diff --git a/.forgejo/workflows/build-iso.yml b/.forgejo/workflows/build-iso.yml
index 7e825fc..37b72cf 100644
--- a/.forgejo/workflows/build-iso.yml
+++ b/.forgejo/workflows/build-iso.yml
@@ -51,6 +51,17 @@ jobs:
           retention-days: 14
           if-no-files-found: error
 
+      - name: Cache ISO for smoke-latest
+        # Persist the ISO to /data/smoke-cache/latest.iso so the
+        # smoke-latest.yml workflow_dispatch job can re-test without
+        # rebuilding. /data is already mounted into the runner container
+        # at a matching host path.
+        run: |
+          mkdir -p /data/smoke-cache
+          iso=$(ls iso/out/*.iso | head -1)
+          cp -f "$iso" /data/smoke-cache/latest.iso
+          ls -lh /data/smoke-cache/latest.iso
+
       - name: Smoke-test ISO on Proxmox test host
         # Inlined as a step (rather than a separate job with `needs:`) so
         # we can reuse the ISO that's already in the workspace — Forgejo's
diff --git a/.forgejo/workflows/smoke-latest.yml b/.forgejo/workflows/smoke-latest.yml
new file mode 100644
index 0000000..b4a7e18
--- /dev/null
+++ b/.forgejo/workflows/smoke-latest.yml
@@ -0,0 +1,41 @@
+name: Smoke latest ISO
+
+# Manual-trigger smoke test against the last ISO `build-iso.yml` produced.
+# Use this when you've changed something that only affects smoke-vm.sh,
+# the PVE setup, or the secrets — skips the 25-min ISO rebuild and only
+# runs the ~2-min VM boot + /:5000 check.
+#
+# The ISO lives at /data/smoke-cache/latest.iso on the runner, populated
+# by build-iso.yml's "Cache ISO for smoke-latest" step. That path is
+# inside the runner's already-mounted /data volume, so no extra bind
+# mounts needed.
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: smoke-latest
+  cancel-in-progress: false
+
+jobs:
+  smoke:
+    runs-on: self-hosted
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check cached ISO exists
+        run: |
+          iso=/data/smoke-cache/latest.iso
+          if [ ! -f "$iso" ]; then
+            echo "::error::$iso not found — trigger build-iso.yml first to populate the cache."
+            exit 1
+          fi
+          echo "Will smoke: $iso"
+          ls -lh "$iso"
+
+      - name: Smoke-test ISO on Proxmox test host
+        env:
+          PVE_TEST_HOST: ${{ secrets.PVE_TEST_HOST }}
+          PVE_TEST_TOKEN: ${{ secrets.PVE_TEST_TOKEN }}
+          SMOKE_SHA: ${{ github.sha }}
+        run: ./scripts/smoke-vm.sh /data/smoke-cache/latest.iso