diff --git a/.github/workflows/infra-deploy.yml b/.github/workflows/infra-deploy.yml
index c8c116f92f..6fa278b712 100644
--- a/.github/workflows/infra-deploy.yml
+++ b/.github/workflows/infra-deploy.yml
@@ -74,6 +74,7 @@ jobs:
           set -euo pipefail
           yarn cdk diff --context imageVersion=${{ inputs.imageVersion }} 2>&1 | tee cdk.diff
 
-      # TODO: Enable CDK Deploy when ready
-      # - name: CDK Deploy
-      #   run: yarn cdk deploy --require-approval never --context imageVersion=${{ inputs.imageVersion }}
+      - name: CDK Deploy
+        run: |
+          set -euo pipefail
+          yarn cdk deploy --require-approval never --context imageVersion=${{ inputs.imageVersion }}
diff --git a/infra/lib/constructs/service.ts b/infra/lib/constructs/service.ts
index 919b5c2aa3..0834a7d035 100644
--- a/infra/lib/constructs/service.ts
+++ b/infra/lib/constructs/service.ts
@@ -74,12 +74,7 @@ export class Service extends Construct {
         SMTP_PASSWORD: ecs.Secret.fromSecretsManager(smtpCredentials, 'password'),
       },
       targetGroupHealthCheck: { path: '/up' },
-      dns: {
-        zoneName: config.hostedZoneName,
-        recordName: config.fqdn,
-        // TODO: Remove after DNS propagation - will become primary domain
-        additionalDomains: [{ zoneName: 'zarhq.dev', recordName: 'fizzy.zarhq.dev' }],
-      },
+      dns: { zoneName: config.hostedZoneName, recordName: config.fqdn },
     });
 
     // Grant S3 permissions to the ECS task role