diff --git a/.tangled/workflows/deploy-gcp-dev.yml b/.tangled/workflows/deploy-gcp-dev.yml
new file mode 100644
index 000000000..7a3331b32
--- /dev/null
+++ b/.tangled/workflows/deploy-gcp-dev.yml
@@ -0,0 +1,95 @@
+when:
+  - event: push
+    branch: sv-fe
+    paths:
+      - bobbin/**
+      - crates/**
+      - lexicons/**
+      - Cargo.toml
+      - Cargo.lock
+      - rust-toolchain.toml
+      - web/**
+      - flake.nix
+      - flake.lock
+      - nix/pkgs/web-static-files.nix
+      - .tangled/workflows/deploy-gcp-dev.yml
+
+engine: microvm
+image: nixos
+
+virtualisation:
+  docker: true
+
+dependencies:
+  - google-cloud-sdk
+
+environment:
+  GCP_PROJECT: exemplary-proxy-507408-d6
+  GCP_REGION: europe-north1
+  REGISTRY: europe-north1-docker.pkg.dev/exemplary-proxy-507408-d6/tangled
+  CI_SERVICE_ACCOUNT: ci-deployer-next@exemplary-proxy-507408-d6.iam.gserviceaccount.com
+  IM_SERVICE_ACCOUNT: im-deployer-next@exemplary-proxy-507408-d6.iam.gserviceaccount.com
+  DEPLOYMENT: tangled-dev
+  TF_VERSION: "=1.5.7"
+  VITE_OAUTH_CLIENT_ID: https://svfe-next-264757501569.europe-north1.run.app/oauth-client-metadata.json
+  VITE_OAUTH_REDIRECT_URI: https://svfe-next-264757501569.europe-north1.run.app/oauth/callback
+
+steps:
+  - name: authenticate to gcp
+    command: |
+      set -eu
+      mkdir -p ~/.config/gcloud
+      printf '%s' "$GCP_CI_CREDENTIALS" > ~/.config/gcloud/application_default_credentials.json
+      gcloud config set project "$GCP_PROJECT" --quiet
+      gcloud config set auth/impersonate_service_account "$CI_SERVICE_ACCOUNT" --quiet
+      gcloud auth configure-docker "$GCP_REGION-docker.pkg.dev" --quiet
+      # fail fast if auth is dead
+      gcloud auth print-access-token >/dev/null
+
+  # bobbin's Containerfile copies from the repo root, so the root is the context
+  - name: build and push bobbin
+    command: |
+      set -eu
+      tag="dev-${TANGLED_COMMIT_SHA:0:8}"
+      docker build \
+        --file=bobbin/containerfiles/bobbin.Containerfile \
+        --tag="$REGISTRY/bobbin-next:$tag" \
+        .
+      docker push "$REGISTRY/bobbin-next:$tag"
+      echo "bobbin-next:$tag"
+
+  - name: build and push svfe
+    command: |
+      set -eu
+      tag="dev-${TANGLED_COMMIT_SHA:0:8}"
+
+      out=$(nix build .#web-static-files --no-link --print-out-paths)
+      mkdir -p web/static
+      rm -rf web/static/fonts web/static/logos
+      cp -fr "$out"/* web/static
+
+      docker build \
+        --file=web/Containerfile \
+        --build-arg VITE_OAUTH_CLIENT_ID="$VITE_OAUTH_CLIENT_ID" \
+        --build-arg VITE_OAUTH_REDIRECT_URI="$VITE_OAUTH_REDIRECT_URI" \
+        --tag="$REGISTRY/svfe-next:$tag" \
+        web/
+      docker push "$REGISTRY/svfe-next:$tag"
+      echo "svfe-next:$tag"
+
+  # reuse the last deployed blueprint here.
+  # we are only changing the container image
+  - name: deploy
+    command: |
+      set -eu
+      dep="projects/$GCP_PROJECT/locations/$GCP_REGION/deployments/$DEPLOYMENT"
+
+      src=$(gcloud infra-manager deployments describe "$dep" \
+        --format='value(terraformBlueprint.gcsSource)')
+
+      gcloud infra-manager deployments apply "$dep" \
+        --service-account="projects/$GCP_PROJECT/serviceAccounts/$IM_SERVICE_ACCOUNT" \
+        --gcs-source="$src" \
+        --tf-version-constraint="$TF_VERSION"
+
+      gcloud infra-manager deployments describe "$dep" --format='value(latestRevision)'