diff --git a/Dockerfile b/Dockerfile
index 36b873fdf..3622db85b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -49,10 +49,18 @@ RUN go mod download
 COPY . .
 
 # see build_docker.sh
-ARG goflags_arg=""
-ENV GOFLAGS=$goflags_arg
+ARG VERSION_LONG=""
+ENV VERSION_LONG=$VERSION_LONG
+ARG VERSION_SHORT=""
+ENV VERSION_SHORT=$VERSION_SHORT
+ARG VERSION_GIT_HASH=""
+ENV VERSION_GIT_HASH=$VERSION_GIT_HASH
 
-RUN go install -v ./cmd/...
+RUN go install -tags=xversion -ldflags="\
+      -X tailscale.com/version.Long=$VERSION_LONG \
+      -X tailscale.com/version.Short=$VERSION_SHORT \
+      -X tailscale.com/version.GitCommit=$VERSION_GIT_HASH" \
+      -v ./cmd/...
 
 FROM alpine:3.11
 RUN apk add --no-cache ca-certificates iptables iproute2
diff --git a/build_docker.sh b/build_docker.sh
index 29dd99f46..5ec9729ea 100755
--- a/build_docker.sh
+++ b/build_docker.sh
@@ -27,5 +27,8 @@ set -eu
 
 eval $(./version/version.sh)
 
-GOFLAGS='-tags xversion -ldflags '"-X tailscale.com/version.Long=${VERSION_LONG} -X tailscale.com/version.Short=${VERSION_SHORT} -X tailscale.com/version.GitCommit=${VERSION_GIT_HASH}"
-docker build --build-arg goflags_arg="'""${GOFLAGS}""'" -t tailscale:tailscale .
+docker build \
+  --build-arg VERSION_LONG=$VERSION_LONG \
+  --build-arg VERSION_SHORT=$VERSION_SHORT \
+  --build-arg VERSION_GIT_HASH=$VERSION_GIT_HASH \
+  -t tailscale:tailscale .