diff --git a/version.sh b/version.sh
index 0472da9025a..8de3496d7eb 100755
--- a/version.sh
+++ b/version.sh
@@ -68,7 +68,7 @@ fi
 if [[ -z ${VERSION} ]]; then
     # Check if this branch has any tags (typically, only release branches will
     # have tags).
-    MAYBE_TAG=$(git describe --tags --abbrev=0 2>/dev/null | grep -Eo 'v?\d+\.\d+\.\d+')
+    MAYBE_TAG=$(git describe --tags --abbrev=0 2>/dev/null)
     SHA=$(git rev-parse --short HEAD)
 
     # No tag on current branch.
@@ -92,6 +92,16 @@ if [[ -z ${VERSION} ]]; then
         )
     fi
 
+    # Filter out additional +metadata from the tag, should it
+    # exist. This prevents version strings like
+    # 0.751.0+dryrun+27a014b44.
+    # Note: we use [0-9] instead of \d here, because while BSD grep's
+    # -E includes the \d character class, GNU grep's -E does not. This
+    # means using \d on macOS will work fine, but it will break on
+    # Linux (and thus, CI). To avoid this, we fall back to standard
+    # character sets.
+    MAYBE_TAG=$(grep -Eo 'v?[0-9]+\.[0-9]+\.[0-9]+' <(printf "%s" "$MAYBE_TAG"))
+
     # Munge the tag into the form we want. Note: we always append a SHA hash,
     # even if we're on the commit with the tag. This is partially because I feel
     # like it will be more consistent and result in fewer surprises, but also it