diff --git a/meson.build b/meson.build
index 807858c4a4..702eaaf652 100644
--- a/meson.build
+++ b/meson.build
@@ -1808,26 +1808,13 @@ xml_helper_py = find_program('tools/xml_helper.py')
 ############################################################
 
 version_tag = get_option('version-tag')
-# Check that we have either .git/ (a normal clone) or a .git file (a work-tree) and that we don't
-# get confused if a tarball is extracted in a higher-level git repository.
-if version_tag == '' and git.found() and fs.exists(project_source_root / '.git')
-        # If the working tree has no tags (CI builds), the first git-describe will fail
-        # and we fall back to project_version-commitid instead.
-        version_cmd = '''(git -C "$1" describe --abbrev=7 --dirty=^ 2>/dev/null ||
-                          echo "$2-$(git -C "$1" describe --always --abbrev=7)") |
-                         sed 's/^v//; s/-rc/~rc/' '''
-else
-        version_cmd = '''echo "$2" '''
-endif
-
 version_h = vcs_tag(
         input : 'src/version/version.h.in',
         output : 'version.h',
-        # TODO: Use 'sh' variable with meson >= 0.63.0
-        command: ['sh', '-euc', version_cmd,
-                  '_',
+        command: [project_source_root / 'tools/meson-vcs-tag.sh',
                   project_source_root,
-                  version_tag == '' ? meson.project_version() : version_tag,
+                  meson.project_version(),
+                  version_tag,
                  ])
 
 shared_lib_tag = get_option('shared-lib-tag')
diff --git a/tools/meson-vcs-tag.sh b/tools/meson-vcs-tag.sh
new file mode 100755
index 0000000000..65564bba85
--- /dev/null
+++ b/tools/meson-vcs-tag.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+set -eu
+set -o pipefail
+
+dir="${1:?}"
+fallback="${2:?}"
+version_tag="$3"
+
+if [ -n "${version_tag}" ]; then
+    # If -Dversion_tag= was used, just use that without further changes.
+    echo "${version_tag}"
+else
+    # Check that we have either .git/ (a normal clone) or a .git file (a work-tree)
+    # and that we don't get confused if a tarball is extracted in a higher-level
+    # git repository.
+    #
+    # If the working tree has no tags (CI builds), the first git-describe will fail
+    # and we fall back to project_version-commitid instead.
+    if [ -e "${dir}/.git" ]; then
+        c="$(git -C "$dir" describe --abbrev=7 --dirty=^ 2>/dev/null ||
+                    echo "${fallback}-$(git -C "$dir" describe --always --abbrev=7)")"
+    else
+        c="${fallback}"
+    fi
+    echo "$c" | sed 's/^v//; s/-rc/~rc/'
+fi