diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 2eeba49..a29085f 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -2,7 +2,7 @@ name: Tests
 
 permissions:
   id-token: write
-  contents: read
+  contents: write
 
 on:
   push:
@@ -21,19 +21,47 @@ jobs:
       LOCATION: eastus
       DEPLOYMENT_NAME: keyweave-${{ github.run_id }}
     steps:
-    - uses: actions/checkout@v3
-    - uses: azure/login@v1
-      with:
-        client-id: ${{ secrets.AZURE_CLIENT_ID }}
-        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
-        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-    - name: Deploy Bicep template
-      uses: azure/arm-deploy@v1
-      with:
-        scope: subscription
-        region: ${{ env.LOCATION }}
-        template: bicep/main.bicep
-        deploymentName: ${{ env.DEPLOYMENT_NAME }}
+      - uses: actions/checkout@v3
+      - name: Fetch complete history
+        run: git fetch --prune --unshallow
+      - name: Check for deployed tag
+        id: check_tag
+        run: |
+          if git rev-parse --verify deployed >/dev/null 2>&1; then
+            echo "DEPLOYED_TAG_EXISTS=true" >> $GITHUB_ENV
+            echo "LAST_DEPLOYED_COMMIT=$(git rev-list -n 1 deployed)" >> $GITHUB_ENV
+          else
+            echo "DEPLOYED_TAG_EXISTS=false" >> $GITHUB_ENV
+          fi
+      - name: Check for changes in bicep folder
+        if: env.DEPLOYED_TAG_EXISTS == 'true'
+        run: |
+          if git diff --quiet $LAST_DEPLOYED_COMMIT HEAD -- bicep/ ; then
+            echo "NO_CHANGES=true" >> $GITHUB_ENV
+          else
+            echo "NO_CHANGES=false" >> $GITHUB_ENV
+          fi
+      - if: env.DEPLOYED_TAG_EXISTS == 'false' || env.NO_CHANGES == 'false'
+        uses: azure/login@v1
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+      - if: env.DEPLOYED_TAG_EXISTS == 'false' || env.NO_CHANGES == 'false'
+        name: Deploy Bicep template
+        uses: azure/arm-deploy@v1
+        with:
+          scope: subscription
+          region: ${{ env.LOCATION }}
+          template: bicep/main.bicep
+          deploymentName: ${{ env.DEPLOYMENT_NAME }}
+      - if: env.DEPLOYED_TAG_EXISTS == 'false' || env.NO_CHANGES == 'false'
+        name: Tag Deployment
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -fa deployed -m "Deployed to Azure"
+          git push origin --tags --force
 
   tests-no-access:
     name: Tests with No Access