diff --git a/.github/workflows/bicep.yml b/.github/workflows/bicep.yml
new file mode 100644
index 0000000..08b51c6
--- /dev/null
+++ b/.github/workflows/bicep.yml
@@ -0,0 +1,44 @@
+name: Bicep
+
+on:
+  pull_request:
+  push:
+    branches: ["main"]
+
+env:
+  CLASS_RG: rg-hyf-students
+
+jobs:
+  what-if:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: azure/login@v2
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+      - name: Preview deployment
+        run: |
+          az deployment group what-if \
+            --resource-group "$CLASS_RG" \
+            --template-file main.bicep \
+            --parameters \
+              storageName=sthyfyourname \
+              dbAdminPassword=not-a-real-secret
+
+  deploy:
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: azure/login@v2
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+      - name: Apply deployment
+        run: |
+          az deployment group create \
+            --resource-group "$CLASS_RG" \
+            --template-file main.bicep \
+            --parameters \
+              storageName=sthyfyourname \
+              dbAdminPassword=not-a-real-secret
diff --git a/modules/storage.bicep b/modules/storage.bicep
index 34ac8e8..e2b615a 100644
--- a/modules/storage.bicep
+++ b/modules/storage.bicep
@@ -9,7 +9,15 @@ param containerName string = 'raw'
 resource storage 'Microsoft.Storage/storageAccounts@2023-01-01' = {
   name: storageName
   location: location
-  sku: { name: 'Standard_LRS' }
+
+  tags: {
+    environment: 'training'
+  }
+
+  sku: {
+    name: 'Standard_LRS'
+  }
+
   kind: 'StorageV2'
 }