diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index d35ae78..18ee303 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -5,16 +5,20 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
-    types: [opened, synchronize, reopened, labeled]
   merge_group:
+  workflow_dispatch:
+    inputs:
+      ok-to-test:
+        description: Run e2e tests
+        type: boolean
+        default: false
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}-${{ github.event.action == 'labeled' }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:
   build:
-    if: github.event.action != 'labeled'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -27,7 +31,6 @@ jobs:
         run: make build
 
   verify:
-    if: github.event.action != 'labeled'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -40,7 +43,6 @@ jobs:
         run: make verify
 
   test:
-    if: github.event.action != 'labeled'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -53,7 +55,6 @@ jobs:
         run: make test
 
   test-integration:
-    if: github.event.action != 'labeled'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -66,7 +67,8 @@ jobs:
         run: make test-integration
 
   test-e2e:
-    if: github.event_name == 'push' || github.event_name == 'merge_group' || contains(github.event.pull_request.labels.*.name, 'ok-to-test')
+    if: >-
+      github.event_name == 'push' || github.event_name == 'merge_group' || (github.event_name == 'workflow_dispatch' && inputs.ok-to-test) || contains(github.event.pull_request.labels.*.name, 'ok-to-test')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/retest.yaml b/.github/workflows/retest.yaml
new file mode 100644
index 0000000..6e0b4d9
--- /dev/null
+++ b/.github/workflows/retest.yaml
@@ -0,0 +1,47 @@
+name: Retest
+
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  retest:
+    if: >-
+      github.event.issue.pull_request && contains(github.event.comment.body, '/retest')
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      pull-requests: read
+    steps:
+      - name: Check permission
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PERMISSION=$(gh api "repos/${{ github.repository }}/collaborators/${{ github.event.comment.user.login }}/permission" -q .permission)
+          if [[ "$PERMISSION" != "admin" && "$PERMISSION" != "write" ]]; then
+            echo "User ${{ github.event.comment.user.login }} does not have write permission (permission=$PERMISSION)"
+            exit 1
+          fi
+
+      - name: Trigger CI
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_NUMBER=${{ github.event.issue.number }}
+          HEAD_SHA=$(gh pr view "$PR_NUMBER" --json headRefOid -q .headRefOid)
+          RUN_ID=$(gh run list --workflow=ci.yaml --commit="$HEAD_SHA" --limit=1 --json databaseId -q '.[0].databaseId')
+
+          if [ -n "$RUN_ID" ]; then
+            CONCLUSION=$(gh run view "$RUN_ID" --json conclusion -q .conclusion)
+            if [ "$CONCLUSION" = "failure" ]; then
+              gh run rerun "$RUN_ID" --failed
+              exit 0
+            elif [ -z "$CONCLUSION" ]; then
+              echo "CI is already in progress (run $RUN_ID)"
+              exit 0
+            fi
+          fi
+
+          HEAD_REF=$(gh pr view "$PR_NUMBER" --json headRefName -q .headRefName)
+          OK_TO_TEST=$(gh pr view "$PR_NUMBER" --json labels -q '[.labels[].name] | any(. == "ok-to-test")')
+          gh workflow run ci.yaml --ref "$HEAD_REF" -f "ok-to-test=$OK_TO_TEST"