diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3ebc727..fbe2f8a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,7 @@
 name: CI
 
 on:
+  workflow_dispatch:
   push:
   pull_request:
   schedule:
diff --git a/test/transport_test.go b/test/transport_test.go
index 04e6463..7335a77 100644
--- a/test/transport_test.go
+++ b/test/transport_test.go
@@ -311,7 +311,15 @@ func TestShouldRejectNonConnectFrameGivenNewTransportWhenFrameSentBeforeAuthenti
 		frame := protocol.EncodeFrameOwned(protocol.MessageTypeKvBegin, nil)
 		defer frame.Release()
 		require.NoError(t, trans.Write(ctx, frame.Bytes()))
-		_, err = trans.Read(ctx)
+		// New brokers may send an unsolicited SERVER_HELLO before rejecting the
+		// unauthenticated domain frame. Drain any such capability advertisement
+		// and assert that the session is ultimately closed.
+		for {
+			_, err = trans.Read(ctx)
+			if err != nil {
+				break
+			}
+		}
 		require.Error(t, err)
 	})
 }