diff --git a/contracts/ERC7589/ERC7589RolesRegistry.sol b/contracts/ERC7589/ERC7589RolesRegistry.sol
index 3219996..b050625 100644
--- a/contracts/ERC7589/ERC7589RolesRegistry.sol
+++ b/contracts/ERC7589/ERC7589RolesRegistry.sol
@@ -142,9 +142,8 @@ contract ERC7589RolesRegistry is IERC7589, ERC1155Holder, IERC7589LockTokensAndG
         uint256 _tokenId = tokenLocks[_lockId].tokenId;
         uint256 _tokenAmount = tokenLocks[_lockId].tokenAmount;
         delete tokenLocks[_lockId];
-        emit TokensUnlocked(_lockId);
-
         _transferFrom(address(this), _owner, _tokenAddress, _tokenId, _tokenAmount);
+        emit TokensUnlocked(_lockId);
     }
 
     function setRoleApprovalForAll(address _tokenAddress, address _operator, bool _approved) external {
@@ -253,8 +252,8 @@ contract ERC7589RolesRegistry is IERC7589, ERC1155Holder, IERC7589LockTokensAndG
         require(_tokenAmount > 0, 'ERC7589RolesRegistry: tokenAmount must be greater than zero');
         lockId_ = ++lockIdCount;
         tokenLocks[lockId_] = TokenLock(_owner, _tokenAddress, _tokenId, _tokenAmount);
-        emit TokensLocked(_owner, lockId_, _tokenAddress, _tokenId, _tokenAmount);
         _transferFrom(_owner, address(this), _tokenAddress, _tokenId, _tokenAmount);
+        emit TokensLocked(_owner, lockId_, _tokenAddress, _tokenId, _tokenAmount);
     }
 
     function _grantERC7589Role(
diff --git a/scripts/ERC-7589/ERC7589RolesRegistry/01-deploy.ts b/scripts/ERC-7589/ERC7589RolesRegistry/01-deploy.ts
new file mode 100644
index 0000000..5a293b6
--- /dev/null
+++ b/scripts/ERC-7589/ERC7589RolesRegistry/01-deploy.ts
@@ -0,0 +1,53 @@
+import hre, { ethers, network } from 'hardhat'
+import { AwsKmsSigner } from '@govtechsg/ethers-aws-kms-signer'
+import { confirmOrDie, print, colors } from '../../../utils/misc'
+
+const kmsCredentials = {
+  accessKeyId: process.env.AWS_ACCESS_KEY_ID || 'AKIAxxxxxxxxxxxxxxxx', // credentials for your IAM user with KMS access
+  secretAccessKey: process.env.AWS_ACCESS_KEY_SECRET || 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx', // credentials for your IAM user with KMS access
+  region: 'us-east-1', // region of your KMS key
+  keyId: process.env.AWS_KMS_KEY_ID || 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', // KMS key id
+}
+
+const NETWORK = network.name
+const IMMUTABLE_CONTRACT_NAME = 'ERC7589RolesRegistry'
+const MARKETPLACE_CONTRACT = '0xB1D47B09aa6D81d7B00C3A37705a6A157B83C49F'
+
+const networkConfig: any = network.config
+const provider = new ethers.providers.JsonRpcProvider(networkConfig.url || '')
+
+const deployer = new AwsKmsSigner(kmsCredentials).connect(provider)
+
+async function main() {
+  const deployerAddress = await deployer.getAddress()
+
+  /** Deploy ERC7589RolesRegistry **/
+
+  await confirmOrDie(
+    `Deploying ${IMMUTABLE_CONTRACT_NAME} contract on: ${NETWORK} network with ${deployerAddress}. Continue?`,
+  )
+
+  const ERC7589RolesRegistryFactory = await ethers.getContractFactory(IMMUTABLE_CONTRACT_NAME, { signer: deployer })
+  const ERC7589RolesRegistry = await ERC7589RolesRegistryFactory.deploy(MARKETPLACE_CONTRACT, {
+    gasPrice: ethers.utils.parseUnits('100', 'gwei')
+  })
+  await ERC7589RolesRegistry.deployed()
+
+  console.log(`${IMMUTABLE_CONTRACT_NAME} deployed at: ${ERC7589RolesRegistry.address}`)
+
+  print(colors.highlight, `Verifying contract ${IMMUTABLE_CONTRACT_NAME} on ${NETWORK}...`)
+  await hre.run('verify:verify', {
+    address: ERC7589RolesRegistry.address,
+    constructorArguments: [ MARKETPLACE_CONTRACT ],
+  })
+  print(colors.success, `Contract ${IMMUTABLE_CONTRACT_NAME} verified!`)
+}
+
+main()
+  .then(async () => {
+    console.log('All done!')
+  })
+  .catch(error => {
+    console.error(error)
+    process.exitCode = 1
+  })