diff --git a/.gitea/workflows/macos-owned-snapshot.yaml b/.gitea/workflows/macos-owned-snapshot.yaml
new file mode 100644
index 0000000..26910a4
--- /dev/null
+++ b/.gitea/workflows/macos-owned-snapshot.yaml
@@ -0,0 +1,41 @@
+name: One bounded snapshot of the owned macOS experiment
+
+on:
+  workflow_dispatch:
+
+jobs:
+  owned-snapshot:
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    steps:
+      - name: Read only the current experiment's existing logs and counters
+        env:
+          OWNER_TOKEN: "b9ff84e8984c492d8d9a0e35d8a99f10"
+        run: |
+          set -euo pipefail
+          name="meeting-assistant-native-$OWNER_TOKEN"
+          owner=$(docker inspect --format '{{ index .Config.Labels "org.meeting-assistant.native-diagnostic" }}' "$name")
+          [ "$owner" = "$OWNER_TOKEN" ]
+          id=$(docker inspect --format '{{ .Id }}' "$name")
+          mkdir -p artifacts/owned-snapshot
+          docker inspect --format '{{json .State}}' "$id" > artifacts/owned-snapshot/state.json
+          docker logs --timestamps --tail 160 "$id" > artifacts/owned-snapshot/container.log 2>&1
+          docker exec "$id" sh -c '
+            printf "[existing guest proof]\n"
+            if [ -f /storage/13/ci-state/proof.log ]; then tail -c 16384 /storage/13/ci-state/proof.log; fi
+            printf "\n[container counters]\n"
+            cat /sys/fs/cgroup/cpu.stat /sys/fs/cgroup/memory.current /sys/fs/cgroup/memory.events
+            printf "\n[existing monitor]\n"
+            if [ -S /run/shm/monitor.sock ]; then
+              printf "info kvm\ninfo status\n" | timeout -s KILL 5 nc.openbsd -q 1 -w 2 -U /run/shm/monitor.sock || true
+            fi
+          ' > artifacts/owned-snapshot/snapshot.log 2>&1
+          cat artifacts/owned-snapshot/state.json artifacts/owned-snapshot/container.log artifacts/owned-snapshot/snapshot.log
+      - name: Retain the single snapshot
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: native-macos-owned-snapshot
+          path: artifacts/owned-snapshot/
+          if-no-files-found: error
+          retention-days: 7