diff --git a/Makefile b/Makefile
index 6f9d2335f..232722671 100644
--- a/Makefile
+++ b/Makefile
@@ -56,6 +56,8 @@ ARCH := $(if $(GOARCH),$(GOARCH),$(shell go env GOARCH))
 GO_VERSION       ?= 1.17
 BUILD_IMAGE      ?= appscode/golang-dev:$(GO_VERSION)
 
+RESTIC_VER  := 0.12.1
+
 OUTBIN = bin/$(BIN)-$(OS)-$(ARCH)
 ifeq ($(OS),windows)
   OUTBIN := bin/$(BIN)-$(OS)-$(ARCH).exe
@@ -156,6 +158,7 @@ $(OUTBIN): .go/$(OUTBIN).stamp
 	        git_tag=$(git_tag)                                  \
 	        commit_hash=$(commit_hash)                          \
 	        commit_timestamp=$(commit_timestamp)                \
+	        RESTIC_VER=$(RESTIC_VER)                            \
 	        ./hack/build.sh                                     \
 	    "
 	@if ! cmp -s .go/bin/$(OS)_$(ARCH)/$(BIN) $(OUTBIN); then   \
diff --git a/hack/build.sh b/hack/build.sh
index 8b4e22ad3..d33149ce2 100755
--- a/hack/build.sh
+++ b/hack/build.sh
@@ -29,6 +29,11 @@ if [ -z "${VERSION:-}" ]; then
     exit 1
 fi
 
+if [ -z "${RESTIC_VER:-}" ]; then
+    echo "RESTIC_VER must be set"
+    exit 1
+fi
+
 export CGO_ENABLED=0
 export GOARCH="${ARCH}"
 export GOOS="${OS}"
@@ -47,5 +52,6 @@ go install \
       -X main.GoVersion=$(go version | cut -d " " -f 3) \
       -X main.Compiler=$(go env CC)                     \
       -X main.Platform=${OS}/${ARCH}                    \
+      -X stash.appscode.dev/cli/pkg.ResticTag=${RESTIC_VER} \
     " \
     ./...
diff --git a/pkg/cli.go b/pkg/cli.go
index d58e40e80..afe498529 100644
--- a/pkg/cli.go
+++ b/pkg/cli.go
@@ -40,14 +40,21 @@ type cliLocalDirectories struct {
 	downloadDir string // user provided or, current working dir
 }
 
+// These variables will be set during build time
 var (
-	imgRestic = docker_image.Docker{
-		Registry: "restic",
-		Image:    "restic",
-		Tag:      "0.9.5", // TODO: update default release tag
-	}
+	ResticRegistry = "restic"
+	ResticImage    = "restic"
+	ResticTag      = "latest"
 )
 
+var imgRestic docker_image.Docker
+
+func init() {
+	imgRestic.Registry = ResticRegistry
+	imgRestic.Image = ResticImage
+	imgRestic.Tag = ResticTag
+}
+
 func (localDirs *cliLocalDirectories) prepareSecretDir(tempDir string, secret *core.Secret) error {
 	// write repository secrets in a sub-dir insider tempDir
 	localDirs.secretDir = filepath.Join(tempDir, secretDirName)