diff --git a/.github/workflows/dashboard.yml b/.github/workflows/dashboard.yml
new file mode 100644
index 0000000000..8b9bd453ec
--- /dev/null
+++ b/.github/workflows/dashboard.yml
@@ -0,0 +1,51 @@
+name: 65-dashboard
+run-name: "[${{ github.event_name == 'push' && 'APPLY' || 'PLAN' }}] 65-dashboard → ${{ github.event_name == 'push' && github.ref_name || github.head_ref }}"
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "ops/services/65-dashboard/**"
+      - ".github/workflows/dashboard.yml"
+      - ".github/workflows/tofu-run.yml"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "ops/services/65-dashboard/**"
+      - ".github/workflows/dashboard.yml"
+      - ".github/workflows/tofu-run.yml"
+
+concurrency:
+  group: tofu-dashboard-plan-or-apply
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  setup:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: codebuild-ab2d-non-prod-${{ github.run_id }}-${{ github.run_attempt }}
+    outputs:
+      apply: ${{ steps.check.outputs.apply }}
+      branch: ${{ steps.check.outputs.branch }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.3.0
+      - id: check
+        run: |
+          echo "apply=${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}" >> $GITHUB_OUTPUT
+          echo "branch=${{ github.head_ref || github.ref }}" >> $GITHUB_OUTPUT
+
+  prod:
+    needs: setup
+    uses: ./.github/workflows/tofu-run.yml
+    with:
+      service: "65-dashboard"
+      environment: "prod"
+      apply: ${{ needs.setup.outputs.apply }}
+      branch: ${{ needs.setup.outputs.branch }}
+    secrets: inherit
diff --git a/.github/workflows/monitors.yml b/.github/workflows/monitors.yml
new file mode 100644
index 0000000000..978117259e
--- /dev/null
+++ b/.github/workflows/monitors.yml
@@ -0,0 +1,78 @@
+name: 60-monitors
+run-name: "[${{ github.event_name == 'push' && 'APPLY' || 'PLAN' }}] 60-monitors → ${{ github.event_name == 'push' && github.ref_name || github.head_ref }}"
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "ops/services/60-monitors/**"
+      - ".github/workflows/monitors.yml"
+      - ".github/workflows/tofu-run.yml"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "ops/services/60-monitors/**"
+      - ".github/workflows/monitors.yml"
+      - ".github/workflows/tofu-run.yml"
+
+concurrency:
+  group: tofu-monitors-plan-or-apply
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  setup:
+    runs-on: codebuild-ab2d-non-prod-${{ github.run_id }}-${{ github.run_attempt }}
+    outputs:
+      apply: ${{ steps.check.outputs.apply }}
+      branch: ${{ steps.check.outputs.branch }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.3.0
+      - id: check
+        run: |
+          echo "apply=${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}" >> $GITHUB_OUTPUT
+          echo "branch=${{ github.head_ref || github.ref }}" >> $GITHUB_OUTPUT
+
+  dev:
+    needs: setup
+    uses: ./.github/workflows/tofu-run.yml
+    with:
+      service: "60-monitors"
+      environment: "dev"
+      apply: ${{ needs.setup.outputs.apply }}
+      branch: ${{ needs.setup.outputs.branch }}
+    secrets: inherit
+
+  test:
+    needs: [setup, dev]
+    uses: ./.github/workflows/tofu-run.yml
+    with:
+      service: "60-monitors"
+      environment: "test"
+      apply: ${{ needs.setup.outputs.apply }}
+      branch: ${{ needs.setup.outputs.branch }}
+    secrets: inherit
+
+  sandbox:
+    needs: [setup, test]
+    uses: ./.github/workflows/tofu-run.yml
+    with:
+      service: "60-monitors"
+      environment: "sandbox"
+      apply: ${{ needs.setup.outputs.apply }}
+      branch: ${{ needs.setup.outputs.branch }}
+    secrets: inherit
+
+  prod:
+    needs: [setup, sandbox]
+    uses: ./.github/workflows/tofu-run.yml
+    with:
+      service: "60-monitors"
+      environment: "prod"
+      apply: ${{ needs.setup.outputs.apply }}
+      branch: ${{ needs.setup.outputs.branch }}
+    secrets: inherit
diff --git a/.github/workflows/tofu-run.yml b/.github/workflows/tofu-run.yml
new file mode 100644
index 0000000000..baffee4b28
--- /dev/null
+++ b/.github/workflows/tofu-run.yml
@@ -0,0 +1,55 @@
+name: tofu-run
+
+on:
+  workflow_call:
+    inputs:
+      service:
+        required: true
+        type: string
+      environment:
+        required: true
+        type: string
+      apply:
+        required: true
+        type: string
+      branch:
+        required: true
+        type: string
+
+env:
+  TENV_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+jobs:
+  tofu:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: codebuild-ab2d-${{ contains(fromJSON('["dev", "test"]'), inputs.environment) && 'non-prod' || 'prod' }}-${{ github.run_id }}-${{ github.run_attempt }}
+    env:
+      APP: ab2d
+      ENV: ${{ inputs.environment }}
+    defaults:
+      run:
+        working-directory: ops/services/${{ inputs.service }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.3.0
+        with:
+          ref: ${{ inputs.branch }}
+      - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+      - uses: cmsgov/cdap/actions/setup-tenv@f4c14d47cc20e7f6de9112d7155af1213c9bca5a
+      - uses: cmsgov/cdap/actions/setup-sops@f4c14d47cc20e7f6de9112d7155af1213c9bca5a
+      - uses: cmsgov/cdap/actions/setup-yq@f4c14d47cc20e7f6de9112d7155af1213c9bca5a
+      - uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        with:
+          role-to-assume: arn:aws:iam::${{ contains(fromJSON('["dev", "test"]'), inputs.environment) && secrets.NON_PROD_ACCOUNT || secrets.PROD_ACCOUNT }}:role/delegatedadmin/developer/ab2d-${{ inputs.environment }}-github-actions
+          aws-region: ${{ vars.AWS_REGION }}
+
+      - name: tofu plan
+        run: |
+          tofu init -var=parent_env=$ENV -reconfigure
+          tofu workspace select -var=parent_env=$ENV -or-create=true $ENV
+          tofu plan -no-color -input=false -out=tfplan
+
+      - name: tofu apply
+        if: inputs.apply == 'true'
+        run: tofu apply -no-color -input=false tfplan
diff --git a/ops/services/60-monitors/variables.tf b/ops/services/60-monitors/variables.tf
deleted file mode 100644
index 8b13789179..0000000000
--- a/ops/services/60-monitors/variables.tf
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/ops/services/65-dashboard/variables.tf b/ops/services/65-dashboard/variables.tf
deleted file mode 100644
index e69de29bb2..0000000000