diff --git a/provisioner/BUILD.bazel b/provisioner/BUILD.bazel
index 3a8af26b6..95583e780 100644
--- a/provisioner/BUILD.bazel
+++ b/provisioner/BUILD.bazel
@@ -117,15 +117,60 @@ task(
 task(
     name = "deploy",
     cmds = [
+        "export COMMIT_SHA=$(git rev-parse HEAD)",
+        cmd.shell(
+            cmd.executable(":deploy_mark"),
+            "$COMMIT_SHA",
+        ),
         cmd.executable(":deploy_provision"),
         cmd.executable(":deploy_validate"),
     ],
+    cwd = "$BUILD_WORKSPACE_DIRECTORY",
+    env = {
+        "SETUP_ENV": "prod",
+    },
+)
+
+py_binary(
+    name = "deploy_mark_binary",
+    srcs = [
+        "deploy_mark.py",
+    ],
+    main = "deploy_mark.py",
+    deps = [
+        requirement("requests"),
+    ],
+)
+
+task(
+    name = "deploy_mark",
+    cmds = [
+        secrets({
+            "ENTITY_GUID": "provisioner-mark-new-relic-api-key.entity_guid",
+            "NEW_RELIC_API_KEY": "provisioner-mark-new-relic-api-key.password",
+        }),
+        cmd.shell(
+            cmd.executable(":deploy_mark_binary"),
+            "$CLI_ARGS",
+        ),
+    ],
+    env = {
+        "OP_BINARY": cmd.executable("//tools/onepassword:op"),
+    },
+    exec_properties = {
+        "include-secrets": "true",
+    },
+    deps = ["//tools/onepassword:lib"],
 )
 
 task_test(
     name = "deploy_test",
     size = "large",
     cmds = [
+        cmd.shell(
+            cmd.executable(":deploy_mark"),
+            "test-commit-sha",
+        ),
         cmd.executable(":deploy_provision"),
         cmd.shell(
             cmd.executable(":deploy_validate"),
@@ -135,6 +180,7 @@ task_test(
     ],
     env = {
         "PYINFRA_RUN_ARGS": "--dry",
+        "SETUP_ENV": "test",
     },
 )
 
@@ -198,7 +244,7 @@ task(
     name = "validate",
     cmds = [
         secrets({
-            "NEW_RELIC_API_KEY": "provisioner-validate-api-key.password",
+            "NEW_RELIC_API_KEY": "provisioner-validate-new-relic-api-key.password",
         }),
         cmd.python("""
         import os
diff --git a/provisioner/deploy_mark.py b/provisioner/deploy_mark.py
new file mode 100644
index 000000000..6a3d0fbfe
--- /dev/null
+++ b/provisioner/deploy_mark.py
@@ -0,0 +1,47 @@
+import requests
+import os
+import sys
+
+url = "https://api.eu.newrelic.com/graphql"
+entity_guid = os.environ["ENTITY_GUID"]
+_, commit_sha = sys.argv
+new_relic_api_key = os.environ["NEW_RELIC_API_KEY"]
+group_id = commit_sha
+
+headers = {
+    "Content-Type": "application/json",
+    "API-Key": new_relic_api_key,
+}
+
+query = """
+mutation {
+  changeTrackingCreateDeployment(deployment: {
+    entityGuid: "%s",
+    commit: "%s",
+    groupId: "%s",
+    deploymentType: ROLLING,
+    version: "0.1",
+  }) {
+    changelog
+    commit
+    deepLink
+    deploymentId
+    deploymentType
+    description
+    groupId
+    user
+  }
+}
+""" % (
+    entity_guid,
+    commit_sha,
+    group_id,
+)
+
+response = requests.post(url, json={"query": query}, headers=headers)
+
+if response.ok:
+    print("Request was successful.")
+else:
+    print(response.text)
+    response.raise_for_status()
diff --git a/renovate.json b/renovate.json
index 4efc5e395..db6cc8c2c 100644
--- a/renovate.json
+++ b/renovate.json
@@ -42,7 +42,11 @@
   "bazel-module": {
     "enabled": true
   },
+  "bazel": {
+    "fileMatch": ["(^|/)WORKSPACE\\.bzlmod$"]
+  },
   "docker-compose": {
     "fileMatch": ["(^|/)docker-compose\\.yml\\.j2$"]
-  }
+  },
+  "automergeSchedule": ["after 9am every weekday", "before 5pm every weekday"]
 }
diff --git a/requirements.in b/requirements.in
index 20c7fa630..4ac7b0a7f 100644
--- a/requirements.in
+++ b/requirements.in
@@ -14,4 +14,5 @@ sqlalchemy==2.0.15;
 semver==2.13.0;
 bazel-runfiles==0.22.0;
 grpclib[protobuf]==0.4.4;
-googleapis-common-protos==1.59.0;
\ No newline at end of file
+googleapis-common-protos==1.59.0;
+requests==2.31.0;
\ No newline at end of file
diff --git a/requirements.txt b/requirements.txt
index 35ee2654d..05a542f64 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1493,6 +1493,7 @@ requests==2.31.0 \
     --hash=sha256:58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f \
     --hash=sha256:942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1
     # via
+    #   -r requirements.in
     #   homeassistant
     #   opentelemetry-exporter-otlp-proto-http
     #   pulumi-kubernetes
diff --git a/tools/onepassword/lib.py b/tools/onepassword/lib.py
index 167cef3fd..969ea9dac 100644
--- a/tools/onepassword/lib.py
+++ b/tools/onepassword/lib.py
@@ -71,10 +71,9 @@ def get_item_path(path):
 
     json_string = result.stdout.decode("utf-8")
     raw_data = json.loads(json_string)
-
     data = {}
 
     for field in raw_data["fields"]:
-        data[field["id"]] = field.get("value", None)
+        data[field["label"]] = field.get("value", None)
 
     return data[item_field]