diff --git a/.forgejo/workflows/build-iso.yml b/.forgejo/workflows/build-iso.yml
index ab94870..0aaaa7c 100644
--- a/.forgejo/workflows/build-iso.yml
+++ b/.forgejo/workflows/build-iso.yml
@@ -12,6 +12,7 @@ on:
       - '**/*.md'
       - 'docs/**'
       - 'website/**'
+      - 'ops/**'
       - 'CHANGELOG.md'
       - 'RELEASING.md'
   workflow_dispatch:
diff --git a/website/deploy-ci.sh b/website/deploy-ci.sh
index 454622b..608d55d 100755
--- a/website/deploy-ci.sh
+++ b/website/deploy-ci.sh
@@ -24,4 +24,10 @@ echo "==> hugo build → $WEBROOT"
 cd "$SRCROOT"
 hugo --minify --cleanDestinationDir -d "$WEBROOT"
 
+# The runner job runs as root inside the container; hand the trees back
+# to the VM user so the manual deploy.sh path keeps working afterwards.
+if [ "$(id -u)" = 0 ]; then
+  chown -R "${FURTKA_OWNER:-1000:1000}" "$SRCROOT" "$WEBROOT"
+fi
+
 echo "OK: deployed to https://furtka.org/"