diff --git a/.gitea/workflows/build-kernel.yml b/.gitea/workflows/build-kernel.yml
index 7add102..09c47fd 100644
--- a/.gitea/workflows/build-kernel.yml
+++ b/.gitea/workflows/build-kernel.yml
@@ -51,23 +51,31 @@ jobs:
           if [ ! -e /proc/sys/fs/binfmt_misc/qemu-aarch64 ]; then
             docker run --privileged --rm tonistiigi/binfmt --install arm64
           fi
+          # Per-version image tag. The matrix entries can run concurrently on a
+          # single runner sharing one Docker daemon; a fixed tag (e.g. iec-kbuild)
+          # is then a shared mutable name and the builds race — whichever `docker
+          # build` finishes last wins the tag, so both `docker create` calls
+          # resolve to the same image and every job emits the same vermagic.
+          # A unique tag per kernel version isolates them.
+          img="iec-kbuild:${KERNEL_VERSION//[:\/]/-}"
           # Builder image: toolchain + matching raspberrypi kernel headers.
           docker build --platform linux/arm64 \
             --build-arg DEBIAN_SUITE="$DEBIAN_SUITE" \
             --build-arg HEADERS_PKG="$HEADERS_PKG" \
             --build-arg KERNEL_VERSION="$KERNEL_VERSION" \
-            -t iec-kbuild .
+            -t "$img" .
           # Compile inside the container. We use `docker cp` instead of the bind
           # mount that build-in-docker.sh uses for local builds: under the runner's
           # docker-in-docker, /workspace is a volume the host daemon can't see, so
           # `-v "$PWD:/build"` mounts an empty dir and make finds no Makefile.
-          cid=$(docker create --platform linux/arm64 --entrypoint sleep iec-kbuild infinity)
+          cid=$(docker create --platform linux/arm64 --entrypoint sleep "$img" infinity)
           docker start "$cid"
           docker cp ./. "$cid:/build"
           docker exec "$cid" /usr/local/bin/docker-entrypoint.sh clean
           docker exec "$cid" /usr/local/bin/docker-entrypoint.sh
           docker cp "$cid:/build/iec_listener.ko" ./iec_listener.ko
           docker rm -f "$cid"
+          docker rmi "$img" || true
 
       - name: Stage build output (modules/iec_listener_<kernel_version>.ko)
         working-directory: kernel