diff --git a/src/api/client.js b/src/api/client.js
index cd520b0..3651599 100644
--- a/src/api/client.js
+++ b/src/api/client.js
@@ -179,10 +179,14 @@ export class ZinoClient {
   async uploadFile(file, ctx) {
     const form = new FormData()
     form.append('file', file)
-    if (ctx.workflowUuid) form.append('workflow_uuid', ctx.workflowUuid)
-    if (ctx.activityId)   form.append('activity_id', ctx.activityId)
-    if (ctx.fieldId)      form.append('field_id', ctx.fieldId)
-    if (ctx.instanceId)   form.append('instance_id', String(ctx.instanceId))
+    // workflow_uuid is REQUIRED and is fixed for this app, so it is taken from
+    // config rather than from ctx. Passing it optionally is how the first
+    // version shipped: the upload sent activity_id, field_id and instance_id
+    // and got back `Missing required params: workflow_uuid`.
+    form.append('workflow_uuid', WORKFLOW)
+    if (ctx.activityId) form.append('activity_id', ctx.activityId)
+    if (ctx.fieldId)    form.append('field_id', ctx.fieldId)
+    if (ctx.instanceId) form.append('instance_id', String(ctx.instanceId))
     const headers = {}
     if (this.token) headers['Authorization'] = `Bearer ${this.token}`
     const res = await fetch(`${this.baseUrl}/app/${APP_ID}/upload`, { method: 'POST', headers, body: form })