diff --git a/Config.in b/Config.in
index 49f37390..f2875807 100644
--- a/Config.in
+++ b/Config.in
@@ -110,9 +110,10 @@ config INFIX_OEM_PATH
 	  directory (absolute path) and the Infix post-build.sh will call `git
 	  describe -C $INFIX_OEM_PATH`.
 
-	  Note: for release builds the global variable INFIX_RELEASE overrides
-	  the version information derived from `git describe`.  However, the
-	  GIT version is always saved as the BUILD_ID in /etc/os-releases.
+	  Note: the OS version (VERSION, VERSION_ID, BUILD_ID in
+	  /etc/os-release) is always derived from `git describe`.  The global
+	  variable INFIX_RELEASE does not change it; it only labels the release
+	  channel (IMAGE_VERSION) and names the published artifacts.
 
 endmenu
 
diff --git a/infix.mk b/infix.mk
index 788134c7..31fc52f1 100644
--- a/infix.mk
+++ b/infix.mk
@@ -4,10 +4,12 @@ oem-dir := $(call qstrip,$(INFIX_OEM_PATH))
 INFIX_TOPDIR = $(if $(oem-dir),$(oem-dir),$(BR2_EXTERNAL_INFIX_PATH))
 
 # Unless the user specifies an explicit build id, source it from git.
-# The build id also becomes the image version, unless an official
-# release is being built.
-export INFIX_BUILD_ID ?= $(shell git -C $(INFIX_TOPDIR) describe --dirty --always --tags)
-export INFIX_VERSION = $(if $(INFIX_RELEASE),$(INFIX_RELEASE),$(INFIX_BUILD_ID))
+# Exclude the moving 'latest*' tags so the version always resolves to a
+# real release tag, see issue #1524.  The build id is also the version
+# shown to users; INFIX_RELEASE only labels the release channel and names
+# artifacts (see INFIX_ARTIFACT below).
+export INFIX_BUILD_ID ?= $(shell git -C $(INFIX_TOPDIR) describe --dirty --always --tags --exclude 'latest*')
+export INFIX_VERSION = $(INFIX_BUILD_ID)
 export INFIX_ARTIFACT = $(call qstrip,$(INFIX_IMAGE_ID)$(if $(INFIX_RELEASE),-$(INFIX_RELEASE)))
 
 INFIX_CFLAGS:=-Wall -Werror -Wextra -Wno-unused-parameter -Wformat=2 -Wformat-overflow=2 -Winit-self -Wstrict-overflow=4 -Wno-format-truncation -Wno-format-nonliteral
diff --git a/src/confd/bin/gen-hostname b/src/confd/bin/gen-hostname
index 092ef24a..eb777220 100755
--- a/src/confd/bin/gen-hostname
+++ b/src/confd/bin/gen-hostname
@@ -2,26 +2,20 @@
 # Generate ietf-system.yang hostname based on:
 #  1. Command line argument + MAC suffix
 #  2. Specific hostname from qemu_fw_cfg, from Qeneth
-#  3. /etc/hostname from squashfs + MAC suffix
+#  3. Default hostname + MAC suffix
+#
+# The MAC suffix is emitted as the %m format specifier, expanded by confd
+# at apply time, so the actual MAC never ends up baked into a saved
+# configuration (issue #1554).
 #
 set -e
 
-gen()
-{
-    base_mac=$(jq -r '.["mac-address"]' /run/system.json)
-    if [ -z "$base_mac" ] || [ "$base_mac" = "null" ]; then
-	base_mac=00:00:00:00:00:00
-    fi
-
-    echo "$1-$(echo $base_mac | tail -c 9 | tr ':' '-')"
-}
-
 if [ "$1" ]; then
-    sysname=$(gen "$1")
+    sysname="$1-%m"
 elif [ -f "/sys/firmware/qemu_fw_cfg/by_name/opt/hostname/raw" ]; then
     sysname="$(cat /sys/firmware/qemu_fw_cfg/by_name/opt/hostname/raw)"
 else
-    sysname=$(gen "$(cat /etc/hostname)")
+    sysname="%h-%m"
 fi
 
 cat <<EOF