diff --git a/Makefile b/Makefile
index ebfd2e7a..4fd12949 100644
--- a/Makefile
+++ b/Makefile
@@ -81,10 +81,8 @@ endif
 CONTAINER_GOSRC = /src/github.com/containers/skopeo
 CONTAINER_RUN ?= $(CONTAINER_CMD) --security-opt label=disable -v $(CURDIR):$(CONTAINER_GOSRC) -w $(CONTAINER_GOSRC) $(SKOPEO_CIDEV_CONTAINER_FQIN)
 
-GIT_COMMIT := $(shell GIT_CEILING_DIRECTORIES=$$(cd ..; pwd) git rev-parse HEAD 2> /dev/null || true)
-
 EXTRA_LDFLAGS ?=
-SKOPEO_LDFLAGS := -ldflags '-X main.gitCommit=${GIT_COMMIT} $(EXTRA_LDFLAGS)'
+SKOPEO_LDFLAGS := -ldflags '$(EXTRA_LDFLAGS)'
 
 MANPAGES_MD = $(wildcard docs/*.md)
 MANPAGES ?= $(MANPAGES_MD:%.md=%)
diff --git a/cmd/skopeo/main.go b/cmd/skopeo/main.go
index 13670687..36bdecb8 100644
--- a/cmd/skopeo/main.go
+++ b/cmd/skopeo/main.go
@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"fmt"
+	"runtime/debug"
 	"strings"
 	"time"
 
@@ -15,10 +16,6 @@ import (
 	"go.podman.io/storage/pkg/reexec"
 )
 
-// gitCommit will be the hash that the binary was built from
-// and will be populated by the Makefile
-var gitCommit = ""
-
 var defaultUserAgent = "skopeo/" + version.Version
 
 type globalOptions struct {
@@ -70,8 +67,10 @@ func createApp() (*cobra.Command, *globalOptions) {
 		// (skopeo --tls-verify inspect) (causes a warning) and (skopeo inspect --tls-verify) (no warning).
 		TraverseChildren: true,
 	}
-	if gitCommit != "" {
-		rootCommand.Version = fmt.Sprintf("%s commit: %s", version.Version, gitCommit)
+	// We don’t use debug.ReadBuildInfo to automate version.Version, because that would not work well for builds from
+	// a released tarball (e.g. RPM builds).
+	if commit := gitCommit(); commit != "" {
+		rootCommand.Version = fmt.Sprintf("%s commit: %s", version.Version, commit)
 	} else {
 		rootCommand.Version = version.Version
 	}
@@ -112,6 +111,20 @@ func createApp() (*cobra.Command, *globalOptions) {
 	return rootCommand, &opts
 }
 
+// gitCommit returns the git commit for this codebase, if we are built from a git repo; "" otherwise.
+func gitCommit() string {
+	bi, ok := debug.ReadBuildInfo()
+	if !ok {
+		logrus.Fatal("runtime.ReadBuildInfo failed")
+	}
+	for _, e := range bi.Settings {
+		if e.Key == "vcs.revision" {
+			return e.Value
+		}
+	}
+	return ""
+}
+
 // before is run by the cli package for any command, before running the command-specific handler.
 func (opts *globalOptions) before(cmd *cobra.Command, args []string) error {
 	if opts.debug {
diff --git a/go.mod b/go.mod
index 9d4524be..60b25fc0 100644
--- a/go.mod
+++ b/go.mod
@@ -1,7 +1,7 @@
 module github.com/containers/skopeo
 
 // Minimum required golang version
-go 1.23.3
+go 1.24.0
 
 // Warning: Ensure the "go" and "toolchain" versions match exactly to prevent unwanted auto-updates
 
diff --git a/integration/signing_test.go b/integration/signing_test.go
index e5fa5748..4a6a9a16 100644
--- a/integration/signing_test.go
+++ b/integration/signing_test.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
 	"os"
@@ -29,9 +30,8 @@ type signingSuite struct {
 var _ = suite.SetupAllSuite(&signingSuite{})
 
 func findFingerprint(lineBytes []byte) (string, error) {
-	lines := string(lineBytes)
-	for _, line := range strings.Split(lines, "\n") {
-		fields := strings.Split(line, ":")
+	for line := range bytes.SplitSeq(lineBytes, []byte{'\n'}) {
+		fields := strings.Split(string(line), ":")
 		if len(fields) >= 10 && fields[0] == "fpr" {
 			return fields[9], nil
 		}
diff --git a/integration/sync_test.go b/integration/sync_test.go
index b17009be..981ef669 100644
--- a/integration/sync_test.go
+++ b/integration/sync_test.go
@@ -381,7 +381,7 @@ quay.io:
 	// get the number of tags
 	re := regexp.MustCompile(`^ +- +[^:/ ]+`)
 	var nTags int
-	for _, l := range strings.Split(yamlConfig, "\n") {
+	for l := range strings.SplitSeq(yamlConfig, "\n") {
 		if re.MatchString(l) {
 			nTags++
 		}