diff --git a/.github/workflows/coverage-on-pr.yml b/.github/workflows/coverage-on-pr.yml
index 6f982b33a..7c6c026f4 100644
--- a/.github/workflows/coverage-on-pr.yml
+++ b/.github/workflows/coverage-on-pr.yml
@@ -21,8 +21,8 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          count=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/${{ github.event.workflow_run.id }}/artifacts" \
-            --jq '[.artifacts[] | select(.name == "octocov-pr")] | length')
+          count=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/${{ github.event.workflow_run.id }}/artifacts?name=octocov-pr" \
+            --jq '.total_count')
           echo "count=$count" >> "$GITHUB_OUTPUT"
 
       # Only the config, from the base branch: this job holds a write token, so
diff --git a/.github/workflows/detect-changes.sh b/.github/workflows/detect-changes.sh
index 2e7a42586..d1a6760ad 100755
--- a/.github/workflows/detect-changes.sh
+++ b/.github/workflows/detect-changes.sh
@@ -9,8 +9,8 @@
 #   build - anything that ends up in a binary, image or package (i.e. every
 #           change except the doc-only paths in $DOC_ONLY_RE)
 #
-# Only pull requests are narrowed. Master pushes and tags always get every flag,
-# so a release can never be built from a partially validated tree.
+# Only pull requests are narrowed. Master pushes, tags and manual runs always get
+# every flag, so a release can never be built from a partially validated tree.
 #
 # Flags gate STEPS, not jobs: a job-level skip propagates through the needs
 # chain (actions/runner#491) and would take the release jobs down with it.
@@ -20,9 +20,9 @@
 set -uo pipefail
 export LC_ALL=C
 
-GO_RE='(\.go$|(^|/)go\.(mod|sum)$|^Makefile$|^\.golangci\.yml$|^resources/)'
+GO_RE='(\.go$|(^|/)go\.(mod|sum)$|^Makefile$|^\.golangci\.yml$|^resources/|^db/migrations/)'
 JS_RE='^ui/'
-I18N_RE='(^resources/i18n/|^\.github/workflows/validate-translations\.sh$)'
+I18N_RE='(^resources/i18n/|^ui/src/i18n/en\.json$|^\.github/workflows/validate-translations\.sh$)'
 DOC_ONLY_RE='(\.md$|^LICENSE$|^\.git-blame-ignore-revs$|^\.gitignore$|^\.devcontainer/)'
 
 emit() { printf '%s=%s\n' "$1" "$2" | tee -a "${GITHUB_OUTPUT:-/dev/null}"; }
@@ -34,7 +34,13 @@ if [ "${GITHUB_EVENT_NAME:-}" != "pull_request" ]; then
 fi
 
 BASE_REF="${BASE_REF:-master}"
-git fetch --no-tags --quiet origin "+refs/heads/${BASE_REF}:refs/remotes/origin/${BASE_REF}"
+git fetch --no-tags --quiet origin "+refs/heads/${BASE_REF}:refs/remotes/origin/${BASE_REF}" || true
+# Guard the diff, not the fetch: checkout already created the ref, so a failed
+# refresh is harmless, but an unresolvable ref would emit every flag as false.
+if ! git rev-parse --verify --quiet "origin/${BASE_REF}" >/dev/null; then
+  printf '::error::Cannot resolve origin/%s. In CI, check out with fetch-depth: 0.\n' "$BASE_REF" >&2
+  exit 1
+fi
 
 files="$(git diff --name-only "origin/${BASE_REF}...HEAD")"
 echo "Changed files:"
diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
index bb318bf5c..cc90b370a 100644
--- a/.github/workflows/pipeline.yml
+++ b/.github/workflows/pipeline.yml
@@ -8,6 +8,7 @@ on:
   pull_request:
     branches:
       - master
+  workflow_dispatch:
 
 concurrency:
   group: ${{ startsWith(github.ref, 'refs/tags/v') && 'tag' || 'branch' }}-${{ github.ref }}