diff --git a/CMakeLists.txt b/CMakeLists.txt
index 23eb07a..f8d1c74 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -302,6 +302,18 @@ if(BUILD_RELOCATABLE_PACKAGE)
   # RVS-style relocatable packaging: bypass rocm_install/rocm_create_package and
   # drive CPack directly so CMAKE_INSTALL_PREFIX / CPACK_PACKAGING_INSTALL_PREFIX
   # set by the caller (build_packages_local.sh) are honored.
+  #
+  # The CPack flow below uses CPACK_ARCHIVE_FILE_NAME (3.13+) and the
+  # DEB-DEFAULT / RPM-DEFAULT canonical-naming sentinels (3.6+). The
+  # project-wide cmake_minimum_required is 3.5 for the non-packaging build, so
+  # gate the relocatable path locally to avoid silently producing a literal
+  # "DEB-DEFAULT" filename on a too-old CMake.
+  if(CMAKE_VERSION VERSION_LESS 3.13)
+    message(FATAL_ERROR
+      "BUILD_RELOCATABLE_PACKAGE requires CMake >= 3.13 "
+      "(found ${CMAKE_VERSION}); needed for CPACK_ARCHIVE_FILE_NAME and "
+      "the DEB-DEFAULT / RPM-DEFAULT canonical-naming sentinels.")
+  endif()
   if(NOT DEFINED ROCM_MAJOR_VERSION)
     set(ROCM_MAJOR_VERSION "7")
   endif()
@@ -331,23 +343,45 @@ if(BUILD_RELOCATABLE_PACKAGE)
   set(CPACK_PACKAGE_DESCRIPTION_SUMMARY "TransferBench: benchmark simultaneous transfers between CPU/GPU/NIC")
   set(CPACK_RESOURCE_FILE_LICENSE "${CMAKE_CURRENT_SOURCE_DIR}/LICENSE.md")
 
+  # Per-build release tag, threaded into DEB/RPM metadata AND the TGZ filename.
+  # Prefer the explicit -D from build_packages_local.sh; fall back to the env
+  # vars CPack itself reads (so direct cmake invocations still work).
+  # Quote variable references throughout so the comparison is unambiguous
+  # under any CMP0054 setting.
+  set(_tb_pkg_release "")
+  if(NOT "${TRANSFERBENCH_PACKAGE_RELEASE}" STREQUAL "")
+    set(_tb_pkg_release "${TRANSFERBENCH_PACKAGE_RELEASE}")
+  elseif(NOT "$ENV{CPACK_RPM_PACKAGE_RELEASE}" STREQUAL "")
+    set(_tb_pkg_release "$ENV{CPACK_RPM_PACKAGE_RELEASE}")
+  elseif(NOT "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}" STREQUAL "")
+    set(_tb_pkg_release "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}")
+  endif()
+
   # DEB
   set(CPACK_DEBIAN_PACKAGE_NAME       "${CPACK_PACKAGE_NAME}")
   set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "amd64")
   set(CPACK_DEBIAN_PACKAGE_DEPENDS    "numactl, libnuma1, hsa-rocr")
   set(CPACK_DEBIAN_PACKAGE_MAINTAINER "${CPACK_PACKAGE_CONTACT}")
-  if(DEFINED ENV{CPACK_DEBIAN_PACKAGE_RELEASE})
+  if(NOT "${_tb_pkg_release}" STREQUAL "")
+    set(CPACK_DEBIAN_PACKAGE_RELEASE "${_tb_pkg_release}")
+  elseif(DEFINED ENV{CPACK_DEBIAN_PACKAGE_RELEASE})
     set(CPACK_DEBIAN_PACKAGE_RELEASE "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}")
   endif()
+  # Canonical filename: <name>_<version>-<release>_<arch>.deb
+  set(CPACK_DEBIAN_FILE_NAME "DEB-DEFAULT")
 
   # RPM
   set(CPACK_RPM_PACKAGE_NAME    "${CPACK_PACKAGE_NAME}")
   set(CPACK_RPM_PACKAGE_LICENSE "MIT")
   set(CPACK_RPM_PACKAGE_REQUIRES "numactl, hsa-rocr")
   set(CPACK_RPM_PACKAGE_VENDOR  "${CPACK_PACKAGE_VENDOR}")
-  if(DEFINED ENV{CPACK_RPM_PACKAGE_RELEASE})
+  if(NOT "${_tb_pkg_release}" STREQUAL "")
+    set(CPACK_RPM_PACKAGE_RELEASE "${_tb_pkg_release}")
+  elseif(DEFINED ENV{CPACK_RPM_PACKAGE_RELEASE})
     set(CPACK_RPM_PACKAGE_RELEASE "$ENV{CPACK_RPM_PACKAGE_RELEASE}")
   endif()
+  # Canonical filename: <name>-<version>-<release>.<arch>.rpm
+  set(CPACK_RPM_FILE_NAME "RPM-DEFAULT")
   # Use the actual install prefix (caller-controlled in relocatable mode)
   # rather than hard-coded /opt/... paths.
   if(DEFINED CPACK_PACKAGING_INSTALL_PREFIX)
@@ -360,8 +394,18 @@ if(BUILD_RELOCATABLE_PACKAGE)
         "${_rpm_exclude_prefix}"
         "${_rpm_exclude_prefix}/bin")
 
-  # TGZ
-  set(CPACK_ARCHIVE_FILE_NAME "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-Linux")
+  # TGZ — embed release tag so successive runs do not collide on the same key.
+  # CMake 3.13+ honors CPACK_ARCHIVE_FILE_NAME for archive generators, but
+  # CMake 3.22 (Ubuntu 22.04) falls back to CPACK_PACKAGE_FILE_NAME for TGZ.
+  # Set both to the same suffixed value. DEB/RPM are unaffected because they
+  # use the explicit DEB-DEFAULT / RPM-DEFAULT canonical-naming tokens above.
+  if("${_tb_pkg_release}" STREQUAL "")
+    set(_tb_archive_name "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-Linux")
+  else()
+    set(_tb_archive_name "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-${_tb_pkg_release}-Linux")
+  endif()
+  set(CPACK_ARCHIVE_FILE_NAME "${_tb_archive_name}")
+  set(CPACK_PACKAGE_FILE_NAME "${_tb_archive_name}")
 
   set(CPACK_GENERATOR "DEB;RPM;TGZ")
   include(CPack)
diff --git a/build_packages_local.sh b/build_packages_local.sh
index cf12b83..91ace56 100755
--- a/build_packages_local.sh
+++ b/build_packages_local.sh
@@ -40,6 +40,19 @@ BUILD_DIR="${REPO_ROOT}/build"
 SDK_DIR="${HOME}/rocm-sdk"
 ROCM_PATH="${SDK_DIR}/install"
 
+# Containerized builds (e.g. manylinux on a host-mounted workspace) hit git's
+# "dubious ownership" guard because the checkout is host-UID-owned but we run
+# as root. Without this, `git describe` in CMakeLists.txt silently fails and
+# TRANSFERBENCH_VERSION_PATCH falls back to its hard-coded default.
+#
+# Use GIT_CONFIG_* env vars (git >= 2.31) so the scoped safe.directory entry
+# is inherited by CMake's `execute_process(git …)` children without touching
+# the user's persistent ~/.gitconfig (especially harmful under sudo, where
+# the modification would land in root's global config).
+export GIT_CONFIG_COUNT=1
+export GIT_CONFIG_KEY_0="safe.directory"
+export GIT_CONFIG_VALUE_0="${REPO_ROOT}"
+
 # Default GPU targets baked into every package, regardless of GPU_FAMILY tarball.
 DEFAULT_GPU_TARGETS="gfx906;gfx908;gfx90a;gfx942;gfx950;gfx1030;gfx1100;gfx1101;gfx1102;gfx1150;gfx1151;gfx1200;gfx1201"
 GPU_TARGETS="${GPU_TARGETS:-$DEFAULT_GPU_TARGETS}"
@@ -220,6 +233,7 @@ CMAKE_ARGS=(
   -DENABLE_MPI_COMM=OFF
   -DDISABLE_DMABUF=OFF
   -DGPU_TARGETS="${GPU_TARGETS}"
+  -DTRANSFERBENCH_PACKAGE_RELEASE="${PKG_RELEASE}"
 )
 if [[ -n "${CMAKE_CXX_COMPILER_OVERRIDE}" ]]; then
   CMAKE_ARGS+=(-DCMAKE_CXX_COMPILER="${CMAKE_CXX_COMPILER_OVERRIDE}")