diff --git a/.github/workflows/build-artifact.yml b/.github/workflows/build-artifact.yml
index f733ca2..f548eaf 100644
--- a/.github/workflows/build-artifact.yml
+++ b/.github/workflows/build-artifact.yml
@@ -1,8 +1,7 @@
 name: Build Bootc Artifact
 on:
-  pull_request:
-    branches:
-      - main
+  # Requires build_type/flavor inputs provided by workflow_dispatch; these do
+  # not exist for pull_request events, so only enable manual dispatch.
   workflow_dispatch:
     inputs:
       build_type:
diff --git a/.github/workflows/reusable-build-image.yml b/.github/workflows/reusable-build-image.yml
index 5ed00e9..1e96def 100644
--- a/.github/workflows/reusable-build-image.yml
+++ b/.github/workflows/reusable-build-image.yml
@@ -201,6 +201,7 @@ jobs:
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
 
       - name: Add SBOM Attestation
+        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         env:
           IMAGE: ${{ steps.registry_case.outputs.lowercase }}/${{ steps.image_case.outputs.lowercase }}
           DIGEST: ${{ steps.push.outputs.digest }}
diff --git a/Containerfile b/Containerfile
index 2a3225f..3d4feed 100644
--- a/Containerfile
+++ b/Containerfile
@@ -41,19 +41,16 @@ RUN tar -xvf prometheus-3.4.0.linux-amd64.tar.gz && \
     COPY observability/prometheus/prometheus.yml /etc/prometheus
     COPY observability/prometheus/prometheus.service /etc/systemd/system
     RUN systemctl enable prometheus
-# Install Loki
-# Refresh base packages and (re)extract the TLS CA bundle before adding the
-# grafana repo. dnf's librepo fails with curl error 77 ("error adding trust
-# anchors from file: /etc/pki/tls/certs/ca-bundle.crt") when that bundle is
-# missing/empty in the bootc build container. Updating ca-certificates runs its
-# %post (update-ca-trust), and we call update-ca-trust explicitly too so the
-# bundle is repopulated even when ca-certificates is already current. This must
-# run before the grafana repo is configured, otherwise dnf tries to refresh
-# grafana's repo metadata against the broken bundle and fails the same way.
-RUN dnf update -y && update-ca-trust
+# Install Loki & Grafana
+# The default system CA trust store works fine; do NOT pin sslcacert to
+# /etc/pki/tls/certs/ca-bundle.crt. That classic Fedora symlink does not
+# exist in the fedora-bootc base image, so dnf fails with curl error 77
+# ("error adding trust anchors from file: ...") when fetching the grafana
+# repo metadata. Omitting sslcacert lets dnf/curl use the system default
+# bundle (extracted by ca-certificates at /etc/pki/ca-trust/extracted/pem/).
 RUN curl -LO https://rpm.grafana.com/gpg.key && \
     rpm --import gpg.key && \
-    echo -e '[grafana]\nname=grafana\nbaseurl=https://rpm.grafana.com\nrepo_gpgcheck=0\nenabled=1\ngpgcheck=1\ngpgkey=https://rpm.grafana.com/gpg.key\nsslverify=1\nsslcacert=/etc/pki/tls/certs/ca-bundle.crt' | sudo tee /etc/yum.repos.d/grafana.repo
+    echo -e '[grafana]\nname=grafana\nbaseurl=https://rpm.grafana.com\nrepo_gpgcheck=0\nenabled=1\ngpgcheck=1\ngpgkey=https://rpm.grafana.com/gpg.key\nsslverify=1' | sudo tee /etc/yum.repos.d/grafana.repo
 RUN dnf install loki grafana -y
 COPY observability/loki/config.yml /etc/loki
 RUN systemctl enable loki.service