diff --git a/.gitea/workflows/drill.yml b/.gitea/workflows/drill.yml
index e93adf3..a9298a5 100644
--- a/.gitea/workflows/drill.yml
+++ b/.gitea/workflows/drill.yml
@@ -10,7 +10,11 @@ on:
   schedule:
     # 04:17 UTC on the 1st — after the 03:00 stage-local nightly backups.
     - cron: '17 4 1 * *'
-  workflow_dispatch:
+  # On demand: push a `drill-<anything>` tag (`git tag drill-$(date +%s) &&
+  # git push origin --tags`). Gitea 1.22 cannot dispatch workflows via API
+  # or UI (that arrives in 1.23 — then add workflow_dispatch here).
+  push:
+    tags: ['drill-*']
 
 env:
   IMAGE_BASE: gitea.101010.cloud/stwaidele/dorfteich
diff --git a/docs/operations/restore-runbook.md b/docs/operations/restore-runbook.md
index f719c74..4b71309 100644
--- a/docs/operations/restore-runbook.md
+++ b/docs/operations/restore-runbook.md
@@ -34,8 +34,9 @@ never corruption.
 
 ## Automated monthly drill (`.gitea/workflows/drill.yml`)
 
-Runs on the 1st of each month (and on demand via _Run workflow_): it
-executes `deploy/backup/drill.sh`, which
+Runs on the 1st of each month — and on demand by pushing a `drill-*` tag
+(`git tag drill-$(date +%s) && git push origin --tags`; Gitea 1.22 has no
+workflow-dispatch button yet). It executes `deploy/backup/drill.sh`, which
 
 - reads the drilled stage's backups volume **read-only** (stage volumes are
   never touched — everything scratch lives under a unique