diff --git a/build/BUILD.bazel b/build/BUILD.bazel
index 14a14e62f..86f6635ab 100644
--- a/build/BUILD.bazel
+++ b/build/BUILD.bazel
@@ -33,7 +33,7 @@ DOCKERIZED_BINARIES = {
     # Since the multi_arch_container macro replaces the {ARCH} format string,
     # we need to escape the stamping vars.
     docker_tags = ["{{STABLE_DOCKER_REGISTRY}}/cert-manager-%s-{ARCH}:{{STABLE_DOCKER_TAG}}" % binary],
-    stamp = True,
+    stamp = 1,
     symlinks = {
         # Some cluster startup scripts expect to find the binaries in /usr/local/bin,
         # but the debs install the binaries into /usr/bin.
diff --git a/hack/boilerplate/BUILD.bazel b/hack/boilerplate/BUILD.bazel
index 37d2c138c..1e50f729f 100644
--- a/hack/boilerplate/BUILD.bazel
+++ b/hack/boilerplate/BUILD.bazel
@@ -20,9 +20,10 @@ genrule(
     outs = ["boilerplate.bzl.timestamped.txt.out"],
     cmd = " ".join([
         "sed",
-        "s/YEAR/$$(date +\"%Y\")/",
+        "s/YEAR/$$(grep '^STABLE_LAST_COMMIT_YEAR' bazel-out/stable-status.txt | awk '{print $$2}')/",
         "$(location :boilerplate.bzl.txt)",
         "> $@",
     ]),
+    stamp = 1,
     visibility = ["//visibility:public"],
 )
diff --git a/hack/build/print-workspace-status.sh b/hack/build/print-workspace-status.sh
index 4b09ec6e1..8f8869209 100755
--- a/hack/build/print-workspace-status.sh
+++ b/hack/build/print-workspace-status.sh
@@ -33,6 +33,7 @@ if [ ! -z "$(git status --porcelain)" ]; then
 fi
 
 cat <<EOF
+STABLE_LAST_COMMIT_YEAR $(git log -1 --date=format:"%Y" --format="%ad")
 STABLE_BUILD_GIT_COMMIT ${KUBE_GIT_COMMIT-}
 STABLE_BUILD_SCM_STATUS ${KUBE_GIT_TREE_STATE-}
 STABLE_BUILD_SCM_REVISION ${KUBE_GIT_VERSION-}