diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index e98a234..e191bb4 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -28,6 +28,9 @@ on:
         default: deploy
         type: choice
         options: [deploy, validate]
+      chain:
+        description: "chain id under the node's chains/ directory to take miner credentials from (overrides CHAIN); the node deploy's validate step prints it"
+        required: false
 
 # Never half-apply two deploys at once. (Not relied on for correctness of a
 # single host: the restart is checksum-gated and the binary is rsynced atomically.)
@@ -179,9 +182,9 @@ jobs:
           umask 077
           tmp=$(mktemp -d)
           trap 'rm -rf "$tmp"' EXIT
-          nrun sudo cat /var/lib/quantus-node/chains/${{ env.CHAIN }}/miner-auth-token \
+          nrun sudo cat /var/lib/quantus-node/chains/${{ github.event.inputs.chain || env.CHAIN }}/miner-auth-token \
             > "$tmp/miner-auth-token"
-          nrun sudo cat /var/lib/quantus-node/chains/${{ env.CHAIN }}/miner-tls-cert-sha256 \
+          nrun sudo cat /var/lib/quantus-node/chains/${{ github.event.inputs.chain || env.CHAIN }}/miner-tls-cert-sha256 \
             > "$tmp/miner-tls-cert-sha256"
           test -s "$tmp/miner-auth-token"      || { echo "node auth token empty — has ${{ matrix.node }} started?" >&2; exit 1; }
           test -s "$tmp/miner-tls-cert-sha256" || { echo "node TLS pin empty — has ${{ matrix.node }} started?" >&2; exit 1; }