diff --git a/.github/workflows/deploy-runner.yml b/.github/workflows/deploy-runner.yml
index db86562..8c0efbf 100644
--- a/.github/workflows/deploy-runner.yml
+++ b/.github/workflows/deploy-runner.yml
@@ -10,6 +10,10 @@ on:
     branches: [main]
     paths:
       - "cloud-run/**"
+  # Deploys can fail for reasons outside the code (a missing IAM grant, a Cloud
+  # Build outage). Without this the only way to retry was to push a no-op
+  # commit, which is worse than useless on the branch that deploys production.
+  workflow_dispatch:
 
 # The deploy script needs `gcloud` (auth + setup-gcloud below). No write access
 # to this repository itself is required.
diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md
index a7a8624..3b9490a 100644
--- a/DEPLOYMENT.md
+++ b/DEPLOYMENT.md
@@ -186,11 +186,16 @@ changes will deploy nothing:
    | `roles/iam.serviceAccountUser` | act as the runtime service account |
    | `roles/cloudbuild.builds.editor` | run the build |
    | `roles/artifactregistry.writer` | push the built image (else `artifactregistry.repositories.get` is denied) |
-   | `roles/storage.objectAdmin` | read/write the source bucket `run-sources-<project>-<region>` (else `storage.buckets.get` is denied) |
-
-   Scope the last two to the repository and bucket if you prefer, but a partial
-   set fails at deploy time with a message naming only the next missing
-   permission — which is how this list was corrected twice.
+   | `roles/storage.admin` | the source bucket: read its metadata (`storage.buckets.get`, `storage.buckets.list`) and write the objects in it |
+
+   `roles/storage.admin` is the one to grant, and the narrower storage roles do
+   **not** compose into a substitute. Measured against the live role definitions:
+   `storage.objectAdmin` has 32 permissions and not one is `storage.buckets.*`;
+   `storage.legacyBucketReader` supplies `storage.buckets.get` but not
+   `storage.buckets.list`. A source deploy needs `buckets.get`, `buckets.list`
+   and `objects.create`, and only `storage.admin` supplies all three — so the
+   failures arrive one permission at a time and each looks like the last one
+   being wrong.
 2. In **Settings → Secrets and variables → Actions**, create a repository secret
    named `CCC_FFAI_RUNNER_SA_KEY_JSON` whose value is the key's full JSON
    (including the surrounding `{ }`).