diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 42ceaa8..8f96e3e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -10,6 +10,28 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Get GitHub Runner Public IP
+        run: echo "RUNNER_IP=$(curl -s https://checkip.amazonaws.com)/32" >> "$GITHUB_ENV"
+
+      - name: Authorize temporary SSH access for GitHub Runner
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: ${{ secrets.AWS_REGION }}
+          EC2_SECURITY_GROUP_ID: ${{ secrets.EC2_SECURITY_GROUP_ID }}
+        run: |
+          set -e
+          OUTPUT=$(aws ec2 authorize-security-group-ingress \
+            --group-id "$EC2_SECURITY_GROUP_ID" \
+            --protocol tcp \
+            --port 22 \
+            --cidr "$RUNNER_IP" 2>&1) || STATUS=$?
+          if [ "${STATUS:-0}" -ne 0 ] && ! echo "$OUTPUT" | grep -q "InvalidPermission.Duplicate"; then
+            echo "$OUTPUT"
+            exit "${STATUS}"
+          fi
+          echo "Temporary SSH ingress ensured for $RUNNER_IP"
+
       - name: Deploy & Verify on Production EC2 via SSH
         uses: appleboy/ssh-action@v1.0.3
         with:
@@ -72,3 +94,23 @@ jobs:
               exit 1
             fi
             echo "=== Deployment Completed Successfully ==="
+
+      - name: Revoke temporary SSH access for GitHub Runner
+        if: always()
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: ${{ secrets.AWS_REGION }}
+          EC2_SECURITY_GROUP_ID: ${{ secrets.EC2_SECURITY_GROUP_ID }}
+        run: |
+          set -e
+          OUTPUT=$(aws ec2 revoke-security-group-ingress \
+            --group-id "$EC2_SECURITY_GROUP_ID" \
+            --protocol tcp \
+            --port 22 \
+            --cidr "$RUNNER_IP" 2>&1) || STATUS=$?
+          if [ "${STATUS:-0}" -ne 0 ] && ! echo "$OUTPUT" | grep -q "InvalidPermission.NotFound"; then
+            echo "$OUTPUT"
+            exit "${STATUS}"
+          fi
+          echo "Temporary SSH ingress revoked for $RUNNER_IP"
diff --git a/deploy/README.md b/deploy/README.md
index 785aa43..04cd513 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -40,6 +40,8 @@ Ensure the following inbound ports are open in AWS EC2 Security Group:
 | **Custom TCP** | `8080` | `0.0.0.0/0` | Direct Spring Boot API & Swagger UI |
 | **Custom TCP** | `9001` | `My IP` | MinIO Web Console (Admin access only) |
 
+For GitHub Actions CD deployments, workflow automation temporarily opens SSH (`22`) only for the active runner public IP and revokes it immediately after deployment.
+
 ---
 
 ## 🔑 One-Time SSL Certificate Issuance (Let's Encrypt)