diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index a0cec373..be2b0346 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -40,13 +40,21 @@ jobs:
           elif [ "$GITHUB_BRANCH" = "deploy" ]; then
             cp appspec-deploy.yml appspec.yml
           fi
+      - name: Save secret-populated code for a subsequent deploy step
+        uses: actions/upload-artifact@v2
+        with:
+          name: codebase
+          path: .
   deploy:
     runs-on: ubuntu-18.04
     needs: build # Don't deploy unless the build succeeds
     env:
       GITHUB_BRANCH: ${{ github.head_ref }} 
     steps:
-      - uses: actions/checkout@v2
+      - name: Get the secret-populated code
+        uses: actions/download-artifact@v2
+        with:
+          name: codebase
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v1
         with: