diff --git a/.github/workflows/merge-bot.yml b/.github/workflows/merge-bot.yml
index 6f91c2c..2fdfe42 100644
--- a/.github/workflows/merge-bot.yml
+++ b/.github/workflows/merge-bot.yml
@@ -143,7 +143,7 @@ jobs:
           # not success is a hard fail. Timeout fails closed.
           for i in $(seq 1 20); do
             ok=1
-            for name in "CodeQL" "Analyze (actions)" "Analyze (python)"; do
+            for name in "CodeQL" "Analyze (actions)" "Analyze (python)" "policy-ci"; do
               c=$(gh api "repos/$GITHUB_REPOSITORY/commits/$HEAD_SHA/check-runs?per_page=100" \
                 --jq "[.check_runs[] | select(.name == \"$name\")] | sort_by(.started_at) | last | if . == null or .status != \"completed\" then \"none\" else .conclusion // \"none\" end")
               echo "attempt $i: $name: $c"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 34f9541..38d7d85 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -52,9 +52,9 @@ jobs:
         run: |
           set -euo pipefail
           id="$(gh run list --repo "$GITHUB_REPOSITORY" --workflow build-environment-image.yml \
-            --commit "$GITHUB_SHA" --status success --event push \
-            --json databaseId,headBranch \
-            --jq '[.[] | select(.headBranch == "main")] | .[0].databaseId // empty')"
+            --commit "$GITHUB_SHA" --status success \
+            --json databaseId,headBranch,event \
+            --jq '[.[] | select(.headBranch == "main" and (.event == "push" or .event == "workflow_dispatch"))] | .[0].databaseId // empty')"
           if [ -z "$id" ]; then
             echo "::error::no successful build-environment-image run on main for $GITHUB_SHA. Tag the commit that built the image."
             exit 1