diff --git a/.github/workflows/opt-out-import-deploy-dev.yml b/.github/workflows/opt-out-import-deploy-dev.yml
index ee5895b..f5ee9c0 100644
--- a/.github/workflows/opt-out-import-deploy-dev.yml
+++ b/.github/workflows/opt-out-import-deploy-dev.yml
@@ -40,5 +40,5 @@ jobs:
 
       - name: Upload and reload
         run: |
-          aws s3 cp --no-progress optout/build/distributions/optout.zip s3://${{ vars.OPT_OUT_IMPORT_BUCKET }}/function.zip
-          aws lambda update-function-code --function-name ab2d-dev-opt-out-import --s3-bucket ${{ vars.OPT_OUT_IMPORT_BUCKET }} --s3-key function.zip
+          aws s3 cp --no-progress optout/build/distributions/optout.zip s3://${{ vars.OPT_OUT_IMPORT_ZIP_BUCKET }}/function.zip
+          aws lambda update-function-code --function-name ab2d-dev-opt-out-import --s3-bucket ${{ vars.OPT_OUT_IMPORT_ZIP_BUCKET }} --s3-key function.zip
diff --git a/.github/workflows/opt-out-import-deploy-prod.yml b/.github/workflows/opt-out-import-deploy-prod.yml
new file mode 100644
index 0000000..139868f
--- /dev/null
+++ b/.github/workflows/opt-out-import-deploy-prod.yml
@@ -0,0 +1,24 @@
+name: Deploy opt-out-import to prod
+
+on:
+  workflow_dispatch:
+
+env:
+  AWS_REGION: ${{ vars.AWS_REGION }}
+
+jobs:
+  deploy:
+    runs-on: self-hosted
+    environment: prod
+
+    steps:
+      - name: Assume role in target account
+        uses: aws-actions/configure-aws-credentials@v3
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          role-to-assume: ${{ vars.ACCOUNT_ROLE }}
+
+      - name: Promote lambda code from test to prod
+        run: |
+          aws s3 cp --no-progress s3://${{ vars.OPT_OUT_IMPORT_TEST_ZIP_BUCKET }}/function.zip s3://${{ vars.OPT_OUT_IMPORT_ZIP_BUCKET }}/function.zip
+          aws lambda update-function-code --function-name ab2d-prod-opt-out-import --s3-bucket ${{ vars.OPT_OUT_IMPORT_ZIP_BUCKET }} --s3-key function.zip
diff --git a/.github/workflows/opt-out-import-deploy-sbx.yml b/.github/workflows/opt-out-import-deploy-sbx.yml
new file mode 100644
index 0000000..d2e4559
--- /dev/null
+++ b/.github/workflows/opt-out-import-deploy-sbx.yml
@@ -0,0 +1,24 @@
+name: Deploy opt-out-import to sbx (sandbox)
+
+on:
+  workflow_dispatch:
+
+env:
+  AWS_REGION: ${{ vars.AWS_REGION }}
+
+jobs:
+  deploy:
+    runs-on: self-hosted
+    environment: sbx
+
+    steps:
+      - name: Assume role in target account
+        uses: aws-actions/configure-aws-credentials@v3
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          role-to-assume: ${{ vars.ACCOUNT_ROLE }}
+
+      - name: Promote lambda code from test to sbx
+        run: |
+          aws s3 cp --no-progress s3://${{ vars.OPT_OUT_IMPORT_TEST_ZIP_BUCKET }}/function.zip s3://${{ vars.OPT_OUT_IMPORT_ZIP_BUCKET }}/function.zip
+          aws lambda update-function-code --function-name ab2d-sbx-opt-out-import --s3-bucket ${{ vars.OPT_OUT_IMPORT_ZIP_BUCKET }} --s3-key function.zip
diff --git a/.github/workflows/opt-out-import-deploy-test.yml b/.github/workflows/opt-out-import-deploy-test.yml
index e20c09d..1a7ee44 100644
--- a/.github/workflows/opt-out-import-deploy-test.yml
+++ b/.github/workflows/opt-out-import-deploy-test.yml
@@ -45,5 +45,5 @@ jobs:
 
       - name: Upload and reload
         run: |
-          aws s3 cp --no-progress optout/build/distributions/optout.zip s3://${{ vars.OPT_OUT_IMPORT_BUCKET }}/function.zip
-          aws lambda update-function-code --function-name ab2d-test-opt-out-import --s3-bucket ${{ vars.OPT_OUT_IMPORT_BUCKET }} --s3-key function.zip
+          aws s3 cp --no-progress optout/build/distributions/optout.zip s3://${{ vars.OPT_OUT_IMPORT_ZIP_BUCKET }}/function.zip
+          aws lambda update-function-code --function-name ab2d-test-opt-out-import --s3-bucket ${{ vars.OPT_OUT_IMPORT_ZIP_BUCKET }} --s3-key function.zip