diff --git a/config/modules/meta/deploy.nix b/config/modules/meta/deploy.nix
index 12026aa8..09e401c0 100644
--- a/config/modules/meta/deploy.nix
+++ b/config/modules/meta/deploy.nix
@@ -32,7 +32,7 @@ in
 {
   imports = [
     (toString (sources.tf-nix + "/modules/run.nix"))
-  ] ++ (optional (builtins.pathExists ../../trusted/tf/tf.nix) (../../trusted/tf/tf.nix));
+  ] ++ (optional (builtins.pathExists ../../tf/tf.nix) (../../tf/tf.nix));
   options = {
     deploy = {
       dataDir = mkOption {
@@ -83,6 +83,15 @@ in
                 deps = {
                   select.allProviders = true;
                   enable = true;
+/*
+                  apply = {
+                    doneCommand = ''
+                      git -C "${cfg.dataDir}" add -A
+                      git -C "${cfg.dataDir}" commit -m "${config.name}: $(date +'%F %T')"
+                      git -C "${cfg.dataDir}" push
+                      '';
+                      };
+*/
                 };
                 terraform = {
                   version = "1.0";
@@ -101,8 +110,21 @@ in
                     attrPrefix = "deploy.targets.${name}.tf.runners.run.";
                   };
                   run = {
-                    apply.name = "${name}-apply";
+                    apply.name = "${name}-apply-uw";
                     terraform.name = "${name}-tf";
+                    myApply = {
+                      name = "${name}-apply";
+                      command = let
+                        path = toString cfg.dataDir;
+                      in ''
+                        set -e
+                        git -C "${path}" pull
+                        ${config.tf.runners.run.apply.package}/bin/${config.tf.runners.run.apply.executable}
+                        git -C "${path}" add -A
+                        git -C "${path}" commit -m "${config.name}: $(date +'%F %T')"
+                        git -C "${path}" push --force
+                      '';
+                    };
                   };
                 };
                 continue.envVar = "TF_NIX_CONTINUE_${replaceStrings [ "-" ] [ "_" ] config.name}";
diff --git a/config/tf b/config/tf
new file mode 160000
index 00000000..c1263b12
--- /dev/null
+++ b/config/tf
@@ -0,0 +1 @@
+Subproject commit c1263b12d719256ffcf2a8fb49a9a821caa229b3
diff --git a/config/trusted b/config/trusted
index b7078463..24d46cfc 160000
--- a/config/trusted
+++ b/config/trusted
@@ -1 +1 @@
-Subproject commit b70784634ce12f0c53859767c52e31e6f8e1ead7
+Subproject commit 24d46cfc0082e042628f05600ab2d648dd6d4fe6