diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index cd95d79..901c25d 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -13,6 +13,14 @@ on:
         options:
           - direct
           - proxy
+      upload_debug_artifacts:
+        description: 'Upload redacted diagnostics on failure for this manual run'
+        required: true
+        default: 'false'
+        type: choice
+        options:
+          - 'false'
+          - 'true'
 
 permissions:
   contents: write
@@ -71,15 +79,14 @@ jobs:
           GCP_SECRET_ID: ${{ vars.GCP_SECRET_ID }}
           SCHWAB_REDIRECT_URI: ${{ vars.SCHWAB_REDIRECT_URI }}
 
-      - name: Upload Error Screenshot
-        if: failure()
+      - name: Upload Redacted Diagnostics
+        if: failure() && github.event_name == 'workflow_dispatch' && inputs.upload_debug_artifacts == 'true'
         uses: actions/upload-artifact@v7
         with:
-          name: debug-screenshots
+          name: redacted-diagnostics
           path: |
-            *.png
             *_diagnostics.json
-          retention-days: 3
+          retention-days: 1
 
       - name: Update Log (Bash Version)
         if: success()
diff --git a/tests/test_workflow_config_sources.sh b/tests/test_workflow_config_sources.sh
index 9eb91b7..6691afb 100644
--- a/tests/test_workflow_config_sources.sh
+++ b/tests/test_workflow_config_sources.sh
@@ -22,7 +22,9 @@ grep -Eq "channel: ['\"]chrome['\"]" "$repo_dir/main.js"
 grep -Fq 'PW_TEST_SCREENSHOT_NO_FONTS_READY' "$repo_dir/main.js"
 grep -Fq '#placeholderCode' "$repo_dir/main.js"
 grep -Fq '#continueButton' "$repo_dir/main.js"
-grep -Fq '            *.png' "$workflow_file"
+grep -Fq 'upload_debug_artifacts:' "$workflow_file"
+grep -Fq 'Upload Redacted Diagnostics' "$workflow_file"
+grep -Fq "inputs.upload_debug_artifacts == 'true'" "$workflow_file"
 grep -Fq '            *_diagnostics.json' "$workflow_file"
 
 if grep -Fq 'google-chrome-stable_current_amd64.deb' "$workflow_file"; then
@@ -35,6 +37,11 @@ if grep -Fq 'npx playwright install --with-deps chromium' "$workflow_file"; then
   exit 1
 fi
 
+if grep -Fq '            *.png' "$workflow_file"; then
+  echo "workflow should not upload screenshots by default" >&2
+  exit 1
+fi
+
 if grep -Fq 'secrets.GCP_PROJECT_ID' "$workflow_file"; then
   echo "workflow should not read GCP_PROJECT_ID from secrets anymore" >&2
   exit 1