diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9af0b84..08e9bfd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,7 +3,8 @@ name: ci
 env:
   NODE_VERSION: 20
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   push:
@@ -76,3 +77,8 @@ jobs:
         NODE_VERSION: ${{ env.NODE_VERSION }}
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+
+  deploy-cdk-tools:
+    if: ${{ github.ref == 'refs/heads/main' }}
+    needs: [audit, lint, test, build, sonarcloud]
+    uses: ./.github/workflows/deploy-cdk-tools.yml
diff --git a/.github/workflows/infrastructure.yml b/.github/workflows/deploy-cdk-env.yml
similarity index 95%
rename from .github/workflows/infrastructure.yml
rename to .github/workflows/deploy-cdk-env.yml
index 54f8243..1e18548 100644
--- a/.github/workflows/infrastructure.yml
+++ b/.github/workflows/deploy-cdk-env.yml
@@ -1,4 +1,4 @@
-name: infrastructure-env
+name: deploy-cdk-env
 
 env:
   NODE_VERSION: 20
@@ -40,7 +40,7 @@ jobs:
           base: main
           filters: |
             infrastructure:
-              - '.github/workflows/infrastructure.yml'
+              - '.github/workflows/deploy-cdk-env.yml'
               - 'infrastructure/src/env/**'
               - '!**/*.md'
 
diff --git a/.github/workflows/tools.yml b/.github/workflows/deploy-cdk-tools.yml
similarity index 93%
rename from .github/workflows/tools.yml
rename to .github/workflows/deploy-cdk-tools.yml
index 0f18395..bf961ac 100644
--- a/.github/workflows/tools.yml
+++ b/.github/workflows/deploy-cdk-tools.yml
@@ -1,4 +1,4 @@
-name: infrastructure-tools
+name: deploy-cdk-tools
 
 env:
   NODE_VERSION: 20
@@ -9,11 +9,7 @@ permissions:
   contents: read
 
 on:
-  workflow_run:
-    workflows: ["ci"]
-    branches: [main]
-    types:
-      - completed
+  workflow_call:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
@@ -33,7 +29,7 @@ jobs:
           base: main
           filters: |
             infrastructure:
-              - '.github/workflows/tools.yml'
+              - '.github/workflows/deploy-cdk-tools.yml'
               - 'infrastructure/src/tools/**'
               - '!**/*.md'
             baseimage: