diff --git a/.woodpecker/apply.yaml b/.woodpecker/apply.yaml
new file mode 100644
index 0000000..50dbb62
--- /dev/null
+++ b/.woodpecker/apply.yaml
@@ -0,0 +1,22 @@
+when:
+  - event: push
+    branch: master
+
+steps:
+  - name: apply
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260308
+    environment:
+      VAULT_AUTH_METHOD: kubernetes
+    commands:
+      - dnf install vault -y
+      - make apply
+    backend_options:
+      kubernetes:
+        serviceAccountName: terraform-vault
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2