diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index bf8eea7..d1105b0 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -7,6 +7,9 @@ on:
       - 'src/**'
       - 'Cargo.toml'
       - '.github/workflows/bench.yml'
+  pull_request:
+    paths:
+      - '.github/workflows/bench.yml'
   schedule:
     - cron: '0 7 * * 1'
   workflow_dispatch:
@@ -28,6 +31,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.head_ref || github.ref_name }}
 
       - uses: dtolnay/rust-toolchain@stable
 
@@ -135,7 +140,9 @@ jobs:
           retention-days: 90
 
       - name: Update docs/benchmarks.md
-        if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+        if: >-
+          github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' ||
+          (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
         run: |
           mkdir -p docs
           {
@@ -150,4 +157,7 @@ jobs:
           git config user.email arkptz@gmail.com
           git add docs/benchmarks.md
           git commit -m "docs(bench): refresh benchmark results"
-          git push
+          BRANCH="${{ github.head_ref || github.ref_name }}"
+          # demo-gif.yml pushes to the same branch and can land first.
+          git pull --rebase --autostash origin "$BRANCH"
+          git push origin HEAD:"$BRANCH"
diff --git a/.github/workflows/demo-gif.yml b/.github/workflows/demo-gif.yml
index 03d1b0d..b4f624a 100644
--- a/.github/workflows/demo-gif.yml
+++ b/.github/workflows/demo-gif.yml
@@ -8,6 +8,10 @@ on:
       - "ci/demo/**"
       - "Cargo.toml"
       - "Cargo.lock"
+  pull_request:
+    paths:
+      - "ci/demo/**"
+      - ".github/workflows/demo-gif.yml"
   workflow_dispatch:
 
 permissions:
@@ -24,6 +28,8 @@ jobs:
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.head_ref || github.ref_name }}
 
       - uses: dtolnay/rust-toolchain@stable
 
@@ -190,8 +196,15 @@ jobs:
           fi
 
       # Auto-commit
+      - name: Rebase onto branch tip
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        # bench.yml pushes to the same branch and can land first.
+        run: git pull --rebase --autostash origin "${{ github.head_ref || github.ref_name }}"
+
       - name: Auto-commit demo artifacts
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         uses: stefanzweifel/git-auto-commit-action@v7
         with:
+          branch: ${{ github.head_ref || github.ref_name }}
           commit_message: "docs: regenerate demo.gif [skip ci]"
           file_pattern: "docs/demo.gif docs/demo.mp4 README.md"
diff --git a/ci/demo/phase3.spec.ts b/ci/demo/phase3.spec.ts
index 2c7d526..21c5f80 100644
--- a/ci/demo/phase3.spec.ts
+++ b/ci/demo/phase3.spec.ts
@@ -26,7 +26,6 @@ test.beforeAll(() => {
     execSync(
       "docker run -d --name swagger-ui -p 8088:8080 " +
         "-e URL=./openapi.yaml " +
-        "-v ${PWD}/out/openapi.yaml:/usr/share/nginx/html/openapi.yaml:ro " +
         "swaggerapi/swagger-ui",
       { stdio: "inherit" },
     );
@@ -47,6 +46,14 @@ test.beforeAll(() => {
     if (!ready) {
       throw new Error("Swagger UI did not become ready in 30s");
     }
+
+    // Not a bind-mount: nginx workers run as `nginx` and can't read a mount
+    // that keeps the host uid/perms, which surfaces as a 403 in the UI.
+    const specPath = "/usr/share/nginx/html/openapi.yaml";
+    execSync(`docker cp out/openapi.yaml swagger-ui:${specPath}`);
+    execSync(`docker exec -u root swagger-ui chmod 644 ${specPath}`);
+
+    execSync("curl -sf http://localhost:8088/openapi.yaml > /dev/null");
   } catch (e) {
     console.error("Failed to start Swagger UI:", e);
     throw e;
diff --git a/docs/benchmarks.md b/docs/benchmarks.md
index e6c52f0..15f7b28 100644
--- a/docs/benchmarks.md
+++ b/docs/benchmarks.md
@@ -4,7 +4,7 @@ Generated by the [benchmark workflow](.github/workflows/bench.yml).
 
 # Benchmark results
 
-_Run: 2026-08-01 18:28 UTC, commit `2ae753be`, runner: Linux 6.17.0-1020-azure_
+_Run: 2026-08-01 19:24 UTC, commit `ddedce0a`, runner: Linux 6.17.0-1020-azure_
 
 Fixture: 89 MB, 40k requests across 8 endpoint shapes (`bench-fixtures-v1`).
 
@@ -12,11 +12,11 @@ Fixture: 89 MB, 40k requests across 8 endpoint shapes (`bench-fixtures-v1`).
 
 | Command | Mean [s] | Min [s] | Max [s] | Relative |
 |:---|---:|---:|---:|---:|
-| `Python mitmproxy2swagger` | 44.838 ± 0.254 | 44.604 | 45.256 | 16.78 ± 0.13 |
-| `Rust mitm2openapi` | 2.672 ± 0.013 | 2.661 | 2.694 | 1.00 |
+| `Python mitmproxy2swagger` | 41.339 ± 0.209 | 41.015 | 41.592 | 15.85 ± 0.15 |
+| `Rust mitm2openapi` | 2.608 ± 0.020 | 2.586 | 2.631 | 1.00 |
 
 ## Peak RSS
 | Tool | RSS |
 |------|----:|
-| Python mitmproxy2swagger | 47088 KB |
-| Rust mitm2openapi        | 7076 KB |
+| Python mitmproxy2swagger | 46912 KB |
+| Rust mitm2openapi        | 7260 KB |
diff --git a/docs/demo.gif b/docs/demo.gif
index 1964bcb..86b9857 100644
Binary files a/docs/demo.gif and b/docs/demo.gif differ
diff --git a/docs/demo.mp4 b/docs/demo.mp4
index 19abf72..9dc55db 100644
Binary files a/docs/demo.mp4 and b/docs/demo.mp4 differ