diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index cf98a6a86fa4..8a69dc4986e9 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -28,8 +28,14 @@ jobs:
 
       - name: Inspect builder
         run: docker buildx inspect
-      
+
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
       - name: Extract version from pyproject.toml
+        # Note: explicitly requesting bash will mean bash is invoked with `-eo pipefail`, see
+        # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell
+        shell: bash
         run: |
           echo "SYNAPSE_VERSION=$(grep "^version" pyproject.toml | sed -E 's/version\s*=\s*["]([^"]*)["]/\1/')" >> $GITHUB_ENV
 
diff --git a/changelog.d/16009.docker b/changelog.d/16009.docker
new file mode 100644
index 000000000000..7fd9707deb35
--- /dev/null
+++ b/changelog.d/16009.docker
@@ -0,0 +1 @@
+Add `org.opencontainers.image.version` labels to Docker containers [published by Matrix.org](https://hub.docker.com/r/matrixdotorg/synapse). Contributed by Mo Balaa.