diff --git a/.github/workflows/linux-lua.yml b/.github/workflows/linux-lua.yml
index 8a1151f..646e32f 100644
--- a/.github/workflows/linux-lua.yml
+++ b/.github/workflows/linux-lua.yml
@@ -2,6 +2,11 @@ name: Full native tests
 
 on:
   workflow_dispatch:
+    inputs:
+      windows_diagnostics_run:
+        description: Diagnose a previous Windows runtime without running a release validation
+        type: string
+        default: ""
   workflow_call:
   push:
     # Releases call this entire workflow instead of duplicating branch-push jobs.
@@ -28,9 +33,17 @@ on:
 
 permissions:
   contents: read
+  actions: read
 
 jobs:
+  windows-diagnostics:
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.windows_diagnostics_run != '' }}
+    uses: ./.github/workflows/windows-conformance.yml
+    with:
+      runtime_run: ${{ inputs.windows_diagnostics_run }}
+
   native-tests:
+    if: ${{ inputs.windows_diagnostics_run == '' }}
     name: Tests (${{ matrix.os }})
     strategy:
       fail-fast: false
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b7973e3..70cf187 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -121,6 +121,9 @@ jobs:
 
   native-tests:
     name: Native tests
+    permissions:
+      contents: read
+      actions: read
     if: ${{ !inputs.windows_only }}
     needs: prepare
     uses: ./.github/workflows/linux-lua.yml
diff --git a/.github/workflows/windows-conformance.yml b/.github/workflows/windows-conformance.yml
index 21667b9..db58fe6 100644
--- a/.github/workflows/windows-conformance.yml
+++ b/.github/workflows/windows-conformance.yml
@@ -1,7 +1,7 @@
 name: Windows conformance diagnostics
 
 on:
-  workflow_dispatch:
+  workflow_call:
     inputs:
       runtime_run:
         description: Release run whose Windows runtime artifact should be diagnosed