diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index ed484d7..dc8cf32 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,9 +1,19 @@
-name: Deploy Airflow
+name: Deploy Stack
 
 on:
   push:
     branches:
       - main
+  workflow_dispatch:
+    inputs:
+      service:
+        description: "Service to deploy"
+        required: true
+        type: choice
+        options:
+          - all
+          - airflow
+          - keycloak
 
 jobs:
   deploy:
@@ -20,11 +30,26 @@ jobs:
       - name: Setup Helm
         uses: azure/setup-helm@v4
 
-      - name: Deploy Airflow
+      - name: Add Helm repos
         run: |
           helm repo add apache-airflow https://airflow.apache.org
+          helm repo add bitnami https://charts.bitnami.com/bitnami
           helm repo update
+
+      - name: Deploy Airflow
+        if: ${{ github.event_name == 'push' || inputs.service == 'all' || inputs.service == 'airflow' }}
+        run: |
           helm upgrade --install airflow apache-airflow/airflow \
             --namespace airflow \
             --create-namespace \
-            --values helm/airflow/values.yaml 
+            --values helm/airflow/values.yaml \
+            --wait
+
+      - name: Deploy Keycloak
+        if: ${{ github.event_name == 'push' || inputs.service == 'all' || inputs.service == 'keycloak' }}
+        run: |
+          helm upgrade --install keycloak bitnami/keycloak \
+            --namespace keycloak \
+            --create-namespace \
+            --values helm/keycloak/values.yaml \
+            --wait
diff --git a/helm/keycloak/values.yaml b/helm/keycloak/values.yaml
new file mode 100644
index 0000000..5f89129
--- /dev/null
+++ b/helm/keycloak/values.yaml
@@ -0,0 +1,16 @@
+auth:
+  adminUser: admin
+  adminPassword: changeme
+
+postgresql:
+  enabled: true
+  auth:
+    username: keycloak
+    password: keycloak
+    database: keycloak
+
+ingress:
+  enabled: true
+  ingressClassName: nginx
+  hostname: keycloak.49.13.143.254.nip.io
+  tls: false