diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 1ac9193..6b0766b 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -23,6 +23,10 @@ on:
         description: 'grafana/mcp-grafana GitHub release (empty = latest)'
         required: false
         default: ''
+      suffix:
+        description: 'Image tag suffix for rebuilds of the same upstream version (e.g. -1)'
+        required: false
+        default: ''
 
 env:
   REGISTRY: gitea.williammiceli.systems
@@ -54,7 +58,9 @@ jobs:
           echo "version=$VER" >> "$GITHUB_OUTPUT"
           # Image tag strips a leading 'v' from the release tag (v1.2.3 -> v1.2.3),
           # so the tag is always v<semver> regardless of upstream's tag style.
-          echo "tag=${VER#v}" >> "$GITHUB_OUTPUT"
+          # An optional workflow_dispatch suffix (-1) allows rebuilds of the same
+          # upstream version (e.g. image fixes) without overwriting the original tag.
+          echo "tag=${VER#v}${{ github.event.inputs.suffix }}" >> "$GITHUB_OUTPUT"
           echo "Resolved grafana/mcp-grafana version: $VER"
 
       - name: Skip if already published
diff --git a/Dockerfile b/Dockerfile
index 6b1e6ce..2494889 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -27,7 +27,10 @@ ARG MCP_GRAFANA_VERSION
 ARG TARGETARCH
 
 # curl + tar + coreutils (sha256sum/grep) to fetch and verify the pinned
-# upstream release. ca-certificates for HTTPS to github.com.
+# upstream release. ca-certificates for HTTPS to github.com — and the CA
+# bundle is copied into the final scratch image too, because Grafana
+# (GF_SERVER_ENFORCE_DOMAIN=true) redirects API calls to its canonical
+# https:// domain and Go's TLS verification needs the bundle.
 RUN apk add --no-cache curl tar coreutils ca-certificates
 
 WORKDIR /tmp
@@ -49,8 +52,11 @@ RUN set -eux; \
     chmod +x mcp-grafana
 
 # The binary is fully static (no INTERP segment) — scratch is sufficient.
+# The CA bundle is copied in for TLS verification of redirected Grafana
+# requests (Grafana enforces its canonical https:// domain).
 FROM scratch
 
+COPY --from=fetch /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=fetch /tmp/mcp-grafana /mcp-grafana
 
 EXPOSE 3000