diff --git a/pyproject.toml b/pyproject.toml
index 49f3dab..9572f16 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "gds-idea-app-kit"
-version = "0.2.2"
+version = "0.2.3"
 description = "CLI tool for scaffolding and maintaining GDS IDEA web apps on AWS"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/gds_idea_app_kit/init.py b/src/gds_idea_app_kit/init.py
index 2b84fcf..d5881d1 100644
--- a/src/gds_idea_app_kit/init.py
+++ b/src/gds_idea_app_kit/init.py
@@ -278,6 +278,12 @@ def run_init(framework: str, app_name: str, python_version: str) -> None:
         variables=template_vars,
     )
 
+    # -- Copy CI/CD workflow --
+    _copy_template(
+        templates / "common" / "ci_cd_cdk_app.yml",
+        project_dir / ".github" / "workflows" / "ci_cd_cdk_app.yml",
+    )
+
     # -- Copy .devcontainer/ files --
     _copy_template(
         templates / "common" / "devcontainer.json",
diff --git a/src/gds_idea_app_kit/manifest.py b/src/gds_idea_app_kit/manifest.py
index 7e49c6d..106bb63 100644
--- a/src/gds_idea_app_kit/manifest.py
+++ b/src/gds_idea_app_kit/manifest.py
@@ -16,6 +16,7 @@
 # Files that `update` manages, keyed by source location in the templates directory.
 # The dict maps template source path -> destination path in the project.
 TOOL_OWNED_FILES = {
+    "common/ci_cd_cdk_app.yml": ".github/workflows/ci_cd_cdk_app.yml",
     "common/devcontainer.json": ".devcontainer/devcontainer.json",
     "common/docker-compose.yml": ".devcontainer/docker-compose.yml",
     "dev_mocks/dev_mock_authoriser.json": "dev_mocks/dev_mock_authoriser.json",
diff --git a/src/gds_idea_app_kit/templates/common/ci_cd_cdk_app.yml b/src/gds_idea_app_kit/templates/common/ci_cd_cdk_app.yml
new file mode 100644
index 0000000..31c870e
--- /dev/null
+++ b/src/gds_idea_app_kit/templates/common/ci_cd_cdk_app.yml
@@ -0,0 +1,47 @@
+name: CI/CD Orchestrator for CDK Apps
+
+on:
+  push:
+    branches: 
+      - prod
+      - dev
+
+permissions:
+  id-token: write
+  contents: read
+  pull-requests: write
+  
+jobs:
+  ci_pr_dev:
+    uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/ci_pr_dev.yml@main
+    with:
+      run-version-check: false
+      
+  ci_build:
+    uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/ci_build.yml@main
+    with:
+      run-version-check: false
+
+  ci_pyproject_version:
+    uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/ci_pyproject_version.yml@main
+    with:
+      run-version-check: false
+
+  ci_lint:
+    uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/ci_lint.yml@main
+    with:
+      run-version-check: false
+
+  ci_tests:
+    uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/ci_tests.yml@main
+    with:
+      run-version-check: false
+
+  ci_cdk_diff:
+    uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/ci_cdk_diff.yml@main
+    with:
+      run-version-check: false
+
+  cd:
+    needs: [ci_pr_dev, ci_build, ci_pyproject_version, ci_lint, ci_tests, ci_cdk_diff]
+    uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/cd_workflow_cdk.yml@main
diff --git a/tests/test_manifest.py b/tests/test_manifest.py
index ae4fd19..67ad376 100644
--- a/tests/test_manifest.py
+++ b/tests/test_manifest.py
@@ -31,6 +31,8 @@ def tracked_project(project_dir):
     (project_dir / ".devcontainer").mkdir()
     (project_dir / ".devcontainer" / "devcontainer.json").write_text("{}")
     (project_dir / ".devcontainer" / "docker-compose.yml").write_text("services:")
+    (project_dir / ".github" / "workflows").mkdir(parents=True)
+    (project_dir / ".github" / "workflows" / "ci_cd_cdk_app.yml").write_text("name: CI/CD")
     (project_dir / "dev_mocks").mkdir()
     (project_dir / "dev_mocks" / "dev_mock_authoriser.json").write_text("{}")
     (project_dir / "dev_mocks" / "dev_mock_user.json").write_text("{}")
@@ -84,6 +86,7 @@ def test_hash_file_binary(tmp_path):
 def test_tracked_files_include_common_destinations(framework):
     tracked = get_tracked_files(framework)
     destinations = set(tracked.values())
+    assert ".github/workflows/ci_cd_cdk_app.yml" in destinations
     assert ".devcontainer/devcontainer.json" in destinations
     assert ".devcontainer/docker-compose.yml" in destinations
     assert "dev_mocks/dev_mock_authoriser.json" in destinations
@@ -174,7 +177,7 @@ def test_build_manifest_hashes_all_tracked_files(tracked_project):
     assert result["framework"] == "streamlit"
     assert result["app_name"] == "test-app"
     assert result["tool_version"] == "0.1.0"
-    assert len(result["files"]) == 5
+    assert len(result["files"]) == 6
     for file_hash in result["files"].values():
         assert file_hash.startswith("sha256:")
 
diff --git a/uv.lock b/uv.lock
index d533ea5..869dca7 100644
--- a/uv.lock
+++ b/uv.lock
@@ -52,7 +52,7 @@ wheels = [
 
 [[package]]
 name = "gds-idea-app-kit"
-version = "0.2.2"
+version = "0.2.3"
 source = { editable = "." }
 dependencies = [
     { name = "boto3" },