diff --git a/.copr/Makefile b/.copr/Makefile
index b335e8c..6d5b37a 100644
--- a/.copr/Makefile
+++ b/.copr/Makefile
@@ -1,4 +1,3 @@
-VERSION := $(shell git describe --tags --abbrev=0 2>/dev/null | sed 's/^v//; s/-/~/g' | grep .)
 SPEC := secureEye/rpm/secure-eye.spec
 outdir ?= $(CURDIR)
 topdir := $(CURDIR)/.copr-rpmbuild
@@ -7,15 +6,22 @@ topdir := $(CURDIR)/.copr-rpmbuild
 srpm:
 	dnf -y install git rpm-build
 	git config --global --add safe.directory $(CURDIR)
-	scripts/set-package-version.sh "$(VERSION)"
+	set -eu; \
+	version="$$(git describe --tags --abbrev=0 2>/dev/null | sed 's/^v//; s/-/~/g')"; \
+	if [ -z "$$version" ]; then \
+	    echo "no tag to take the version from: submit the build with --commit <tag> so the clone is checked out at a tagged commit" >&2; \
+	    exit 1; \
+	fi; \
+	echo "building secure-eye $$version"; \
+	scripts/set-package-version.sh "$$version"; \
 	git -c user.name=copr -c user.email=copr@localhost \
-	    commit -qam "generated packaging for $(VERSION)" --allow-empty
-	mkdir -p "$(topdir)/SOURCES" "$(outdir)"
+	    commit -qam "generated packaging for $$version" --allow-empty; \
+	mkdir -p "$(topdir)/SOURCES" "$(outdir)"; \
 	git archive --format=tar.gz \
-	    --prefix="secure-eye-$(VERSION)/" \
-	    -o "$(topdir)/SOURCES/secure-eye-$(VERSION).tar.gz" HEAD
-	cp secureEye/rpm/secure-eye.sysusers "$(topdir)/SOURCES/"
+	    --prefix="secure-eye-$$version/" \
+	    -o "$(topdir)/SOURCES/secure-eye-$$version.tar.gz" HEAD; \
+	cp secureEye/rpm/secure-eye.sysusers "$(topdir)/SOURCES/"; \
 	rpmbuild -bs $(SPEC) \
 	    --define "_topdir $(topdir)" \
-	    --define "pkg_version $(VERSION)" \
+	    --define "pkg_version $$version" \
 	    --define "_srcrpmdir $(outdir)"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d9270a0..f5c4a82 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.1] - 2026-08-19
+
+### Fixed
+
+- COPR builds failed in the source stage, before any chroot was built:
+  `.copr/Makefile` resolved the release version with `git describe` while make
+  parsed the file, which happens before the recipe installs git. The version
+  came out empty and `set-package-version.sh` aborted. It is now resolved
+  inside the recipe, after git is installed, and a clone with no reachable tag
+  fails with a message that says so rather than with a blank version.
+
 ## [0.2.0] - 2026-08-18
 
 ### Changed