diff --git a/.tangled/workflows/deploy-gcp-dev.yml b/.tangled/workflows/deploy-gcp-dev.yml
index 5d31c9692..c1a275390 100644
--- a/.tangled/workflows/deploy-gcp-dev.yml
+++ b/.tangled/workflows/deploy-gcp-dev.yml
@@ -89,7 +89,8 @@ steps:
       echo "svfe-next:$tag"
 
   # reuse the last deployed blueprint here.
-  # we are only changing the container image
+  # the image ref input is what rolls the services: terraform diffs the image
+  # string, and a floating :dev tag looks unchanged, so pin the sha tag
   - name: deploy
     command: |
       set -eu
@@ -99,9 +100,13 @@ steps:
       src=$(gcloud infra-manager deployments describe "$dep" \
         --format='value(terraformBlueprint.gcsSource)')
 
+      ref=":dev-${TANGLED_COMMIT_SHA:0:8}"
+      printf 'env_name = "dev"\nimage_refs = { bobbin = "%s", svfe = "%s" }\n' "$ref" "$ref" > /tmp/im-inputs.env
+
       gcloud infra-manager deployments apply "$dep" \
         --service-account="projects/$GCP_PROJECT/serviceAccounts/$IM_SERVICE_ACCOUNT" \
         --gcs-source="$src" \
+        --inputs-file=/tmp/im-inputs.env \
         --tf-version-constraint="$TF_VERSION"
 
       gcloud infra-manager deployments describe "$dep" --format='value(latestRevision)'