diff --git a/.github/workflows/screenshots.yml b/.github/workflows/screenshots.yml
index 9a47127..e362f1c 100644
--- a/.github/workflows/screenshots.yml
+++ b/.github/workflows/screenshots.yml
@@ -7,6 +7,10 @@ name: Screenshots
 #
 # The caller is started by hand (workflow_dispatch) after a change to the look. A commit pushed
 # with the GITHUB_TOKEN starts no other workflow, so the pictures don't run the checks again.
+#
+# A branch behind a ruleset (pull request, status checks) refuses the GITHUB_TOKEN; the secret
+# deploy-key pushes with a deploy key on the ruleset's bypass list instead (as in bump-version.yml).
+# That push starts the branch's on: push workflows. The Playwright image brings openssh-client.
 on:
   workflow_call:
     inputs:
@@ -45,6 +49,10 @@ on:
         description: Name of that database
         type: string
         default: screenshots
+    secrets:
+      deploy-key:
+        description: Private SSH key of a deploy key with write access, for a branch whose ruleset lets deploy keys bypass it
+        required: false
 
 permissions:
   contents: read
@@ -87,6 +95,9 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v7
+        with:
+          # Empty: the GITHUB_TOKEN
+          ssh-key: ${{ secrets.deploy-key }}
 
       # The npm package brings the binary without curl or unzip, which the image lacks
       - name: Bun
diff --git a/README.md b/README.md
index f2a5742..1afd368 100644
--- a/README.md
+++ b/README.md
@@ -656,8 +656,13 @@ jobs:
 | `postgres` | `""` | Postgres image, e.g. `postgres:16`, for a database next to the job; its URL is in `$POSTGRES_URL` |
 | `postgres-db` | `screenshots` | name of that database |
 
+| Secret | |
+|---|---|
+| `deploy-key` | private key of a deploy key with write access, for a branch behind a ruleset; set up as for [Bump version](#bump-version) (the same key can serve both) |
+
 The command starts whatever the pictures need (a dev server, a production build with demo data, a
-mock) and stops it again. Like *Bump version*, the branch must accept pushes from GitHub Actions.
+mock) and stops it again. Like *Bump version*, the branch must accept pushes from GitHub Actions,
+or the push needs the deploy key; that commit then runs the branch's CI.
 
 ## Versions
 
diff --git a/actions/commit-changes/action.yml b/actions/commit-changes/action.yml
index 2cc3858..663f03f 100644
--- a/actions/commit-changes/action.yml
+++ b/actions/commit-changes/action.yml
@@ -3,6 +3,7 @@ description: >-
   Commits what changed under the given paths (screenshots, baselines, generated files) as
   github-actions[bot] and pushes it to the branch the workflow runs on. Nothing changed: nothing
   is committed. The job needs contents: write; a push with the GITHUB_TOKEN starts no other workflow.
+  It pushes with whatever actions/checkout set up, e.g. its ssh-key for a deploy key.
 
 inputs:
   paths: