallback.
+    REVISION = begin
+      File.read(File.join(__dir__, "REVISION")).strip
+    rescue Errno::ENOENT
+      "dev"
+    end
+
     # Overridable so the test suite can point this at a throwaway directory
     # instead of the real data/ — nothing else needs to set this.
     DATA_DIR = ENV.fetch("MAPTOOL_DATA_DIR") { File.join(__dir__, "data") }
@@ -151,7 +165,7 @@ module Maptool
     end
 
     get "/" do
-      erb :index, locals: { logged_in: logged_in?, user: session[:user] }
+      erb :index, locals: { logged_in: logged_in?, user: session[:user], revision: REVISION }
     end
 
     get "/api/health" do
diff --git a/views/index.erb b/views/index.erb
index b44fc25..43cfb35 100644
--- a/views/index.erb
+++ b/views/index.erb
@@ -1,6 +1,6 @@
 <div id="app">
   <header class="topbar">
-    <span class="topbar__brand">MapTool</span>
+    <span class="topbar__brand" title="rev <%= revision %>">MapTool</span>
     <div class="topbar__auth">
       <% if logged_in %>
         <span><%= user %></span>