diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8238b1f..c89e098 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -14,3 +14,13 @@ updates:
         update-types:
           - "minor"
           - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 628bfb5..79eb97a 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -13,71 +13,31 @@ permissions:
   id-token: write
   attestations: write
 
-env:
-  TOFU_VERSION: "1.11.4"
-
 jobs:
-  validate-modules:
-    name: Format and Validate Modules
-    runs-on: ubuntu-latest
+  verify-deployment:
+    name: Verify Deployment
     if: github.ref == 'refs/heads/main'
+    uses: ./.github/workflows/verify-deployment.yml
+    secrets: inherit
+    with:
+      ref: ${{ github.sha }}
+
+  publish:
+    name: Publish
+    needs: verify-deployment
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup OpenTofu
-        uses: opentofu/setup-opentofu@v1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          tofu_version: ${{ env.TOFU_VERSION }}
-
-      - name: Initialize and validate all modules
-        run: |
-          echo "Initializing and validating all Terraform modules..."
-          failed_modules=""
-          
-          for module in modules/*/; do
-            echo "============================================"
-            echo "Processing: $module"
-            echo "============================================"
-            
-            cd "$module"
-            
-            echo "Running tofu init..."
-            if ! tofu init -backend=false; then
-              echo "::error::tofu init failed for $module"
-              failed_modules="$failed_modules $module"
-              cd - > /dev/null
-              continue
-            fi
-            
-            echo "Running tofu validate..."
-            if ! tofu validate; then
-              echo "::error::tofu validate failed for $module"
-              failed_modules="$failed_modules $module"
-            else
-              echo "✓ $module validated successfully"
-            fi
-            
-            cd - > /dev/null
-          done
-          
-          if [[ -n "$failed_modules" ]]; then
-            echo "::error::The following modules failed validation:$failed_modules"
-            exit 1
-          fi
-          
-          echo "All modules validated successfully!"
+          persist-credentials: false
 
       - name: Determine version
         id: version
         run: |
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            VERSION="${{ inputs.version }}"
-          else
-            VERSION="${{ github.ref_name }}"
-          fi
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "Release version: $VERSION"
+          echo "version=${{ inputs.version }}" >> $GITHUB_OUTPUT
+          echo "Release version: ${{ inputs.version }}"
 
       - name: Create GitHub Release
         env:
@@ -87,8 +47,7 @@ jobs:
 
           gh release create "$VERSION" \
             --title "$VERSION" \
-            --generate-notes \
-            $PRERELEASE_FLAG
+            --generate-notes
 
       - name: Download release artifacts for attestation
         env:
@@ -102,7 +61,7 @@ jobs:
 
       - name: Generate provenance attestation
         id: attestation
-        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: release-artifacts/*
 
diff --git a/.github/workflows/tflint.yml b/.github/workflows/tflint.yml
deleted file mode 100644
index c1115c2..0000000
--- a/.github/workflows/tflint.yml
+++ /dev/null
@@ -1,118 +0,0 @@
-name: Terraform Quality
-
-on:
-  pull_request:
-    paths:
-      - "src/**"
-      - ".github/workflows/tflint.yml"
-  push:
-    branches:
-      - main
-    paths:
-      - "src/**"
-      - ".github/workflows/tflint.yml"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: terraform-quality-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  format:
-    name: Format
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup OpenTofu
-        uses: opentofu/setup-opentofu@v1
-        with:
-          tofu_version: "1.12.5"
-
-      - name: Check formatting
-        run: tofu -chdir=src fmt -check -diff -recursive
-
-  validate:
-    name: Validate
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup OpenTofu
-        uses: opentofu/setup-opentofu@v1
-        with:
-          tofu_version: "1.12.5"
-
-      - name: Initialize and validate Terraform configurations
-        shell: bash
-        run: |
-          set -euo pipefail
-          mapfile -t terraform_directories < <(
-            find src -type f -name '*.tf' -not -path '*/.terraform/*' -printf '%h\n' | sort -u
-          )
-
-          for directory in "${terraform_directories[@]}"; do
-            echo "Validating $directory"
-            tofu -chdir="$directory" init -backend=false -input=false -no-color
-            tofu -chdir="$directory" validate -no-color
-          done
-
-  test:
-    name: Configuration Tests
-    runs-on: ubuntu-latest
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false
-    timeout-minutes: 30
-    env:
-      STACKIT_SERVICE_ACCOUNT_KEY: ${{ secrets.STACKIT_SERVICE_ACCOUNT_KEY }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup OpenTofu
-        uses: opentofu/setup-opentofu@v1
-        with:
-          tofu_version: "1.12.5"
-
-      - name: Configure STACKIT credentials
-        shell: bash
-        run: |
-          set -euo pipefail
-          test -n "$STACKIT_SERVICE_ACCOUNT_KEY"
-          install -d -m 700 "$HOME/.stackit"
-          printf '%s' "$STACKIT_SERVICE_ACCOUNT_KEY" > "$HOME/.stackit/credentials.json"
-          chmod 600 "$HOME/.stackit/credentials.json"
-
-      - name: Initialize test configuration
-        run: tofu -chdir=src init -backend=false -input=false -no-color
-
-      - name: Run configuration tests
-        run: tofu -chdir=src test -no-color
-
-  tflint:
-    name: TFLint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup TFLint
-        uses: terraform-linters/setup-tflint@v4
-        with:
-          tflint_version: v0.60.0
-
-      - name: Show version
-        run: tflint --version
-
-      - name: Init TFLint
-        run: tflint --chdir=src --init
-
-      - name: Run TFLint (blocking except unused declarations)
-        run: tflint --chdir=src --recursive --format compact --minimum-failure-severity=warning --disable-rule=terraform_unused_declarations --disable-rule=terraform_required_providers
-
-      - name: Run TFLint (unused declarations report only)
-        continue-on-error: true
-        run: tflint --chdir=src --recursive --format compact --only=terraform_unused_declarations
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
new file mode 100644
index 0000000..c6c8724
--- /dev/null
+++ b/.github/workflows/validate.yml
@@ -0,0 +1,141 @@
+name: Validate
+
+on:
+  pull_request:
+    paths:
+      - "src/**"
+      - ".github/workflows/validate.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - "src/**"
+      - ".github/workflows/validate.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: validate-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  TOFU_VERSION: "1.12.5"
+  TFLINT_VERSION: "v0.60.0"
+  TF_PLUGIN_CACHE_DIR: /home/runner/.terraform.d/plugin-cache
+
+jobs:
+  format:
+    name: Format
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup OpenTofu
+        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
+        with:
+          tofu_version: ${{ env.TOFU_VERSION }}
+
+      - name: Check formatting
+        run: tofu -chdir=src fmt -check -diff -recursive
+
+  tflint:
+    name: TFLint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup TFLint
+        uses: terraform-linters/setup-tflint@1cf010d3c7aef302051ccdb68c14c5dc2efa34ef # v6.3.1
+        with:
+          tflint_version: ${{ env.TFLINT_VERSION }}
+
+      - name: Show version
+        run: tflint --version
+
+      - name: Init TFLint
+        run: tflint --chdir=src --init
+
+      - name: Run TFLint (blocking except unused declarations)
+        run: tflint --chdir=src --recursive --format compact --minimum-failure-severity=warning --disable-rule=terraform_unused_declarations --disable-rule=terraform_required_providers
+
+      - name: Run TFLint (unused declarations report only)
+        continue-on-error: true
+        run: tflint --chdir=src --recursive --format compact --only=terraform_unused_declarations
+
+  validate:
+    name: Validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup OpenTofu
+        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
+        with:
+          tofu_version: ${{ env.TOFU_VERSION }}
+
+      - name: Cache provider plugins
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ env.TF_PLUGIN_CACHE_DIR }}
+          key: tofu-plugins-${{ runner.os }}-${{ env.TOFU_VERSION }}-${{ hashFiles('src/**/terraform.tf') }}
+          restore-keys: |
+            tofu-plugins-${{ runner.os }}-${{ env.TOFU_VERSION }}-
+
+      - name: Initialize and validate Terraform configurations
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$TF_PLUGIN_CACHE_DIR"
+          mapfile -t terraform_directories < <(
+            find src -type f -name '*.tf' -not -path '*/.terraform/*' -printf '%h\n' | sort -u
+          )
+
+          for directory in "${terraform_directories[@]}"; do
+            echo "Validating $directory"
+            tofu -chdir="$directory" init -backend=false -input=false -no-color
+            tofu -chdir="$directory" validate -no-color
+          done
+
+  test:
+    name: Configuration Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup OpenTofu
+        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
+        with:
+          tofu_version: ${{ env.TOFU_VERSION }}
+
+      - name: Cache provider plugins
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ env.TF_PLUGIN_CACHE_DIR }}
+          key: tofu-plugins-${{ runner.os }}-${{ env.TOFU_VERSION }}-${{ hashFiles('src/**/terraform.tf') }}
+          restore-keys: |
+            tofu-plugins-${{ runner.os }}-${{ env.TOFU_VERSION }}-
+
+      - name: Initialize test configuration
+        run: |
+          mkdir -p "$TF_PLUGIN_CACHE_DIR"
+          tofu -chdir=src init -backend=false -input=false -no-color
+
+      - name: Run configuration tests
+        run: tofu -chdir=src test -no-color
diff --git a/.github/workflows/verify-deployment.yml b/.github/workflows/verify-deployment.yml
new file mode 100644
index 0000000..faa4c73
--- /dev/null
+++ b/.github/workflows/verify-deployment.yml
@@ -0,0 +1,261 @@
+name: Verify Deployment
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: "Revision to verify"
+        required: false
+        type: string
+        default: ""
+      var_file:
+        description: "Variable file below src/ that the cycle deploys"
+        required: false
+        type: string
+        default: "config/hub-and-spoke-firewall.tfvars"
+  workflow_dispatch:
+    inputs:
+      var_file:
+        description: "Variable file below src/ that the cycle deploys"
+        required: false
+        type: string
+        default: "config/hub-and-spoke-firewall.tfvars"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: landing-zone-test
+  cancel-in-progress: false
+
+env:
+  TOFU_VERSION: "1.12.5"
+  TF_IN_AUTOMATION: "true"
+  TF_INPUT: "false"
+  TF_VAR_FILE: ${{ inputs.var_file }}
+  OPNSENSE_IMAGE_URL: "https://opnsense.object.storage.eu01.onstackit.cloud/opnsense-26.1-amd64-21-05-2026.qcow2"
+  OPNSENSE_IMAGE_SHA256: "5d0fb1cb4375eb258859cafc688f1e5e6f830f54f8d86b9e8bb815611bae1068"
+
+jobs:
+  cycle:
+    name: Plan, apply and destroy
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    environment: terraform-plan
+    env:
+      STACKIT_SERVICE_ACCOUNT_KEY: ${{ secrets.STACKIT_SERVICE_ACCOUNT_KEY }}
+      TF_VAR_owner_email: ${{ vars.TF_VAR_OWNER_EMAIL }}
+      TF_VAR_company_name: ${{ vars.TF_VAR_COMPANY_NAME }}
+      TF_VAR_company_code: ${{ vars.TF_VAR_COMPANY_CODE }}
+      TF_VAR_organization_id: ${{ vars.TF_VAR_ORGANIZATION_ID }}
+      TF_VAR_region: ${{ vars.TF_VAR_REGION }}
+    steps:
+      - name: Checkout revision under verification
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+          persist-credentials: false
+
+      - name: Check inputs
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ "$TF_VAR_FILE" = /* || "$TF_VAR_FILE" == *".."* || ! -f "src/$TF_VAR_FILE" ]]; then
+            echo "::error::var_file must reference an existing file below src (current value: $TF_VAR_FILE)."
+            exit 1
+          fi
+          missing=""
+          require() {
+            if [[ -z "$2" ]]; then
+              missing="$missing $1"
+            fi
+          }
+
+          require TF_VAR_ORGANIZATION_ID "$TF_VAR_organization_id"
+          require TF_VAR_OWNER_EMAIL "$TF_VAR_owner_email"
+          require TF_VAR_COMPANY_NAME "$TF_VAR_company_name"
+          require TF_VAR_COMPANY_CODE "$TF_VAR_company_code"
+          require TF_VAR_REGION "$TF_VAR_region"
+          require TF_STATE_BUCKET "${{ vars.TF_STATE_BUCKET }}"
+
+          if [[ -n "$missing" ]]; then
+            echo "::error::Missing repository or environment variables:$missing"
+            echo "::error::An unset variable becomes an empty string, not a default. Refusing to deploy."
+            exit 1
+          fi
+
+      - name: Configure STACKIT credentials
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ -z "$STACKIT_SERVICE_ACCOUNT_KEY" ]]; then
+            echo "::error::Environment secret STACKIT_SERVICE_ACCOUNT_KEY is missing or empty."
+            exit 1
+          fi
+          install -d -m 700 "$HOME/.stackit"
+          printf '%s' "$STACKIT_SERVICE_ACCOUNT_KEY" > "$HOME/.stackit/credentials.json"
+          chmod 600 "$HOME/.stackit/credentials.json"
+
+      - name: Restore OPNsense image cache
+        id: opnsense-image-cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: src/firewall-image.qcow2
+          key: opnsense-image-${{ env.OPNSENSE_IMAGE_SHA256 }}
+
+      - name: Download OPNsense image
+        if: steps.opnsense-image-cache.outputs.cache-hit != 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          curl \
+            --fail \
+            --location \
+            --retry 3 \
+            --retry-all-errors \
+            --connect-timeout 20 \
+            --output src/firewall-image.qcow2.part \
+            "$OPNSENSE_IMAGE_URL"
+          mv src/firewall-image.qcow2.part src/firewall-image.qcow2
+
+      - name: Verify OPNsense image
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "$OPNSENSE_IMAGE_SHA256  src/firewall-image.qcow2" | sha256sum --check --strict
+
+      - name: Setup OpenTofu
+        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
+        with:
+          tofu_version: ${{ env.TOFU_VERSION }}
+
+      - name: Select the test state backend
+        shell: bash
+        run: |
+          set -euo pipefail
+          cat > src/backend_ci.tf <<'HCL'
+          terraform {
+            backend "s3" {
+              use_path_style              = true
+              use_lockfile                = true
+              skip_credentials_validation = true
+              skip_region_validation      = true
+              skip_metadata_api_check     = true
+              skip_requesting_account_id  = true
+              skip_s3_checksum            = true
+            }
+          }
+          HCL
+
+      - name: Initialize against the test state
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_EC2_METADATA_DISABLED: "true"
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ -z "$AWS_ACCESS_KEY_ID" || -z "$AWS_SECRET_ACCESS_KEY" ]]; then
+            echo "::error::State backend credentials are missing from the terraform-plan environment."
+            exit 1
+          fi
+          tofu -chdir=src init \
+            -input=false \
+            -no-color \
+            -backend-config="bucket=${{ vars.TF_STATE_BUCKET }}" \
+            -backend-config="key=landing-zone-test/terraform.tfstate" \
+            -backend-config="region=${{ vars.TF_VAR_REGION }}" \
+            -backend-config="endpoints={s3=\"https://object.storage.${{ vars.TF_VAR_REGION }}.onstackit.cloud\"}"
+
+      - name: Create plan
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_EC2_METADATA_DISABLED: "true"
+        run: |
+          tofu -chdir=src plan \
+            -input=false \
+            -no-color \
+            -var-file="$TF_VAR_FILE" \
+            -out=tfplan
+
+      - name: Protect resource-manager folders and summarize
+        shell: bash
+        run: |
+          set -euo pipefail
+          tofu -chdir=src show -json tfplan > "$RUNNER_TEMP/tfplan.json"
+
+          add=$(jq '[.resource_changes[]? | select(.change.actions == ["create"])] | length' "$RUNNER_TEMP/tfplan.json")
+          change=$(jq '[.resource_changes[]? | select(.change.actions == ["update"])] | length' "$RUNNER_TEMP/tfplan.json")
+          destroy=$(jq '[.resource_changes[]? | select(.change.actions == ["delete"])] | length' "$RUNNER_TEMP/tfplan.json")
+          replace=$(jq '[.resource_changes[]? | select((.change.actions | index("create")) and (.change.actions | index("delete")))] | length' "$RUNNER_TEMP/tfplan.json")
+          folder_delete=$(jq '[.resource_changes[]? |
+            select(.type == "stackit_resourcemanager_folder") |
+            select((.change.actions | index("delete")) != null)] | length' "$RUNNER_TEMP/tfplan.json")
+
+          {
+            echo "## Deployment verification plan"
+            echo
+            echo "Configuration: \`src/$TF_VAR_FILE\`"
+            echo
+            echo "| Add | Change | Destroy | Replace | Protected folder deletions |"
+            echo "|---:|---:|---:|---:|---:|"
+            echo "| $add | $change | $destroy | $replace | $folder_delete |"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          if (( folder_delete > 0 )); then
+            echo "::error::Verification blocked: the plan deletes or replaces $folder_delete resource-manager folder(s)."
+            jq -r '.resource_changes[]? |
+              select(.type == "stackit_resourcemanager_folder") |
+              select((.change.actions | index("delete")) != null) |
+              "::error::Protected folder: \(.address)"' "$RUNNER_TEMP/tfplan.json"
+            exit 1
+          fi
+
+      - name: Upload plan
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: verify-deployment-plan
+          path: ${{ runner.temp }}/tfplan.json
+          retention-days: 7
+
+      - name: Apply the plan
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_EC2_METADATA_DISABLED: "true"
+        run: tofu -chdir=src apply -input=false -no-color -auto-approve -parallelism=2 tfplan
+
+      - name: Destroy everything except the folder skeleton
+        if: always()
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_EC2_METADATA_DISABLED: "true"
+        shell: bash
+        run: |
+          set -euo pipefail
+          tofu -chdir=src destroy \
+            -input=false \
+            -no-color \
+            -auto-approve \
+            -parallelism=2 \
+            -exclude=module.governance \
+            -var-file="$TF_VAR_FILE"
+
+      - name: Report what is left behind
+        if: failure()
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_EC2_METADATA_DISABLED: "true"
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            echo "## Resources still present in the test organization"
+            echo
+            echo '```'
+            tofu -chdir=src state list || echo "State could not be read."
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.gitignore b/.gitignore
index 6fbdb07..86556fc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -41,3 +41,5 @@ src/.firewall-api-credentials.json
 
 # macOS
 .DS_Store
+
+src/backend_ci.tf
diff --git a/src/tests/hub_spoke.tftest.hcl b/src/tests/hub_spoke.tftest.hcl
index c9b24af..bf89e5a 100644
--- a/src/tests/hub_spoke.tftest.hcl
+++ b/src/tests/hub_spoke.tftest.hcl
@@ -1,3 +1,65 @@
+mock_provider "stackit" {
+  mock_resource "stackit_resourcemanager_project" {
+    defaults = {
+      project_id = "11111111-1111-4111-8111-111111111111"
+    }
+  }
+
+  mock_resource "stackit_network_area" {
+    defaults = {
+      network_area_id = "22222222-2222-4222-8222-222222222222"
+    }
+  }
+
+  mock_resource "stackit_network" {
+    defaults = {
+      network_id = "33333333-3333-4333-8333-333333333333"
+    }
+  }
+
+  mock_resource "stackit_secretsmanager_instance" {
+    defaults = {
+      instance_id = "44444444-4444-4444-8444-444444444444"
+    }
+  }
+
+  mock_resource "stackit_observability_instance" {
+    defaults = {
+      instance_id = "55555555-5555-4555-8555-555555555555"
+    }
+  }
+
+  mock_resource "stackit_objectstorage_credentials_group" {
+    defaults = {
+      credentials_group_id = "66666666-6666-4666-8666-666666666666"
+    }
+  }
+
+  mock_resource "stackit_service_account" {
+    defaults = {
+      email = "mock-service-account@sa.stackit.cloud"
+    }
+  }
+
+  mock_resource "stackit_routing_table" {
+    defaults = {
+      routing_table_id = "77777777-7777-4777-8777-777777777777"
+    }
+  }
+
+  mock_resource "stackit_service_account_key" {
+    defaults = {
+      json = "{}"
+    }
+  }
+
+  mock_resource "stackit_network_interface" {
+    defaults = {
+      network_interface_id = "88888888-8888-4888-8888-888888888888"
+    }
+  }
+}
+
 variables {
   owner_email     = "example@digits.schwarz"
   company_name    = "Test Corp"
diff --git a/src/tests/hub_spoke_firewall.tftest.hcl b/src/tests/hub_spoke_firewall.tftest.hcl
index 1caf6e8..469c095 100644
--- a/src/tests/hub_spoke_firewall.tftest.hcl
+++ b/src/tests/hub_spoke_firewall.tftest.hcl
@@ -1,3 +1,65 @@
+mock_provider "stackit" {
+  mock_resource "stackit_resourcemanager_project" {
+    defaults = {
+      project_id = "11111111-1111-4111-8111-111111111111"
+    }
+  }
+
+  mock_resource "stackit_network_area" {
+    defaults = {
+      network_area_id = "22222222-2222-4222-8222-222222222222"
+    }
+  }
+
+  mock_resource "stackit_network" {
+    defaults = {
+      network_id = "33333333-3333-4333-8333-333333333333"
+    }
+  }
+
+  mock_resource "stackit_secretsmanager_instance" {
+    defaults = {
+      instance_id = "44444444-4444-4444-8444-444444444444"
+    }
+  }
+
+  mock_resource "stackit_observability_instance" {
+    defaults = {
+      instance_id = "55555555-5555-4555-8555-555555555555"
+    }
+  }
+
+  mock_resource "stackit_objectstorage_credentials_group" {
+    defaults = {
+      credentials_group_id = "66666666-6666-4666-8666-666666666666"
+    }
+  }
+
+  mock_resource "stackit_service_account" {
+    defaults = {
+      email = "mock-service-account@sa.stackit.cloud"
+    }
+  }
+
+  mock_resource "stackit_routing_table" {
+    defaults = {
+      routing_table_id = "77777777-7777-4777-8777-777777777777"
+    }
+  }
+
+  mock_resource "stackit_service_account_key" {
+    defaults = {
+      json = "{}"
+    }
+  }
+
+  mock_resource "stackit_network_interface" {
+    defaults = {
+      network_interface_id = "88888888-8888-4888-8888-888888888888"
+    }
+  }
+}
+
 variables {
   owner_email     = "example@digits.schwarz"
   company_name    = "Test Corp"
diff --git a/src/tests/standalone.tftest.hcl b/src/tests/standalone.tftest.hcl
index 3e8085b..15abe5b 100644
--- a/src/tests/standalone.tftest.hcl
+++ b/src/tests/standalone.tftest.hcl
@@ -1,3 +1,65 @@
+mock_provider "stackit" {
+  mock_resource "stackit_resourcemanager_project" {
+    defaults = {
+      project_id = "11111111-1111-4111-8111-111111111111"
+    }
+  }
+
+  mock_resource "stackit_network_area" {
+    defaults = {
+      network_area_id = "22222222-2222-4222-8222-222222222222"
+    }
+  }
+
+  mock_resource "stackit_network" {
+    defaults = {
+      network_id = "33333333-3333-4333-8333-333333333333"
+    }
+  }
+
+  mock_resource "stackit_secretsmanager_instance" {
+    defaults = {
+      instance_id = "44444444-4444-4444-8444-444444444444"
+    }
+  }
+
+  mock_resource "stackit_observability_instance" {
+    defaults = {
+      instance_id = "55555555-5555-4555-8555-555555555555"
+    }
+  }
+
+  mock_resource "stackit_objectstorage_credentials_group" {
+    defaults = {
+      credentials_group_id = "66666666-6666-4666-8666-666666666666"
+    }
+  }
+
+  mock_resource "stackit_service_account" {
+    defaults = {
+      email = "mock-service-account@sa.stackit.cloud"
+    }
+  }
+
+  mock_resource "stackit_routing_table" {
+    defaults = {
+      routing_table_id = "77777777-7777-4777-8777-777777777777"
+    }
+  }
+
+  mock_resource "stackit_service_account_key" {
+    defaults = {
+      json = "{}"
+    }
+  }
+
+  mock_resource "stackit_network_interface" {
+    defaults = {
+      network_interface_id = "88888888-8888-4888-8888-888888888888"
+    }
+  }
+}
+
 variables {
   owner_email     = "example@digits.schwarz"
   company_name    = "Test Corp"