diff --git a/.gitea/workflows/cms-deploy.yml b/.gitea/workflows/cms-deploy.yml
index ba5266d..11a4264 100644
--- a/.gitea/workflows/cms-deploy.yml
+++ b/.gitea/workflows/cms-deploy.yml
@@ -44,6 +44,13 @@ jobs:
             ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:latest
             ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ gitea.sha }}
 
+      - name: Install AWS CLI
+        run: |
+          curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
+          unzip -q awscliv2.zip
+          sudo ./aws/install
+          rm -rf awscliv2.zip aws
+
       # cluster/service ARNs come from `pulumi stack output ecsClusterArn` /
       # `cmsServiceArn` in the infrastructure project — set once as repo
       # variables (Settings > Actions > Variables), not secrets, since ARNs