diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index b07a6f5b..58880607 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -324,6 +324,8 @@ jobs:
                 ;;
               apps/api/src/services/ai_agent_log_controlled_writeback_consumer_readback.py)
                 ;;
+              apps/api/src/services/ai_agent_log_controlled_writeback_consumer_apply.py)
+                ;;
               apps/api/src/services/ai_agent_autonomous_runtime_control.py)
                 ;;
               apps/api/src/services/awooop_ansible_audit_service.py)
@@ -440,6 +442,8 @@ jobs:
                 ;;
               apps/api/tests/test_ai_agent_log_controlled_writeback_consumer_readback_api.py)
                 ;;
+              apps/api/tests/test_ai_agent_log_controlled_writeback_consumer_apply_api.py)
+                ;;
               apps/api/tests/test_ai_agent_autonomous_runtime_control.py)
                 ;;
               apps/api/tests/test_awooop_truth_chain_service.py)
@@ -706,6 +710,7 @@ jobs:
               src/services/ai_agent_log_controlled_writeback_executor_readback.py \
               src/services/ai_agent_log_controlled_writeback_dispatch.py \
               src/services/ai_agent_log_controlled_writeback_consumer_readback.py \
+              src/services/ai_agent_log_controlled_writeback_consumer_apply.py \
               src/services/ai_agent_autonomous_runtime_control.py \
               src/services/awooop_ansible_audit_service.py \
               src/services/awooop_ansible_check_mode_service.py \
@@ -784,6 +789,7 @@ jobs:
               tests/test_ai_agent_log_controlled_writeback_executor_readback_api.py \
               tests/test_ai_agent_log_controlled_writeback_dispatch_api.py \
               tests/test_ai_agent_log_controlled_writeback_consumer_readback_api.py \
+              tests/test_ai_agent_log_controlled_writeback_consumer_apply_api.py \
               tests/test_ai_agent_autonomous_runtime_control.py \
               tests/test_awooop_truth_chain_service.py \
               tests/test_shadow_auto_approve.py \
diff --git a/ops/runner/test_cd_controlled_runtime_profile.py b/ops/runner/test_cd_controlled_runtime_profile.py
index e4af3a8b..735d141d 100644
--- a/ops/runner/test_cd_controlled_runtime_profile.py
+++ b/ops/runner/test_cd_controlled_runtime_profile.py
@@ -100,6 +100,22 @@ def test_workflow_secret_transport_sources_stay_on_controlled_runtime_profile()
         assert source in text
 
 
+def test_log_controlled_writeback_consumer_apply_stays_on_controlled_runtime_profile() -> None:
+    text = _workflow_text()
+    expected_sources = [
+        "apps/api/src/services/ai_agent_log_controlled_writeback_consumer_readback.py)",
+        "apps/api/src/services/ai_agent_log_controlled_writeback_consumer_apply.py)",
+        "apps/api/tests/test_ai_agent_log_controlled_writeback_consumer_readback_api.py)",
+        "apps/api/tests/test_ai_agent_log_controlled_writeback_consumer_apply_api.py)",
+        "src/services/ai_agent_log_controlled_writeback_consumer_readback.py",
+        "src/services/ai_agent_log_controlled_writeback_consumer_apply.py",
+        "tests/test_ai_agent_log_controlled_writeback_consumer_readback_api.py",
+        "tests/test_ai_agent_log_controlled_writeback_consumer_apply_api.py",
+    ]
+    for source in expected_sources:
+        assert source in text
+
+
 def test_cd_requires_production_deploy_readback_after_rollout() -> None:
     text = _workflow_text()
     assert "apps/api/tests/test_awoooi_production_deploy_readback_blocker.py)" in text