diff --git a/.github/workflows/demo.yml b/.github/workflows/demo.yml
index a3a11a3..711b9d2 100644
--- a/.github/workflows/demo.yml
+++ b/.github/workflows/demo.yml
@@ -13,7 +13,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   render:
@@ -68,14 +68,15 @@ jobs:
         with:
           path: demo/demo.tape
 
-      - name: Commit GIF
+      - name: Upload GIF
+        uses: actions/upload-artifact@v7
+        with:
+          name: demo-gif
+          path: assets/demo.gif
+          if-no-files-found: error
+
+      - name: Summary
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add assets/demo.gif
-          if git diff --staged --quiet; then
-            echo "GIF unchanged"
-          else
-            git commit -m "chore: regenerate demo GIF [skip ci]"
-            git push
-          fi
+          echo "Rendered \`assets/demo.gif\` (\`$(du -h assets/demo.gif | cut -f1)\`)." >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "Download it from the **demo-gif** artifact above, drop it into \`assets/\`, and open a PR to update the README GIF." >> "$GITHUB_STEP_SUMMARY"
diff --git a/demo/demo.tape b/demo/demo.tape
index ba1b46b..927d374 100644
--- a/demo/demo.tape
+++ b/demo/demo.tape
@@ -1,6 +1,11 @@
 # Demo GIF for the README.
 #
-# Rendered in CI by .github/workflows/demo.yml. To render locally:
+# The committed assets/demo.gif is rendered from this tape by hand and updated
+# through a normal pull request. .github/workflows/demo.yml renders the tape on
+# demand and uploads the result as an artifact, so you can check that the tape
+# still works and download a fresh GIF without recording anything.
+#
+# To render locally:
 #
 #   docker compose -f docker-compose.test.yml up -d --wait
 #   uv sync --dev && export PATH="$PWD/.venv/bin:$PATH"