diff --git a/build.cfg b/build.cfg
index fe1abd09..81c2e3c8 100644
--- a/build.cfg
+++ b/build.cfg
@@ -114,7 +114,7 @@ COLIBRI_COST_MODE="${COLIBRI_COST_MODE:-smart}"
 # COLIBRI_STAGE_AGENT=NO stages the daemon without the agent (debug builds).
 # Pin a tag for reproducible images; the agent has no FreeBSD release, so the
 # build host compiles it: (cd $ZOT_REPO && git checkout $ZOT_VERSION &&
-#   GOOS=freebsd GOARCH=amd64 go build -trimpath -o bin/zot ./cmd/zot)
+#   ZOT_BUILD_VERSION="${ZOT_VERSION:-v0.2.29}" && VERSION="${ZOT_BUILD_VERSION#v}" make build)
 COLIBRI_STAGE_AGENT="${COLIBRI_STAGE_AGENT:-YES}"
 ZOT_VERSION="${ZOT_VERSION:-v0.2.29}"
 ZOT_REPO="${ZOT_REPO:-/home/clawdie/ai/zot}"
diff --git a/build.sh b/build.sh
index e1d4cd31..3d744a8c 100755
--- a/build.sh
+++ b/build.sh
@@ -373,7 +373,7 @@ preflight_zot_artifacts() {
             echo "       NOTE: go toolchain not found on this host — install it: pkg install go"
         echo "       The agent has no FreeBSD release — build it first:"
         echo "       (cd ${_resolved_zot_repo} && git checkout ${ZOT_VERSION:-v0.2.29} && \\"
-        echo "          GOOS=freebsd GOARCH=amd64 go build -trimpath -o bin/zot ./cmd/zot)"
+        echo "          ZOT_BUILD_VERSION=\"\${ZOT_VERSION:-v0.2.29}\" && VERSION=\"\${ZOT_BUILD_VERSION#v}\" make build)"
         echo "       Or set COLIBRI_STAGE_AGENT=NO to skip agent staging."
         exit 1
     fi
diff --git a/docs/LIVE-COLIBRI-REBUILD.md b/docs/LIVE-COLIBRI-REBUILD.md
index 046a0ccc..9a6f5a8b 100644
--- a/docs/LIVE-COLIBRI-REBUILD.md
+++ b/docs/LIVE-COLIBRI-REBUILD.md
@@ -193,8 +193,9 @@ fi
 cd zot-build
 git fetch --prune origin
 git checkout v0.2.29          # the zot tag this image ships (see build-manifest.json)
-
-go build -trimpath -o bin/zot ./cmd/zot
+ZOT_BUILD_VERSION="${ZOT_VERSION:-v0.2.29}"
+VERSION="${ZOT_BUILD_VERSION#v}" make build
+./bin/zot --version
 ```
 
 Install into the running USB (privileged steps via `mdo`):
diff --git a/docs/RELEASE-BUILD-RUNBOOK.md b/docs/RELEASE-BUILD-RUNBOOK.md
index 73dc3657..bdf9575b 100644
--- a/docs/RELEASE-BUILD-RUNBOOK.md
+++ b/docs/RELEASE-BUILD-RUNBOOK.md
@@ -84,7 +84,9 @@ cargo clippy --workspace --all-targets -- -D warnings
 # zot agent binary (native FreeBSD build)
 cd ../zot
 git checkout v0.2.29                          # the release tag
-go build -trimpath -o bin/zot ./cmd/zot
+ZOT_BUILD_VERSION="${ZOT_VERSION:-v0.2.29}"
+VERSION="${ZOT_BUILD_VERSION#v}" make build
+./bin/zot --version                            # expect: zot 0.2.29
 
 cd ../clawdie-iso
 ```
diff --git a/scripts/stage-zot-iso.sh b/scripts/stage-zot-iso.sh
index 04181358..96126f45 100755
--- a/scripts/stage-zot-iso.sh
+++ b/scripts/stage-zot-iso.sh
@@ -4,7 +4,8 @@
 # zot is the agent-harness consolidation target (one static Go binary). It has no
 # FreeBSD release, so build it on the host first and point ZOT_ARTIFACT_DIR here:
 #   (cd ../zot && git checkout "$ZOT_VERSION" \
-#       && GOOS=freebsd GOARCH=amd64 go build -trimpath -o bin/zot ./cmd/zot)
+#       && ZOT_BUILD_VERSION="${ZOT_VERSION:-v0.2.29}" \
+#       && VERSION="${ZOT_BUILD_VERSION#v}" make build)
 #
 # Credentials: zot resolves provider keys as --api-key -> provider env var ->
 # $ZOT_HOME/auth.json. This stages auth.json (DeepSeek) under the operator's
@@ -35,7 +36,7 @@ ZOT_HOME="${OP_HOME}/${ZOT_HOME_REL}"
 
 if [ ! -x "${BIN_SRC}" ]; then
     echo "missing executable zot artifact: ${BIN_SRC}" >&2
-    echo "hint: (cd \$ZOT_REPO && GOOS=freebsd GOARCH=amd64 go build -trimpath -o bin/zot ./cmd/zot)" >&2
+    echo "hint: (cd \$ZOT_REPO && ZOT_BUILD_VERSION=\"\${ZOT_VERSION:-v0.2.29}\" && VERSION=\"\${ZOT_BUILD_VERSION#v}\" make build)" >&2
     exit 66
 fi