diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 000000000..c43160cf9
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,50 @@
+name: Deploy to prototype environment
+
+on:
+  workflow_run:
+    workflows: [ Run checks ]
+    types:
+      - completed
+    # branches: [ main ]
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+
+    steps:
+    - name: Install container dependencies
+      run: |
+        sudo apt-get update \
+        && sudo apt-get install -y --no-install-recommends \
+        libcurl4-openssl-dev
+    - uses: actions/checkout@v3
+    - name: Set up Python 3.9
+      uses: actions/setup-python@v3
+      with:
+        python-version: "3.9"
+    - name: Install application dependencies
+      run: make bootstrap
+    - name: Install Cloud Foundry CLI
+      run: |
+        curl -v -L -o cf-cli_amd64.deb 'https://packages.cloudfoundry.org/stable?release=debian64&version=v7&source=github'
+        sudo dpkg -i cf-cli_amd64.deb
+    - name: Deploy to gsa-10x-prototyping api
+      run: make cf-deploy
+      with:
+        CF_ORG: gsa-10x-prototyping
+        CF_SPACE: 10x-notifications
+        CF_APP: notifications-api
+        DANGEROUS_SALT: {{secrets.DANGEROUS_SALT}}
+        SECRET_KEY: {{secrets.SECRET_KEY}}
+        AWS_ACCESS_KEY_ID: {{secrets.AWS_ACCESS_KEY_ID}}
+        AWS_SECRET_ACCESS_KEY: {{secrets.AWS_SECRET_ACCESS_KEY}}
+
+  bail:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'failure' }}
+    steps:
+      - run: echo 'Checks failed, preventing deploy'
\ No newline at end of file
diff --git a/Makefile b/Makefile
index b54db203e..f349e33a4 100644
--- a/Makefile
+++ b/Makefile
@@ -133,14 +133,8 @@ cf-deploy: ## Deploys the app to Cloud Foundry
 	# cancel any existing deploys to ensure we can apply manifest (if a deploy is in progress you'll see ScaleDisabledDuringDeployment)
 	cf cancel-deployment ${CF_APP} || true
 
-	# generate manifest (including secrets) and write it to CF_MANIFEST_PATH (in /tmp/)
-	make -s CF_APP=${CF_APP} generate-manifest > ${CF_MANIFEST_PATH}
-
 	# fails after 15 mins if deploy doesn't work
-	# reads manifest from CF_MANIFEST_PATH
-	CF_STARTUP_TIMEOUT=15 cf push ${CF_APP} --strategy=rolling -f ${CF_MANIFEST_PATH}
-	# delete old manifest file
-	rm ${CF_MANIFEST_PATH}
+	CF_STARTUP_TIMEOUT=15 cf push ${CF_APP} --strategy=rolling
 
 .PHONY: cf-deploy-api-db-migration
 cf-deploy-api-db-migration: