diff --git a/meson.build b/meson.build
index 2dc16b37ad..bebe105130 100644
--- a/meson.build
+++ b/meson.build
@@ -1988,11 +1988,12 @@ endif
 conf.set_quoted('VERSION_TAG', version_tag)
 
 vcs_tag = get_option('vcs-tag')
-version_h = vcs_tag(
+version_h = custom_target('version',
+        build_always_stale : vcs_tag,
         input : 'src/version/version.h.in',
         output : 'version.h',
-        fallback : '',
-        command : [vcs_tag ? 'tools/vcs-tag.sh' : 'true', get_option('mode')],
+        capture : true,
+        command : ['tools/vcs-tag.sh', '@INPUT@', get_option('mode'), vcs_tag ? '1' : '0'],
 )
 
 shared_lib_tag = get_option('shared-lib-tag')
diff --git a/mkosi/mkosi.images/build/mkosi.conf.d/arch/mkosi.build.chroot b/mkosi/mkosi.images/build/mkosi.conf.d/arch/mkosi.build.chroot
index 3e96080dd8..f7268e80f1 100755
--- a/mkosi/mkosi.images/build/mkosi.conf.d/arch/mkosi.build.chroot
+++ b/mkosi/mkosi.images/build/mkosi.conf.d/arch/mkosi.build.chroot
@@ -22,7 +22,7 @@ if ((LLVM)) && [[ -n "$SANITIZERS" ]]; then
     MKOSI_LDFLAGS="$MKOSI_LDFLAGS -Wl,-rpath=$(realpath "$(clang --print-runtime-dir)")"
 fi
 
-MKOSI_MESON_OPTIONS="-D mode=developer -D vcs-tag=${VCS_TAG:-true} -D b_sanitize=${SANITIZERS:-none}"
+MKOSI_MESON_OPTIONS="-D mode=developer -D vcs-tag=${VCS_TAG:-true} -D b_sanitize=${SANITIZERS:-none} -Dtime-epoch=1744207869"
 if ((WIPE)) && [[ -d "$BUILDDIR/meson-private" ]]; then
     MKOSI_MESON_OPTIONS="$MKOSI_MESON_OPTIONS --wipe"
 fi
diff --git a/mkosi/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.build.chroot b/mkosi/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.build.chroot
index 1d617cb7ce..fe96e997ea 100755
--- a/mkosi/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.build.chroot
+++ b/mkosi/mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.build.chroot
@@ -52,7 +52,7 @@ if ((LLVM)) && [[ -n "$SANITIZERS" ]]; then
     MKOSI_LDFLAGS="$MKOSI_LDFLAGS -Wl,-rpath=$(realpath "$(clang --print-runtime-dir)")"
 fi
 
-MKOSI_MESON_OPTIONS="-D mode=developer -D vcs-tag=${VCS_TAG:-true} -D b_sanitize=${SANITIZERS:-none}"
+MKOSI_MESON_OPTIONS="-D mode=developer -D vcs-tag=${VCS_TAG:-true} -D b_sanitize=${SANITIZERS:-none} -Dtime-epoch=1744207869"
 if ((WIPE)) && [[ -d "$BUILDDIR/meson-private" ]]; then
     MKOSI_MESON_OPTIONS="$MKOSI_MESON_OPTIONS --wipe"
 fi
diff --git a/mkosi/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.build.chroot b/mkosi/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.build.chroot
index 215f125675..49f70a511c 100755
--- a/mkosi/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.build.chroot
+++ b/mkosi/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.build.chroot
@@ -22,7 +22,7 @@ if ((LLVM)) && [[ -n "$SANITIZERS" ]]; then
     MKOSI_LDFLAGS="$MKOSI_LDFLAGS -Wl,-rpath=$(realpath "$(clang --print-runtime-dir)")"
 fi
 
-MKOSI_MESON_OPTIONS="-D mode=developer -D vcs-tag=${VCS_TAG:-true} -D b_sanitize=${SANITIZERS:-none}"
+MKOSI_MESON_OPTIONS="-D mode=developer -D vcs-tag=${VCS_TAG:-true} -D b_sanitize=${SANITIZERS:-none} -Dtime-epoch=1744207869"
 if ((WIPE)) && [[ -d "$BUILDDIR/meson-private" ]]; then
     MKOSI_MESON_OPTIONS="$MKOSI_MESON_OPTIONS --wipe"
 fi
diff --git a/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot b/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot
index 1ada7640c2..7b0e95e420 100755
--- a/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot
+++ b/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot
@@ -57,7 +57,7 @@ if [[ -z "${MKOSI_LDFLAGS// }" ]]; then
     MKOSI_LDFLAGS="%{nil}"
 fi
 
-MKOSI_MESON_OPTIONS="-D mode=developer -D vcs-tag=${VCS_TAG:-true} -D b_sanitize=${SANITIZERS:-none}"
+MKOSI_MESON_OPTIONS="-D mode=developer -D vcs-tag=${VCS_TAG:-true} -D b_sanitize=${SANITIZERS:-none} -Dtime-epoch=1744207869"
 if ((WIPE)) && [[ -d "$BUILDDIR/meson-private" ]]; then
     MKOSI_MESON_OPTIONS="$MKOSI_MESON_OPTIONS --wipe"
 fi
diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c
index ef501607b6..7e2cdd8c46 100644
--- a/src/core/exec-invoke.c
+++ b/src/core/exec-invoke.c
@@ -1854,7 +1854,7 @@ static int apply_protect_hostname(const ExecContext *c, const ExecParameters *p,
         }
 #endif
 
-        return 0;
+        return 1;
 }
 
 static void do_idle_pipe_dance(int idle_pipe[static 4]) {
@@ -4451,8 +4451,8 @@ static int setup_delegated_namespaces(
                 r = apply_protect_hostname(context, params, reterr_exit_status);
                 if (r < 0)
                         return r;
-
-                log_exec_debug(context, params, "Set up %sUTS namespace", delegate ? "delegated " : "");
+                if (r > 0)
+                        log_exec_debug(context, params, "Set up %sUTS namespace", delegate ? "delegated " : "");
         }
 
         return 0;
@@ -5467,8 +5467,8 @@ int exec_invoke(
                         *exit_status = EXIT_USER;
                         return log_exec_error_errno(context, params, r, "Failed to set up user namespacing: %m");
                 }
-
-                log_debug("Set up privileged user namespace");
+                if (r > 0)
+                        log_debug("Set up privileged user namespace");
         }
 
         /* Call setup_delegated_namespaces() the second time to unshare all delegated namespaces. */
diff --git a/tools/elf2efi.py b/tools/elf2efi.py
index cb1a284a60..a63d3fc98d 100755
--- a/tools/elf2efi.py
+++ b/tools/elf2efi.py
@@ -611,7 +611,7 @@ def elf2efi(args: argparse.Namespace):
 
     coff.Machine = pe_arch
     coff.NumberOfSections = len(sections)
-    coff.TimeDateStamp = int(os.environ.get("SOURCE_DATE_EPOCH", time.time()))
+    coff.TimeDateStamp = int(sde if (sde := os.environ.get("SOURCE_DATE_EPOCH")) else time.time())
     coff.SizeOfOptionalHeader = sizeof(opt)
     # EXECUTABLE_IMAGE|LINE_NUMS_STRIPPED|LOCAL_SYMS_STRIPPED|DEBUG_STRIPPED
     # and (32BIT_MACHINE or LARGE_ADDRESS_AWARE)
diff --git a/tools/vcs-tag.sh b/tools/vcs-tag.sh
index 0150d0b50e..f9575aeced 100755
--- a/tools/vcs-tag.sh
+++ b/tools/vcs-tag.sh
@@ -2,12 +2,13 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -e
 
-MODE="$1"
+INPUT="$1"
+MODE="$2"
+ENABLED="$3"
 
-if ! [[ -d .git ]] ||
-        ! command -v git >/dev/null ||
-        git describe --tags --exact-match &>/dev/null
+if ! ((ENABLED)) || ! [[ -d .git ]] || ! command -v git >/dev/null || git describe --tags --exact-match &>/dev/null
 then
+    sed "$INPUT" -e "s/@VCS_TAG@//"
     exit 0
 fi
 
@@ -17,4 +18,6 @@ else
     DIRTY=""
 fi
 
-echo "-g$(git describe --abbrev=7 --match="" --always $DIRTY)"
+TAG="-g$(git describe --abbrev=7 --match="" --always $DIRTY)"
+
+sed "$INPUT" -e "s/@VCS_TAG@/$TAG/"