diff --git a/.woodpecker/apply.yaml b/.woodpecker/apply.yaml
index 36986f1..112d696 100644
--- a/.woodpecker/apply.yaml
+++ b/.woodpecker/apply.yaml
@@ -9,8 +9,7 @@ steps:
       VAULT_AUTH_METHOD: kubernetes
     commands:
       - dnf install vault -y
-      - make plan
-      - make apply
+      - make apply-if-changes
     backend_options:
       kubernetes:
         serviceAccountName: terraform-git
diff --git a/Makefile b/Makefile
index 640077e..332592c 100644
--- a/Makefile
+++ b/Makefile
@@ -25,6 +25,19 @@ plan: init
 	@$(call vault_env) && \
 	terragrunt run --all --parallelism 4 --non-interactive plan
 
+apply-if-changes: init
+	@$(call vault_env) && \
+	terragrunt run --all --parallelism 4 --non-interactive plan -- -detailed-exitcode -out=tfplan; \
+	EXIT_CODE=$$?; \
+	if [ $$EXIT_CODE -eq 2 ]; then \
+		$(call vault_env) && \
+		terragrunt run --all --parallelism 2 --non-interactive apply -- tfplan; \
+	elif [ $$EXIT_CODE -eq 0 ]; then \
+		echo "No changes detected, skipping apply."; \
+	else \
+		exit $$EXIT_CODE; \
+	fi
+
 apply: init
 	@$(call vault_env) && \
 	terragrunt run --all --parallelism 2 --non-interactive apply