diff --git a/.github/workflows/deploy-dev-blue-scheduled.yml b/.github/workflows/deploy-dev-blue-scheduled.yml
new file mode 100644
index 00000000..2db0ea28
--- /dev/null
+++ b/.github/workflows/deploy-dev-blue-scheduled.yml
@@ -0,0 +1,28 @@
+name: Scheduled deploy to dev-blue
+
+on:
+  schedule:
+    - cron: "0 5 * * *"
+
+permissions:
+  contents: read # Needed to checkout repo
+
+concurrency:
+  group: deploy-dev-blue
+  cancel-in-progress: true
+
+jobs:
+  call-workflow:
+    name: Call MBTA deploy-ecs workflow
+    permissions:
+      contents: read # Needed to checkout repo
+      id-token: write # Needed to access ECR and ECS
+    uses: mbta/workflows/.github/workflows/deploy-ecs.yml@c76e5ccd9556fbea52bc41548f7ceed5985ad775 # v5.1.0
+    with:
+      app-name: api
+      environment: dev-blue
+      docker-additional-tags: dev-blue
+    secrets:
+      aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}
+      docker-repo: ${{ secrets.DOCKER_REPO }}
+      slack-webhook: ${{ secrets.SLACK_WEBHOOK }}
diff --git a/.github/workflows/deploy-dev-blue.yml b/.github/workflows/deploy-dev-blue.yml
deleted file mode 100644
index 8fa18c78..00000000
--- a/.github/workflows/deploy-dev-blue.yml
+++ /dev/null
@@ -1,48 +0,0 @@
-name: Deploy to Dev-blue (ECS)
-
-on:
-  schedule:
-    - cron: "0 5 * * *"
-  workflow_dispatch:
-
-permissions: {}
-
-concurrency:
-  group: deploy-dev-blue
-  cancel-in-progress: true
-
-jobs:
-  deploy:
-    name: Deploy
-    runs-on: ubuntu-latest
-    permissions:
-      id-token: write # Needed to communicate with AWS
-      contents: read # Needed to check out code
-    environment: dev-blue
-    concurrency: dev-blue
-    if: github.repository_owner == 'mbta'
-    env:
-      ECS_CLUSTER: api
-      ECS_SERVICE: api-dev-blue
-
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-      - uses: mbta/actions/build-push-ecr@62db3e5c547c3c7f439c4a7fb98e69fc79c1a9cc # v2.21
-        id: build-push
-        with:
-          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
-          docker-repo: ${{ secrets.DOCKER_REPO }}
-          docker-additional-tags: dev-blue
-      - uses: mbta/actions/deploy-ecs@62db3e5c547c3c7f439c4a7fb98e69fc79c1a9cc # v2.21
-        with:
-          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
-          ecs-cluster: ${{ env.ECS_CLUSTER }}
-          ecs-service: ${{ env.ECS_SERVICE }}
-          docker-tag: ${{ steps.build-push.outputs.docker-tag }}
-      - uses: mbta/actions/notify-slack-deploy@62db3e5c547c3c7f439c4a7fb98e69fc79c1a9cc # v2.21
-        if: ${{ !cancelled() }}
-        with:
-          webhook-url: ${{ secrets.SLACK_WEBHOOK }}
-          job-status: ${{ job.status }}
diff --git a/.github/workflows/deploy-dev-green.yml b/.github/workflows/deploy-dev-green.yml
deleted file mode 100644
index 60ae27cf..00000000
--- a/.github/workflows/deploy-dev-green.yml
+++ /dev/null
@@ -1,44 +0,0 @@
-name: Deploy to Dev-green (ECS)
-
-on: workflow_dispatch
-
-permissions: {}
-
-concurrency:
-  group: deploy-dev-green
-  cancel-in-progress: true
-
-jobs:
-  deploy:
-    name: Deploy
-    runs-on: ubuntu-latest
-    permissions:
-      id-token: write # Needed to communicate with AWS
-      contents: read # Needed to check out code
-    environment: dev-green
-    concurrency: dev-green
-    env:
-      ECS_CLUSTER: api
-      ECS_SERVICE: api-dev-green
-
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-      - uses: mbta/actions/build-push-ecr@62db3e5c547c3c7f439c4a7fb98e69fc79c1a9cc # v2.21
-        id: build-push
-        with:
-          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
-          docker-repo: ${{ secrets.DOCKER_REPO }}
-          docker-additional-tags: dev-green
-      - uses: mbta/actions/deploy-ecs@62db3e5c547c3c7f439c4a7fb98e69fc79c1a9cc # v2.21
-        with:
-          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
-          ecs-cluster: ${{ env.ECS_CLUSTER }}
-          ecs-service: ${{ env.ECS_SERVICE }}
-          docker-tag: ${{ steps.build-push.outputs.docker-tag }}
-      - uses: mbta/actions/notify-slack-deploy@62db3e5c547c3c7f439c4a7fb98e69fc79c1a9cc # v2.21
-        if: ${{ !cancelled() }}
-        with:
-          webhook-url: ${{ secrets.SLACK_WEBHOOK }}
-          job-status: ${{ job.status }}
diff --git a/.github/workflows/deploy-dev.yml b/.github/workflows/deploy-dev.yml
deleted file mode 100644
index 808b2342..00000000
--- a/.github/workflows/deploy-dev.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-name: Deploy to Dev (ECS)
-
-on:
-  workflow_dispatch:
-  push:
-    branches: [master]
-
-permissions: {}
-
-concurrency:
-  group: deploy-dev
-  cancel-in-progress: true
-
-jobs:
-  deploy:
-    name: Deploy
-    runs-on: ubuntu-latest
-    permissions:
-      id-token: write # Needed to communicate with AWS
-      contents: read # Needed to check out code
-    environment: dev
-    concurrency: dev
-    env:
-      ECS_CLUSTER: api
-      ECS_SERVICE: api-dev
-
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-      - uses: mbta/actions/build-push-ecr@62db3e5c547c3c7f439c4a7fb98e69fc79c1a9cc # v2.21
-        id: build-push
-        with:
-          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
-          docker-repo: ${{ secrets.DOCKER_REPO }}
-          docker-additional-tags: dev
-      - uses: mbta/actions/deploy-ecs@62db3e5c547c3c7f439c4a7fb98e69fc79c1a9cc # v2.21
-        with:
-          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
-          ecs-cluster: ${{ env.ECS_CLUSTER }}
-          ecs-service: ${{ env.ECS_SERVICE }}
-          docker-tag: ${{ steps.build-push.outputs.docker-tag }}
-      - uses: mbta/actions/notify-slack-deploy@62db3e5c547c3c7f439c4a7fb98e69fc79c1a9cc # v2.21
-        if: ${{ !cancelled() }}
-        with:
-          webhook-url: ${{ secrets.SLACK_WEBHOOK }}
-          job-status: ${{ job.status }}
diff --git a/.github/workflows/deploy-lower-env.yml b/.github/workflows/deploy-lower-env.yml
new file mode 100644
index 00000000..9abb0ade
--- /dev/null
+++ b/.github/workflows/deploy-lower-env.yml
@@ -0,0 +1,43 @@
+name: Deploy to lower environment (dev etc)
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        type: environment
+        default: dev
+        required: true
+  push:
+    branches: master
+
+permissions:
+  contents: read # Needed to checkout repo
+
+concurrency:
+  group: deploy-${{ inputs.environment }}
+  cancel-in-progress: true
+
+jobs:
+  check-env:
+    name: Fail if production environment
+    if: ${{ inputs.environment == 'prod' }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          echo "Failing intentionally. Please use the 'Deploy to production' workflow."
+          exit 1
+  call-workflow:
+    name: Call MBTA deploy-ecs workflow
+    if: ${{ inputs.environment != 'prod' }}
+    permissions:
+      contents: read # Needed to checkout repo
+      id-token: write # Needed to access ECR and ECS
+    uses: mbta/workflows/.github/workflows/deploy-ecs.yml@c76e5ccd9556fbea52bc41548f7ceed5985ad775 # v5.1.0
+    with:
+      app-name: api
+      environment: ${{ inputs.environment }}
+      docker-additional-tags: ${{ inputs.environment }}
+    secrets:
+      aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}
+      docker-repo: ${{ secrets.DOCKER_REPO }}
+      slack-webhook: ${{ secrets.SLACK_WEBHOOK }}
diff --git a/.github/workflows/deploy-prod.yml b/.github/workflows/deploy-prod.yml
index d58fce2c..2cbb4ff4 100644
--- a/.github/workflows/deploy-prod.yml
+++ b/.github/workflows/deploy-prod.yml
@@ -1,45 +1,39 @@
-name: Deploy to Prod (ECS)
+name: Deploy to Prod
 
-on: workflow_dispatch
+on:
+  workflow_dispatch:
+  release:
+    types:
+      - released
 
-permissions: {}
+permissions:
+  contents: read # Needed to checkout repo
 
 concurrency:
   group: deploy-prod
   cancel-in-progress: true
 
 jobs:
-  deploy:
-    name: Deploy
+  check-ref:
+    name: Fail if not a tag
+    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write # Needed to communicate with AWS
-      contents: read # Needed to check out code
-    environment: prod
-    concurrency: prod
-    env:
-      ECS_CLUSTER: api
-      ECS_SERVICE: api-prod
-
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-      - uses: mbta/actions/build-push-ecr@788f8e264e9ebb1b76b927c89e6466d5a162be80 # v2.24
-        id: build-push
-        with:
-          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
-          docker-repo: ${{ secrets.DOCKER_REPO }}
-          docker-additional-tags: prod
-      - name: Deploy to ECS
-        uses: mbta/actions/deploy-ecs@788f8e264e9ebb1b76b927c89e6466d5a162be80 # v2.24
-        with:
-          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
-          ecs-cluster: ${{ env.ECS_CLUSTER }}
-          ecs-service: ${{ env.ECS_SERVICE }}
-          docker-tag: ${{ steps.build-push.outputs.docker-tag }}
-      - uses: mbta/actions/notify-slack-deploy@788f8e264e9ebb1b76b927c89e6466d5a162be80 # v2.24
-        if: ${{ !cancelled() }}
-        with:
-          webhook-url: ${{ secrets.SLACK_WEBHOOK }}
-          job-status: ${{ job.status }}
+      - run: |
+          echo "Failing intentionally. Only tags may be deployed to prod."
+          exit 1
+  call-workflow:
+    name: Call MBTA deploy-ecs workflow
+    if: ${{ startsWith(github.ref, 'refs/tags/') }}
+    permissions:
+      contents: read # Needed to checkout repo
+      id-token: write # Needed to access ECR and ECS
+    uses: mbta/workflows/.github/workflows/deploy-ecs.yml@c76e5ccd9556fbea52bc41548f7ceed5985ad775 # v5.1.0
+    with:
+      app-name: api
+      environment: ${{ inputs.environment }}
+      docker-additional-tags: ${{ inputs.environment }}
+    secrets:
+      aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}
+      docker-repo: ${{ secrets.DOCKER_REPO }}
+      slack-webhook: ${{ secrets.SLACK_WEBHOOK }}