diff --git a/.github/macos-installer/Makefile b/.github/macos-installer/Makefile
index 3e1d60dcbeb2ef..1a06f6200e62dc 100644
--- a/.github/macos-installer/Makefile
+++ b/.github/macos-installer/Makefile
@@ -21,7 +21,7 @@ GIT_PREFIX := $(PREFIX)/git
 BUILD_DIR := $(GITHUB_WORKSPACE)/payload
 DESTDIR := $(PWD)/stage/git-$(ARCH_UNIV)-$(VERSION)
 ARTIFACTDIR := build-artifacts
-SUBMAKE := $(MAKE) C_INCLUDE_PATH="$(C_INCLUDE_PATH)" CPLUS_INCLUDE_PATH="$(CPLUS_INCLUDE_PATH)" LD_LIBRARY_PATH="$(LD_LIBRARY_PATH)" TARGET_FLAGS="$(TARGET_FLAGS)" CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" NO_GETTEXT=1 NO_DARWIN_PORTS=1 prefix=$(GIT_PREFIX) DESTDIR=$(DESTDIR)
+SUBMAKE := $(MAKE) C_INCLUDE_PATH="$(C_INCLUDE_PATH)" CPLUS_INCLUDE_PATH="$(CPLUS_INCLUDE_PATH)" LD_LIBRARY_PATH="$(LD_LIBRARY_PATH)" TARGET_FLAGS="$(TARGET_FLAGS)" CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" NO_GETTEXT=1 NO_DARWIN_PORTS=1 prefix=$(GIT_PREFIX) GIT_BUILT_FROM_COMMIT="$(GIT_BUILT_FROM_COMMIT)" DESTDIR=$(DESTDIR)
 CORES := $(shell bash -c "sysctl hw.ncpu | awk '{print \$$2}'")
 
 # Guard against environment variables
diff --git a/.github/workflows/build-git-installers.yml b/.github/workflows/build-git-installers.yml
index bf8997b2402759..a8b5919328f5ba 100644
--- a/.github/workflows/build-git-installers.yml
+++ b/.github/workflows/build-git-installers.yml
@@ -430,6 +430,9 @@ jobs:
 
           make -C git -j$(sysctl -n hw.physicalcpu) GIT-VERSION-FILE dist dist-doc
 
+          export GIT_BUILT_FROM_COMMIT=$(gunzip -c git/git-$VERSION.tar.gz | git get-tar-commit-id) ||
+            die "Could not determine commit for build"
+
           # Extract tarballs
           mkdir payload manpages
           tar -xvf git/git-$VERSION.tar.gz -C payload
@@ -592,12 +595,80 @@ jobs:
             *.deb
   # End build and sign Debian package
 
+  # Validate installers
+  validate-installers:
+    name: Validate installers
+    strategy:
+      matrix:
+        component:
+          - os: ubuntu-latest
+            artifact: linux-artifacts
+            command: git
+          - os: macos-latest-xl-arm64
+            artifact: macos-artifacts
+            command: git
+          - os: macos-latest
+            artifact: macos-artifacts
+            command: git
+          - os: windows-latest
+            artifact: win-installer-x86_64
+            command: $PROGRAMFILES\Git\cmd\git.exe
+    runs-on: ${{ matrix.component.os }}
+    needs: [prereqs, windows_artifacts, create-macos-artifacts, create-linux-artifacts]
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v3
+        with:
+          name: ${{ matrix.component.artifact }}
+
+      - name: Install Windows
+        if: contains(matrix.component.os, 'windows')
+        shell: pwsh
+        run: |
+          $exePath = Get-ChildItem -Path ./*.exe | %{$_.FullName}
+          Start-Process -Wait -FilePath "$exePath" -ArgumentList "/SILENT /VERYSILENT /NORESTART /SUPPRESSMSGBOXES /ALLOWDOWNGRADE=1"
+
+      - name: Install Linux
+        if: contains(matrix.component.os, 'ubuntu')
+        run: |
+          debpath=$(find ./*.deb)
+          sudo apt install $debpath
+
+      - name: Install macOS
+        if: contains(matrix.component.os, 'macos')
+        run: |
+          # avoid letting Homebrew's `git` in `/opt/homebrew/bin` override `/usr/local/bin/git`
+          arch="$(uname -m)"
+          test arm64 != "$arch" ||
+          brew uninstall git
+
+          pkgpath=$(find ./*universal*.pkg)
+          sudo installer -pkg $pkgpath -target /
+
+      - name: Validate
+        shell: bash
+        run: |
+          "${{ matrix.component.command }}" --version | sed 's/git version //' >actual
+          echo ${{ needs.prereqs.outputs.tag_version }} >expect
+          cmp expect actual || exit 1
+
+      - name: Validate universal binary CPU architecture
+        if: contains(matrix.component.os, 'macos')
+        shell: bash
+        run: |
+          set -ex
+          git version --build-options >actual
+          cat actual
+          grep "cpu: $(uname -m)" actual
+  # End validate installers
+
   create-github-release:
     runs-on: ubuntu-latest
     permissions:
       contents: write
       id-token: write # required for Azure login via OIDC
     needs:
+      - validate-installers
       - create-linux-artifacts
       - create-macos-artifacts
       - windows_artifacts
diff --git a/.gitignore b/.gitignore
index 590ed70176abbe..c260a63e4be31d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 /fuzz_corpora
 /GIT-BUILD-DIR
 /GIT-BUILD-OPTIONS
+/GIT-BUILT-FROM-COMMIT
 /GIT-CFLAGS
 /GIT-LDFLAGS
 /GIT-PREFIX
diff --git a/Makefile b/Makefile
index c9747fb046f358..66e255447f0683 100644
--- a/Makefile
+++ b/Makefile
@@ -321,6 +321,10 @@ include shared.mak
 # Define GIT_USER_AGENT if you want to change how git identifies itself during
 # network interactions.  The default is "git/$(GIT_VERSION)".
 #
+# Define GIT_BUILT_FROM_COMMIT if you want to force the commit hash identified
+# in 'git version --build-options' to a specific value. The default is the
+# commit hash of the current HEAD.
+#
 # Define DEFAULT_HELP_FORMAT to "man", "info" or "html"
 # (defaults to "man") if you want to have a different default when
 # "git help" is called without a parameter specifying the format.
@@ -2384,6 +2388,15 @@ GIT-USER-AGENT: FORCE
 		echo '$(GIT_USER_AGENT_SQ)' >GIT-USER-AGENT; \
 	fi
 
+GIT_BUILT_FROM_COMMIT = $(eval GIT_BUILT_FROM_COMMIT := $$(shell \
+	GIT_CEILING_DIRECTORIES="$$(CURDIR)/.." \
+	git rev-parse -q --verify HEAD 2>/dev/null))$(GIT_BUILT_FROM_COMMIT)
+GIT-BUILT-FROM-COMMIT: FORCE
+	@if test x'$(GIT_BUILT_FROM_COMMIT)' != x"`cat GIT-BUILT-FROM-COMMIT 2>/dev/null`" ; then \
+		echo >&2 "    * new built-from commit"; \
+		echo '$(GIT_BUILT_FROM_COMMIT)' >GIT-BUILT-FROM-COMMIT; \
+	fi
+
 ifdef DEFAULT_HELP_FORMAT
 BASIC_CFLAGS += -DDEFAULT_HELP_FORMAT='"$(DEFAULT_HELP_FORMAT)"'
 endif
@@ -2521,13 +2534,11 @@ PAGER_ENV_CQ_SQ = $(subst ','\'',$(PAGER_ENV_CQ))
 pager.sp pager.s pager.o: EXTRA_CPPFLAGS = \
 	-DPAGER_ENV='$(PAGER_ENV_CQ_SQ)'
 
-version.sp version.s version.o: GIT-VERSION-FILE GIT-USER-AGENT
+version.sp version.s version.o: GIT-VERSION-FILE GIT-USER-AGENT GIT-BUILT-FROM-COMMIT
 version.sp version.s version.o: EXTRA_CPPFLAGS = \
 	'-DGIT_VERSION="$(GIT_VERSION)"' \
 	'-DGIT_USER_AGENT=$(GIT_USER_AGENT_CQ_SQ)' \
-	'-DGIT_BUILT_FROM_COMMIT="$(shell \
-		GIT_CEILING_DIRECTORIES="$(CURDIR)/.." \
-		git rev-parse -q --verify HEAD 2>/dev/null)"'
+	'-DGIT_BUILT_FROM_COMMIT="$(GIT_BUILT_FROM_COMMIT)"'
 
 $(BUILT_INS): git$X
 	$(QUIET_BUILT_IN)$(RM) $@ && \
@@ -3699,7 +3710,7 @@ dist: git-archive$(X) configure
 	@$(MAKE) -C git-gui TARDIR=../.dist-tmp-dir/git-gui dist-version
 	./git-archive --format=tar \
 		$(GIT_ARCHIVE_EXTRA_FILES) \
-		--prefix=$(GIT_TARNAME)/ HEAD^{tree} > $(GIT_TARNAME).tar
+		--prefix=$(GIT_TARNAME)/ HEAD > $(GIT_TARNAME).tar
 	@$(RM) -r .dist-tmp-dir
 	gzip -f -9 $(GIT_TARNAME).tar