diff --git a/.github/workflows/deploy_helmfile.yaml b/.github/workflows/deploy_helmfile.yaml
index 8ba107e..289661e 100644
--- a/.github/workflows/deploy_helmfile.yaml
+++ b/.github/workflows/deploy_helmfile.yaml
@@ -58,6 +58,10 @@ on:
         required: false
         type: string
         default: apply --suppress-secrets
+      enableVpn:
+        description: Enable VPN connection
+        required: false
+        default: true
 
     secrets:
       awsAccessKeyId:
@@ -176,6 +180,14 @@ jobs:
       - name: setup kubeconfig
         run: aws eks update-kubeconfig --name ${{ inputs.eksClusterName }} $OPTIONAL_PARAMS
 
+      - name: Tailscale VPN
+        uses: tailscale/github-action@v2
+        if: inputs.enableVpn
+        with:
+          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
+          tags: tag:ci
+
       - name: helmfile ${{ inputs.helmfileCommand }}
         run: |
           export $(echo ${{ inputs.envVariables }})