@@ -156,6 +156,12 @@ jobs:
       # keep their plain names.
       CODER_BOX_PR_TITLE: ${{ github.event.pull_request.title }}
       CODER_BOX_PR_NUMBER: ${{ github.event.pull_request.number }}
+      # Branch name for the boot-screen label's "<short-sha>@<branch>" stamp. A
+      # PR checkout is a detached HEAD (so the Makefile's `git rev-parse
+      # --abbrev-ref HEAD` would say "HEAD"); github.head_ref is the real source
+      # branch on pull_request events and empty otherwise (the Makefile then
+      # falls back to the local branch name).
+      CODER_BOX_BRANCH: ${{ github.head_ref }}
     strategy:
       fail-fast: false
       matrix:
 
@@ -86,6 +86,13 @@ NIX_OUTPUT_FLAGS ?=
 # checkout (the module then falls back to self.rev / "unknown").
 GIT_REV := $(shell git rev-parse HEAD 2>/dev/null)$(shell git diff-index --quiet HEAD -- 2>/dev/null || echo -dirty)
 
+# Git branch injected into images alongside the rev, for the boot-screen label's
+# "<short-sha>@<branch>" stamp (coderBox.branch). Prefer an explicit
+# CODER_BOX_BRANCH (CI sets it from github.head_ref, since a PR checkout is a
+# detached HEAD where `rev-parse --abbrev-ref HEAD` would just say "HEAD"); fall
+# back to the local branch name. Empty/"HEAD" is dropped from the label.
+GIT_BRANCH := $(or $(CODER_BOX_BRANCH),$(shell git rev-parse --abbrev-ref HEAD 2>/dev/null))
+
 # Optional PR title + number woven into the image's pretty version name
 # (boot-menu label + ISO file name) via coderBox.prTitle / coderBox.prNumber.
 # Not injected through the Nix expression (an arbitrary title would need
@@ -134,7 +141,7 @@ iso_comp_field = $(if $(ISO_COMPRESSION),isoImage.squashfsCompression = "$(ISO_C
 #   $(1) = host                 (nixosConfigurations.<host>)
 #   $(2) = arch token           (empty = builder's native arch)
 #   $(3) = extra module fields  (nix attrset body, may be empty)
-box_cfg = let f = builtins.getFlake (toString ./.); in (f.nixosConfigurations.$(1).extendModules { modules = [ { nixpkgs.hostPlatform = "$(if $(2),$(call norm_arch,$(2)),$${builtins.currentSystem})"; coderBox.rev = "$(GIT_REV)"; $(3) } ]; }).config.system.build
+box_cfg = let f = builtins.getFlake (toString ./.); in (f.nixosConfigurations.$(1).extendModules { modules = [ { nixpkgs.hostPlatform = "$(if $(2),$(call norm_arch,$(2)),$${builtins.currentSystem})"; coderBox.rev = "$(GIT_REV)"; coderBox.branch = "$(GIT_BRANCH)"; $(3) } ]; }).config.system.build
 
 define box_build
 	@mkdir -p out
 
@@ -35,64 +35,64 @@
   boot.loader.systemd-boot.enable = lib.mkForce false;
   boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
 
-  # ── Show the PR identity on the boot screen (PR-preview builds only) ──────────
-  # A PR title can't live in the boot-menu entry: that entry is a single,
-  # non-wrapping line in a fixed-width GRUB/isolinux menu, so a long title
+  # ── Show the build identity on the boot screen as a footer label ─────────────
+  # The boot-menu ENTRY can't carry the build identity: it's a single,
+  # non-wrapping line in a fixed-width GRUB/isolinux menu, so a long PR title
   # overflows and gets clipped (and widening the menu makes it span the whole
-  # screen). Instead, for a PR-preview build, surface the full "PR #N: <title>"
-  # as a standalone GRUB *label* — boot-screen chrome, not a selectable entry —
-  # shown as a footer UNDER the menu.
+  # screen). Instead, render coderBox.bootLabel — e.g.
+  # "Coder Box - PR #46: <title> (abc123@branch)", or just
+  # "Coder Box - abc123@branch" with no PR — as a standalone GRUB *label*
+  # (boot-screen chrome, not a selectable entry) shown as a footer UNDER the menu.
+  # The label is ALWAYS present (every build has a commit/branch), so this also
+  # makes the footer visible on local/non-PR builds, not just CI PR previews.
   #
   # Key gotcha: the stock theme's boot_menu fills almost the whole height with an
   # opaque white pixmap (boot_menu_*.png), and GRUB paints that box OVER any
   # label that overlaps it — so a footer placed inside the box is invisible. The
   # menu only has a handful of entries, so we shrink boot_menu's height to free
-  # the lower third of the screen, then place the label there on the plain
+  # the lower area of the screen, then place the label there on the plain
   # background (dark text, good contrast). The menu WIDTH is untouched (still the
   # stock 800px), so the menu doesn't blow up horizontally like the earlier
   # full-width experiment. EFI/GRUB only; the BIOS/isolinux text menu has no
   # theme, so there the identity is available off-menu via /etc/coder-box-pr +
-  # the installer console banner. Non-PR builds use the stock theme untouched.
+  # the installer console banner.
   #
   # substituteInPlace uses --replace-fail so a future nixpkgs theme reflow fails
   # the build loudly instead of silently dropping the footer.
   isoImage.grubTheme =
     let
-      inherit (config.coderBox) prFull;
+      inherit (config.coderBox) bootLabel;
       # theme.txt wraps the text in double quotes; neutralise quotes/backslashes
       # so an arbitrary title can't break the theme parser.
-      prFullThemeSafe = builtins.replaceStrings [ "\"" "\\" ] [ "'" "" ] prFull;
+      bootLabelThemeSafe = builtins.replaceStrings [ "\"" "\\" ] [ "'" "" ] bootLabel;
     in
-    if prFull == "" then
-      pkgs.nixos-grub2-theme
-    else
-      pkgs.runCommand "coder-box-grub2-theme-pr" { } ''
-        cp -r ${pkgs.nixos-grub2-theme} "$out"
-        chmod -R u+w "$out"
+    pkgs.runCommand "coder-box-grub2-theme" { } ''
+      cp -r ${pkgs.nixos-grub2-theme} "$out"
+      chmod -R u+w "$out"
 
-        # 1) Shrink the menu box so its opaque pixmap stops at ~62% of the screen,
-        #    leaving the lower area free for the footer (stock fills to the
-        #    progress bar and would cover it).
-        substituteInPlace "$out/theme.txt" \
-          --replace-fail 'height = 100%-3%-100-3%-3%-32-3%' 'height = 62%-100-6%'
+      # 1) Shrink the menu box so its opaque pixmap stops at ~62% of the screen,
+      #    leaving the lower area free for the footer (stock fills to the
+      #    progress bar and would cover it).
+      substituteInPlace "$out/theme.txt" \
+        --replace-fail 'height = 100%-3%-100-3%-3%-32-3%' 'height = 62%-100-6%'
 
-        # 2) Footer label in the freed area, centred horizontally, just above the
-        #    timeout progress bar (which lives at ~95%). Quoted heredoc so the
-        #    build shell does no expansion; the PR text is already substituted by
-        #    Nix (and quote/backslash-sanitised).
-        cat >> "$out/theme.txt" <<'EOF'
+      # 2) Footer label in the freed area, centred horizontally, above the
+      #    timeout progress bar (which lives at ~95%). Quoted heredoc so the
+      #    build shell does no expansion; the text is already substituted by Nix
+      #    (and quote/backslash-sanitised).
+      cat >> "$out/theme.txt" <<'EOF'
 
-        + label {
-        	top = 78%
-        	left = 5%
-        	width = 90%
-        	align = "center"
-        	color = "#232627"
-        	font = "DejaVu Regular"
-        	text = "${prFullThemeSafe}"
-        }
-        EOF
-      '';
+      + label {
+      	top = 78%
+      	left = 5%
+      	width = 90%
+      	align = "center"
+      	color = "#232627"
+      	font = "DejaVu Regular"
+      	text = "${bootLabelThemeSafe}"
+      }
+      EOF
+    '';
 
   # Tools install.sh expects at runtime, shipped in the base layer so every ISO
   # flavour (installer + appliance) has them:
 
@@ -34,7 +34,12 @@ let
   # The PR identity is surfaced off-menu instead: recorded at /etc/coder-box-pr
   # and printed by the installer console banner (see prFull / ../installer/iso.nix).
   # Empty for tag/main/local builds.
-  inherit (config.coderBox) prTitle prNumber;
+  inherit (config.coderBox)
+    prTitle
+    prNumber
+    rev
+    branch
+    ;
 
   # Flatten newlines so the identity stays a single line in the file / banner.
   prTitleClean = builtins.replaceStrings [ "\n" ] [ " " ] prTitle;
@@ -43,6 +48,32 @@ let
   # Full PR identity for off-menu surfaces (baked image record + installer
   # console banner): "PR #46: <full title>". Empty for non-PR builds.
   prFull = lib.optionalString (prTitle != "") "PR${prNumMenu}: ${prTitleClean}";
+
+  # Short build revision for the human-facing version stamp (full 40-char hashes
+  # are unwieldy on the boot screen). Keep the "-dirty" suffix if present.
+  revShort =
+    if rev == "unknown" || rev == "" then
+      "unknown"
+    else
+      let
+        dirty = lib.hasSuffix "-dirty" rev;
+        bare = lib.removeSuffix "-dirty" rev;
+      in
+      builtins.substring 0 12 bare + lib.optionalString dirty "-dirty";
+
+  # A detached-HEAD checkout (the default for GitHub Actions' PR builds) reports
+  # branch "HEAD", which is noise — treat it like an unknown branch and drop it.
+  branchClean = if branch == "HEAD" || branch == "unknown" then "" else branch;
+
+  # Version stamp woven into the boot-screen label, using the conventional
+  # "<short-sha>@<branch>" form (branch omitted when unknown/detached).
+  versionStamp = revShort + lib.optionalString (branchClean != "") "@${branchClean}";
+
+  # Boot-screen label (the GRUB footer in ../base/iso.nix). ALWAYS present so the
+  # image's identity is visible on the boot screen regardless of build type:
+  #   with a PR:    "Coder Box - PR #46: <title> (<short-sha>@<branch>)"
+  #   without a PR: "Coder Box - <short-sha>@<branch>"
+  bootLabel = "Coder Box - " + (if prFull != "" then "${prFull} (${versionStamp})" else versionStamp);
 in
 {
   imports = [
@@ -70,6 +101,17 @@ in
     description = "Git revision this Coder box image was built from.";
   };
 
+  # Git branch this image was built from, woven into the boot-screen label as
+  # "<short-sha>@<branch>". Like coderBox.rev, the Makefile injects it (path
+  # flakerefs carry no git metadata); CI can also set CODER_BOX_BRANCH for PR
+  # builds where the checkout is a detached HEAD. Empty/"HEAD" is treated as
+  # unknown and dropped from the label.
+  options.coderBox.branch = lib.mkOption {
+    type = lib.types.str;
+    default = builtins.getEnv "CODER_BOX_BRANCH";
+    description = "Git branch this Coder box image was built from (woven into the boot-screen label when known).";
+  };
+
   # PR title for a pull-request preview build. CI sets it via the
   # CODER_BOX_PR_TITLE environment variable (read here under `--impure`, which
   # every image build already uses), so an arbitrary title never has to be
@@ -104,6 +146,17 @@ in
     description = "Full PR identity (number + untruncated title) for off-menu surfaces (empty for non-PR builds).";
   };
 
+  # Boot-screen label (the GRUB footer in ../base/iso.nix), e.g.
+  # "Coder Box - PR #46: <title> (abc123def456@my-branch)" or, without a PR,
+  # "Coder Box - abc123def456@my-branch". Always non-empty.
+  options.coderBox.bootLabel = lib.mkOption {
+    type = lib.types.str;
+    internal = true;
+    readOnly = true;
+    default = bootLabel;
+    description = "Boot-screen footer label (build identity: PR + short-sha@branch); always present.";
+  };
+
   config = {
 
     # ── Bake the repo into the image at /etc/nixos-repo ──────────────────────────