diff --git a/.github/workflows/_publish_image_reusable.yml b/.github/workflows/_publish_image_reusable.yml
index 8802024..4964125 100644
--- a/.github/workflows/_publish_image_reusable.yml
+++ b/.github/workflows/_publish_image_reusable.yml
@@ -230,6 +230,10 @@ jobs:
     needs: prepare
     if: ${{ needs.prepare.outputs.need_update == 'true' }}
     runs-on: ubuntu-latest
+    env:
+      IMAGE_LABELS: |
+        org.opencontainers.image.revision=${{ needs.prepare.outputs.source_sha }}
+        org.opencontainers.image.source=https://github.com/${{ inputs.source_repository }}
     strategy:
       fail-fast: false
       matrix:
@@ -349,6 +353,7 @@ jobs:
         platforms: linux/amd64
         load: true
         tags: ${{ steps.params.outputs.image_url }}
+        labels: ${{ env.IMAGE_LABELS }}
         cache-from: ${{ steps.params.outputs.cache_from }}
         cache-to: ${{ steps.params.outputs.cache_to_min }}
         build-args: ${{ inputs.mvn_args }}
@@ -362,6 +367,7 @@ jobs:
         platforms: linux/amd64
         load: true
         tags: ${{ steps.params.outputs.image_url }}
+        labels: ${{ env.IMAGE_LABELS }}
         cache-from: ${{ steps.params.outputs.cache_from }}
         cache-to: ${{ steps.params.outputs.cache_to_min }}
 
@@ -392,6 +398,7 @@ jobs:
         platforms: ${{ steps.params.outputs.platforms }}
         push: ${{ needs.prepare.outputs.publish_images == 'true' }}
         tags: ${{ steps.params.outputs.image_url }}
+        labels: ${{ env.IMAGE_LABELS }}
         cache-from: ${{ steps.params.outputs.cache_from }}
         cache-to: ${{ steps.params.outputs.cache_to_max }}
         build-args: ${{ inputs.mvn_args }}
@@ -405,6 +412,7 @@ jobs:
         platforms: ${{ steps.params.outputs.platforms }}
         push: ${{ needs.prepare.outputs.publish_images == 'true' }}
         tags: ${{ steps.params.outputs.image_url }}
+        labels: ${{ env.IMAGE_LABELS }}
         cache-from: ${{ steps.params.outputs.cache_from }}
         cache-to: ${{ steps.params.outputs.cache_to_max }}
 
diff --git a/README.md b/README.md
index 1a97a27..57d7422 100644
--- a/README.md
+++ b/README.md
@@ -205,6 +205,7 @@ Reusable workflows are the real implementation layer.
 - selecting per-module build settings from `build_matrix_json`
 - enabling QEMU and Buildx when needed
 - running optional smoke tests
+- stamping `org.opencontainers.image.revision` and `org.opencontainers.image.source` with the resolved source commit and repository
 - pushing the final image
 - updating the latest-hash variable for `latest` mode only