diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dc96219..d49976a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,6 +18,10 @@ on:
       - 'LICENSE'
       - '.gitignore'
 
+  # On demand. The triggers above both wait on an event, so a green build can only be confirmed
+  # by producing one. No paths-ignore here: asking by hand means asking for the whole thing.
+  workflow_dispatch:
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index d528ac0..3f02946 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -7,6 +7,10 @@ on:
   pull_request:
     branches: [main]
 
+  # On demand, so history can be rescanned after a rule change in .gitleaks.toml without
+  # waiting for the next push to main.
+  workflow_dispatch:
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/web-ci.yml b/.github/workflows/web-ci.yml
index 236d8dc..f6570e1 100644
--- a/.github/workflows/web-ci.yml
+++ b/.github/workflows/web-ci.yml
@@ -8,6 +8,11 @@ on:
     branches: [main]
     paths: ['web/**', '.github/workflows/web-ci.yml']
 
+  # On demand, and this one needs it most: the paths filter means a change outside web/ never
+  # runs it, so it can sit unexercised for long stretches with nothing reporting that. No paths
+  # filter on the manual trigger — the point of pressing it is to run regardless.
+  workflow_dispatch:
+
 permissions:
   contents: read