diff --git a/modules/dashboard.nix b/modules/dashboard.nix
index 847b523..2f4f7bd 100644
--- a/modules/dashboard.nix
+++ b/modules/dashboard.nix
@@ -10,9 +10,15 @@ let
     cp ${../dashboard/dashboard.py} $out/app/dashboard.py
   '';
 
+  # Content-derived tag: changes whenever dashboard.py changes, so `docker stack deploy` actually
+  # rolls the service to the new image (a fixed `:latest` tag + unchanged stack spec does NOT roll —
+  # swarm sees no change). Reproducible + self-healing.
+  imageTag = builtins.substring 0 12 (builtins.hashString "sha256"
+    (builtins.readFile ../dashboard/dashboard.py));
+
   image = pkgs.dockerTools.buildLayeredImage {
     name = "cc-ci-dashboard";
-    tag = "latest";
+    tag = imageTag;
     contents = [ pkgs.python3 pkgs.cacert dashApp ];
     config = {
       Cmd = [ "${pkgs.python3}/bin/python3" "/app/dashboard.py" ];
@@ -25,7 +31,7 @@ let
     version: "3.8"
     services:
       app:
-        image: cc-ci-dashboard:latest
+        image: cc-ci-dashboard:${imageTag}
         environment:
           - DRONE_URL=https://drone.ci.commoninternet.net
           - CI_REPO=recipe-maintainers/cc-ci