diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 000000000..b1a1cf27d
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,40 @@
+name: build
+
+on:
+  workflow_dispatch:
+    inputs:
+      sha:
+        description: "The full SHA of the commit to build (defaults to the latest commit on main)."
+        type: string
+        required: false
+
+env:
+  FORCE_COLOR: 1
+
+permissions: {}
+
+jobs:
+  linux:
+    uses: ./.github/workflows/linux.yml
+    with:
+      ref: ${{ inputs.sha || github.sha }}
+    permissions:
+      packages: write
+      id-token: write
+      attestations: write
+
+  macos:
+    uses: ./.github/workflows/macos.yml
+    with:
+      ref: ${{ inputs.sha || github.sha }}
+    permissions:
+      id-token: write
+      attestations: write
+
+  windows:
+    uses: ./.github/workflows/windows.yml
+    with:
+      ref: ${{ inputs.sha || github.sha }}
+    permissions:
+      id-token: write
+      attestations: write
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 2e934c5fd..9492bf83f 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -1,12 +1,17 @@
 name: linux
 
 on:
-  push:
-    branches: [ main ]
   pull_request:
+  workflow_call:
+    inputs:
+      ref:
+        description: "The git ref to build."
+        type: string
+        required: false
+        default: ''
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref_name }}-${{ github.event.pull_request.number || github.sha }}
+  group: linux-${{ github.ref_name }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
@@ -26,6 +31,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ inputs.ref || '' }}
           persist-credentials: false
 
       - name: Emit rustc version
@@ -64,6 +70,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ inputs.ref || '' }}
           persist-credentials: false
 
       - name: Set up uv
@@ -142,6 +149,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ inputs.ref || '' }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -216,6 +224,7 @@ jobs:
     steps: &build_steps
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ inputs.ref || '' }}
           fetch-depth: 0
           persist-credentials: false
 
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 3a992a9a4..b63bb46b5 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -1,12 +1,17 @@
 name: macos
 
 on:
-  push:
-    branches: [ main ]
   pull_request:
+  workflow_call:
+    inputs:
+      ref:
+        description: "The git ref to build."
+        type: string
+        required: false
+        default: ''
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref_name }}-${{ github.event.pull_request.number || github.sha }}
+  group: macos-${{ github.ref_name }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
@@ -26,6 +31,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ inputs.ref || '' }}
           persist-credentials: false
 
       - name: Emit rustc version
@@ -60,6 +66,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ inputs.ref || '' }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -127,6 +134,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ inputs.ref || '' }}
           fetch-depth: 0
           persist-credentials: false
 
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index cc8b866f0..3e0fb9bbd 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -1,12 +1,17 @@
 name: windows
 
 on:
-  push:
-    branches: [ main ]
   pull_request:
+  workflow_call:
+    inputs:
+      ref:
+        description: "The git ref to build."
+        type: string
+        required: false
+        default: ''
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref_name }}-${{ github.event.pull_request.number || github.sha }}
+  group: windows-${{ github.ref_name }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
@@ -26,6 +31,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ inputs.ref || '' }}
           persist-credentials: false
 
       - name: Emit rustc version
@@ -60,6 +66,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ inputs.ref || '' }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -128,6 +135,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ inputs.ref || '' }}
           fetch-depth: 0
           persist-credentials: false