diff --git a/build.rs b/build.rs
index 6fa5c07..9db6e18 100644
--- a/build.rs
+++ b/build.rs
@@ -18,11 +18,26 @@ fn main() -> Result<()> {
     // Supply information as compile-time environment variables.
     #[cfg(feature = "opa-runtime")]
     {
-        let output = std::process::Command::new("git")
-            .args(["rev-parse", "HEAD"])
-            .output()
-            .expect("`git rev-parse HEAD` failed.");
-        let git_hash = String::from_utf8(output.stdout).unwrap();
+        // Allow build systems (e.g. vcpkg, CI) to inject the commit hash directly
+        // via a GIT_HASH environment variable. If not set, attempt to read it from
+        // git. Fall back to "unknown" when git is unavailable or there is no .git
+        // directory (e.g. builds from source tarballs).
+        let git_hash = std::env::var("GIT_HASH").ok().unwrap_or_else(|| {
+            std::process::Command::new("git")
+                .args(["rev-parse", "HEAD"])
+                .output()
+                .ok()
+                .and_then(|o| {
+                    if o.status.success() {
+                        Some(o.stdout)
+                    } else {
+                        None
+                    }
+                })
+                .and_then(|bytes| String::from_utf8(bytes).ok())
+                .map(|s| s.trim().to_string())
+                .unwrap_or_else(|| "unknown".to_string())
+        });
         println!("cargo:rustc-env=GIT_HASH={git_hash}");
     }
 
diff --git a/src/builtins/opa.rs b/src/builtins/opa.rs
index 82811ee..c6bebeb 100644
--- a/src/builtins/opa.rs
+++ b/src/builtins/opa.rs
@@ -24,7 +24,7 @@ fn opa_runtime(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool)
 
     obj.insert(
         Value::String("commit".into()),
-        Value::String(env!("GIT_HASH").into()),
+        Value::String(option_env!("GIT_HASH").unwrap_or("").into()),
     );
 
     obj.insert(