diff --git a/README.md b/README.md
index c52f2e2..6a5b9a4 100644
--- a/README.md
+++ b/README.md
@@ -84,7 +84,8 @@ curl -s http://localhost:3000/api/v1/validate/https://dpp.oydapp.eu/01/095201234
 ```
 
 `./build.sh <ref>` builds with a given commit or tag of dpp-criteria; the
-default is `main`. `GET /version` shows the commit in use. The image is built
+default is `main`. Branch and tag names are resolved to their commit first, so
+that the Docker build cache never reuses an older dpp-criteria. `GET /version` shows the commit in use. The image is built
 for linux/amd64, like the SOyA web-cli it contains.
 
 ## Deployment
diff --git a/build.sh b/build.sh
index ab737d9..de26704 100755
--- a/build.sh
+++ b/build.sh
@@ -5,6 +5,12 @@
 #   DOCKERHUB=1 ./build.sh         build and push
 set -eu
 REF="${1:-main}"
+# A branch or tag is resolved to its commit, so that the Docker build cache
+# never reuses a clone of an older dpp-criteria.
+RESOLVED=$(git ls-remote https://github.com/OwnYourData/dpp-criteria.git \
+  "refs/heads/$REF" "refs/tags/$REF" "refs/tags/$REF^{}" | sort -k2 | tail -n1 | cut -f1)
+[ -n "$RESOLVED" ] && REF="$RESOLVED"
+echo "dpp-criteria: $REF"
 docker build --platform linux/amd64 --build-arg DPP_CRITERIA_REF="$REF" -f docker/Dockerfile -t oydeu/dpplint:latest .
 if [ "${DOCKERHUB:-0}" = "1" ]; then
   docker push oydeu/dpplint:latest