diff --git a/Config.mk b/Config.mk
index fa0414055b..9188fc9053 100644
--- a/Config.mk
+++ b/Config.mk
@@ -141,6 +141,14 @@ export XEN_HAS_BUILD_ID=y
 build_id_linker := --build-id=sha1
 endif
 
+# Wrap date(1) to use SOURCE_DATE_EPOCH if set the environment.
+# See https://reproducible-builds.org/docs/source-date-epoch/
+ifdef SOURCE_DATE_EPOCH
+date = $(shell LC_ALL=C date -u -d "@$(SOURCE_DATE_EPOCH)" $(1) 2>/dev/null || LC_ALL=C date -u -r "$(SOURCE_DATE_EPOCH)" $(1) 2>/dev/null || LC_ALL=C date -u $(1))
+else
+date = $(shell LC_ALL=C date $(1))
+endif
+
 define buildmakevars2shellvars
     export PREFIX="$(prefix)";                                            \
     export XEN_SCRIPT_DIR="$(XEN_SCRIPT_DIR)";                            \
diff --git a/docs/Makefile b/docs/Makefile
index b30cc619f8..ca9fd726d3 100644
--- a/docs/Makefile
+++ b/docs/Makefile
@@ -3,7 +3,7 @@ include $(XEN_ROOT)/Config.mk
 -include $(XEN_ROOT)/config/Docs.mk
 
 VERSION		:= $(shell $(MAKE) -C $(XEN_ROOT)/xen --no-print-directory xenversion)
-DATE		:= $(shell date +%Y-%m-%d)
+DATE		:= $(call date,"+%Y-%m-%d")
 
 DOC_ARCHES      := arm x86_32 x86_64
 MAN_SECTIONS    := 1 5 7 8
diff --git a/tools/firmware/hvmloader/Makefile b/tools/firmware/hvmloader/Makefile
index c7bc400657..cc5dc00498 100644
--- a/tools/firmware/hvmloader/Makefile
+++ b/tools/firmware/hvmloader/Makefile
@@ -23,7 +23,7 @@ include $(XEN_ROOT)/tools/firmware/Rules.mk
 ld-option = $(shell if $(LD) -v $(1) >/dev/null 2>&1; then echo y; else echo n; fi)
 
 # SMBIOS spec requires format mm/dd/yyyy
-SMBIOS_REL_DATE ?= $(shell date +%m/%d/%Y)
+SMBIOS_REL_DATE ?= $(call date,"+%m/%d/%Y")
 
 CFLAGS += $(CFLAGS_xeninclude) -fno-pic -mregparm=3
 
diff --git a/tools/firmware/vgabios/Makefile b/tools/firmware/vgabios/Makefile
index 3284812fde..db5a2624be 100644
--- a/tools/firmware/vgabios/Makefile
+++ b/tools/firmware/vgabios/Makefile
@@ -1,3 +1,6 @@
+XEN_ROOT = $(CURDIR)/../../..
+include $(XEN_ROOT)/Config.mk
+
 CC      = gcc
 
 GCC = gcc
@@ -5,7 +8,7 @@ BCC = bcc
 AS86 = as86
 
 RELEASE = `pwd | sed "s-.*/--"`
-VGABIOS_REL_DATE ?= `date '+%d %b %Y'`
+VGABIOS_REL_DATE ?= $(call date,"+%d %b %Y")
 RELVERS = `pwd | sed "s-.*/--" | sed "s/vgabios//" | sed "s/-//"`
 
 VGABIOS_DATE = "-DVGABIOS_DATE=\"$(VGABIOS_REL_DATE)\""
diff --git a/xen/Makefile b/xen/Makefile
index 2e1a925c84..a2d0795cde 100644
--- a/xen/Makefile
+++ b/xen/Makefile
@@ -14,15 +14,11 @@ export XEN_WHOAMI	?= $(USER)
 ifeq ($(origin XEN_DOMAIN), undefined)
 export XEN_DOMAIN	:= $(shell ([ -x /bin/dnsdomainname ] && /bin/dnsdomainname) || ([ -x /bin/domainname ] && /bin/domainname || echo [unknown]))
 endif
-ifeq ($(origin XEN_BUILD_DATE), undefined)
-export XEN_BUILD_DATE	:= $(shell LC_ALL=C date)
-endif
-ifeq ($(origin XEN_BUILD_TIME), undefined)
-export XEN_BUILD_TIME	:= $(shell LC_ALL=C date +%T)
-endif
 ifeq ($(origin XEN_BUILD_HOST), undefined)
 export XEN_BUILD_HOST	:= $(shell hostname)
 endif
+# XEN_BUILD_DATE and XEN_BUILD_TIME are set further down, as they depend on
+# Config.mk for SOURCE_DATE_EPOCH handling.
 
 # Best effort attempt to find a python interpreter, defaulting to Python 3 if
 # available.  Fall back to just `python`.
@@ -250,6 +246,13 @@ SRCARCH := $(shell echo $(ARCH) | \
         -e 's/riscv.*/riscv/g' -e 's/ppc.*/ppc/g')
 export ARCH SRCARCH
 
+ifeq ($(origin XEN_BUILD_DATE), undefined)
+export XEN_BUILD_DATE	:= $(call date)
+endif
+ifeq ($(origin XEN_BUILD_TIME), undefined)
+export XEN_BUILD_TIME	:= $(call date,"+%T")
+endif
+
 export CONFIG_SHELL := $(SHELL)
 export CC CXX LD NM OBJCOPY OBJDUMP ADDR2LINE
 export YACC = $(if $(BISON),$(BISON),bison)