diff --git a/.github/workflows/cd-staging.yml b/.github/workflows/cd-staging.yml
index 39e22f7..265a0b3 100644
--- a/.github/workflows/cd-staging.yml
+++ b/.github/workflows/cd-staging.yml
@@ -12,6 +12,10 @@ on:
       - "apps/**"
       - "packages/**"
       - "pnpm-lock.yaml"
+      # Also redeploy when the staging plumbing itself changes, so a port
+      # bump or compose edit doesn't sit unapplied until the next apps/ push.
+      - "infrastructure/docker-compose.staging.yml"
+      - ".github/workflows/cd-staging.yml"
   pull_request:
     types: [opened, synchronize, reopened, closed]
     paths:
@@ -88,10 +92,10 @@ jobs:
           secrets: |
             SENTRY_AUTH_TOKEN=/tmp/sentry_token
 
-  # ── Deploy persistent staging (main push) ────────────────────────────
+  # ── Deploy persistent staging (main push or manual dispatch) ─────────
   deploy-staging:
     name: Deploy Staging
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'workflow_dispatch'
     needs: [build-images]
     runs-on: ubuntu-latest
     environment: production