diff --git a/.github/workflows/buildah.yml b/.github/workflows/buildah.yml
index da6507a..2a5f3e9 100644
--- a/.github/workflows/buildah.yml
+++ b/.github/workflows/buildah.yml
@@ -91,7 +91,12 @@ jobs:
           extra-args: --squash
 
       - name: Push to registry
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        # Auto-deploy when an image change pushes to main, OR run manually from
+        # the Actions pane via workflow_dispatch (which can target a specific
+        # image via the `image` input).
+        if: |
+          (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+          github.event_name == 'workflow_dispatch'
         uses: redhat-actions/push-to-registry@v2
         with:
           image: ${{ matrix.image }}
diff --git a/gh-cli/Containerfile b/gh-cli/Containerfile
index 3ed5a1c..70a73ff 100644
--- a/gh-cli/Containerfile
+++ b/gh-cli/Containerfile
@@ -10,7 +10,7 @@ RUN apk add --no-cache github-cli bash \
     && adduser -D -u 1000 gh \
     && rm -rf /var/cache/apk/* /tmp/* /root/.cache
 
-USER gh
+USER 1000
 WORKDIR /home/gh
 
 ENTRYPOINT ["/bin/bash"]