diff --git a/.github/workflows/deploy-ecs.yml b/.github/workflows/deploy-lower-env.yml
similarity index 63%
rename from .github/workflows/deploy-ecs.yml
rename to .github/workflows/deploy-lower-env.yml
index 72db89b3e..e9ce3e1e6 100644
--- a/.github/workflows/deploy-ecs.yml
+++ b/.github/workflows/deploy-lower-env.yml
@@ -1,4 +1,6 @@
-name: Deploy to ECS
+name: Deploy to lower environment (dev etc)
+
+permissions: {}
 
 on:
   schedule:
@@ -12,11 +14,21 @@ on:
   push:
     branches: master
 
-permissions:
-  contents: read
+concurrency:
+  group: deploy-${{ inputs.environment }}
+  cancel-in-progress: true
 
 jobs:
+  check-env:
+    name: Fail if production environment
+    if: ${{ inputs.environment == 'prod' }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          echo "Failing intentionally. Please use the 'Deploy to production' workflow."
+          exit 1
   call-workflow:
+    if: ${{ inputs.environment != 'prod' }}
     permissions:
       contents: read
       id-token: write # needed for AWS OIDC authentication
diff --git a/.github/workflows/deploy-prod.yml b/.github/workflows/deploy-prod.yml
new file mode 100644
index 000000000..d4c8851c6
--- /dev/null
+++ b/.github/workflows/deploy-prod.yml
@@ -0,0 +1,37 @@
+name: Deploy to prod
+
+permissions: {}
+
+on:
+  workflow_dispatch:
+  release:
+    types:
+      - released
+
+concurrency:
+  group: deploy-prod
+  cancel-in-progress: true
+
+jobs:
+  check-ref:
+    name: Fail if not a tag
+    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          echo "Failing intentionally. Only tags may be deployed to prod."
+          exit 1
+  call-workflow:
+    if: ${{ startsWith(github.ref, 'refs/tags/') }}
+    permissions:
+      id-token: write # Needed to access ECR and ECS
+      contents: read # Needed to access commit details and other repository info
+    uses: mbta/workflows/.github/workflows/deploy-ecs.yml@c76e5ccd9556fbea52bc41548f7ceed5985ad775 # v5.1.0
+    with:
+      app-name: arrow
+      environment: prod
+      docker-additional-tags: prod
+    secrets:
+      aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}
+      docker-repo: ${{ secrets.DOCKER_REPO }}
+      slack-webhook: ${{ secrets.SLACK_WEBHOOK }}