diff --git a/.github/actions/commit-terraform-lock-file/action.yml b/.github/actions/commit-terraform-lock-file/action.yml
new file mode 100644
index 0000000..22a8ce2
--- /dev/null
+++ b/.github/actions/commit-terraform-lock-file/action.yml
@@ -0,0 +1,20 @@
+name: "Commit Terraform Lock File"
+description: "Commit Terraform lock file."
+
+runs:
+  using: "composite"
+  steps:
+    - shell: bash
+      run: |
+        git config user.name "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+        git add .terraform.lock.hcl
+
+        if git diff --staged --quiet; then
+          echo "No Terraform lock file changes."
+          exit 0
+        fi
+
+        git commit -m "chore: update terraform lock file"
+        git push
diff --git a/.github/workflows/terraform-apply.yml b/.github/workflows/terraform-apply.yml
index 560129a..5b27418 100644
--- a/.github/workflows/terraform-apply.yml
+++ b/.github/workflows/terraform-apply.yml
@@ -2,34 +2,35 @@ name: "Terraform Apply"
 
 on:
   push:
-    branches:
-      - main
+    branches: [main]
+    paths-ignore:
+      - ".terraform.lock.hcl"
 
 permissions:
-  contents: read
+  contents: write
 
 jobs:
   apply:
     name: "Terraform Apply"
     runs-on: ubuntu-latest
-    
+    environment: production
+    env:
+      TF_CLI_ARGS: "-no-color"
+
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v6
+      - uses: actions/checkout@v6
 
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v4
+      - uses: hashicorp/setup-terraform@v4
 
-      - name: Terraform Init
+      - run: terraform init -backend-config="endpoints={s3=\"https://${CLOUDFLARE_ACCOUNT_ID}.r2.cloudflarestorage.com\"}"
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-        run: |
-          terraform init \
-            -backend-config="endpoints={s3=\"https://${CLOUDFLARE_ACCOUNT_ID}.r2.cloudflarestorage.com\"}"
 
-      - name: Terraform Apply
+      - uses: ./.github/actions/commit-terraform-lock-file
+
+      - run: terraform apply -auto-approve
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
@@ -38,4 +39,3 @@ jobs:
           TF_VAR_toropon_ip: ${{ secrets.TOROPON_IP }}
           TF_VAR_argotunnel_cname_target: ${{ secrets.ARGOTUNNEL_CNAME_TARGET }}
           TF_VAR_gh_pages_challenge_content: ${{ secrets.GH_PAGES_CHALLENGE_CONTENT }}
-        run: terraform apply -auto-approve -no-color
diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml
index 3d575fa..a2c2966 100644
--- a/.github/workflows/terraform-plan.yml
+++ b/.github/workflows/terraform-plan.yml
@@ -2,8 +2,7 @@ name: "Terraform Plan"
 
 on:
   pull_request:
-    branches:
-      - main
+    branches: [main]
 
 permissions:
   contents: read
@@ -12,30 +11,14 @@ jobs:
   plan:
     name: "Terraform Plan"
     runs-on: ubuntu-latest
-    
+    env:
+      TF_CLI_ARGS: "-no-color"
+
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v6
+      - uses: actions/checkout@v6
 
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v4
+      - uses: hashicorp/setup-terraform@v4
 
-      - name: Terraform Init
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-        run: |
-          terraform init \
-            -backend-config="endpoints={s3=\"https://${CLOUDFLARE_ACCOUNT_ID}.r2.cloudflarestorage.com\"}"
+      - run: terraform init -backend=false
 
-      - name: Terraform Plan
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          TF_VAR_cloudflare_api_token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          TF_VAR_cloudflare_account_id: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          TF_VAR_toropon_ip: ${{ secrets.TOROPON_IP }}
-          TF_VAR_argotunnel_cname_target: ${{ secrets.ARGOTUNNEL_CNAME_TARGET }}
-          TF_VAR_gh_pages_challenge_content: ${{ secrets.GH_PAGES_CHALLENGE_CONTENT }}
-        run: terraform plan -no-color
+      - run: terraform validate