diff --git a/cli/assets/coordinator-policy-hash b/cli/assets/coordinator-policy-hash
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/cli/runtime.go b/cli/runtime.go
index b0aabd088b..5c4782e8c0 100644
--- a/cli/runtime.go
+++ b/cli/runtime.go
@@ -3,4 +3,4 @@ package main
 // DefaultCoordinatorPolicyHash is derived from the coordinator release candidate and injected at release build time.
 //
 // It is intentionally left empty for dev builds.
-var DefaultCoordinatorPolicyHash = "" // TODO(burgerdev): actually inject something at build time.
+var DefaultCoordinatorPolicyHash = ""
diff --git a/packages/default.nix b/packages/default.nix
index 24fffd57af..cd6de0692e 100644
--- a/packages/default.nix
+++ b/packages/default.nix
@@ -34,7 +34,7 @@ rec {
     let
       subPackages = [ "coordinator" "initializer" "cli" ];
     in
-    buildGoModule {
+    lib.makeOverridable buildGoModule {
       inherit version subPackages;
       name = "nunki";
 
@@ -77,6 +77,12 @@ rec {
     };
   inherit (nunki) cli;
 
+  cli-release = (nunki.override (prevArgs: {
+    ldflags = prevArgs.ldflags ++ [
+      "-X main.DefaultCoordinatorPolicyHash=${builtins.readFile ../cli/assets/coordinator-policy-hash}"
+    ];
+  })).cli;
+
   coordinator = dockerTools.buildImage {
     name = "coordinator";
     tag = "v${version}";