diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4eb17b1..0b037f1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
new file mode 100644
index 0000000..b152165
--- /dev/null
+++ b/.github/workflows/e2e.yml
@@ -0,0 +1,30 @@
+name: E2E
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  e2e:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Provision cluster
+        uses: agynio/bootstrap/.github/actions/provision@main
+
+      - name: Setup DevSpace
+        uses: agynio/e2e/.github/actions/setup-devspace@main
+
+      - name: Deploy authorization from source
+        run: devspace dev
+
+      - name: Run E2E tests
+        uses: agynio/e2e/.github/actions/run-tests@main
+        with:
+          service: authorization
diff --git a/devspace.yaml b/devspace.yaml
index 1638bce..9cfd66b 100644
--- a/devspace.yaml
+++ b/devspace.yaml
@@ -2,7 +2,6 @@ version: v2beta1
 
 vars:
   AUTHORIZATION_NAMESPACE: platform
-  E2E_IMAGE: ghcr.io/agynio/devcontainer-go:1
 
 functions:
   disable_argocd_sync: |-
@@ -38,7 +37,7 @@ functions:
               emptyDir: {}
           containers:
             - name: authorization
-              image: ghcr.io/agynio/devcontainer-go:1 # keep in sync with E2E_IMAGE
+              image: ghcr.io/agynio/devcontainer-go:1 # dev container for source deploy
               workingDir: /opt/app/data
               command:
                 - sh
@@ -75,26 +74,6 @@ functions:
     EOF
     )"
 
-deployments:
-  e2e-runner:
-    namespace: ${AUTHORIZATION_NAMESPACE}
-    helm:
-      chart:
-        name: component-chart
-        repo: https://charts.devspace.sh
-      values:
-        containers:
-          - image: ${E2E_IMAGE}
-            env:
-              - name: AUTHORIZATION_ADDRESS
-                value: "authorization:50051"
-        labels:
-          app.kubernetes.io/name: authorization-e2e
-
-commands:
-  test:e2e: |-
-    devspace run-pipeline test:e2e $@
-
 pipelines:
   dev:
     flags:
@@ -125,20 +104,6 @@ pipelines:
         stop_dev authorization
       fi
 
-  test:e2e:
-    run: |-
-      create_deployments e2e-runner
-      start_dev e2e-runner &
-      sleep 5
-      exec_container \
-        --label-selector "app.kubernetes.io/name=authorization-e2e" \
-        -n ${AUTHORIZATION_NAMESPACE} \
-        -- bash -c 'cd /opt/app/data && buf generate buf.build/agynio/api --path agynio/api/authorization/v1 && go test -v -count=1 -tags e2e ./test/e2e/'
-      EXIT_CODE=$?
-      stop_dev e2e-runner
-      purge_deployments e2e-runner
-      exit $EXIT_CODE
-
 hooks:
   - name: restore-argocd-auto-sync
     events:
@@ -179,17 +144,3 @@ dev:
           lastLines: 200
     ports:
       - port: "50051"
-
-  e2e-runner:
-    namespace: ${AUTHORIZATION_NAMESPACE}
-    labelSelector:
-      app.kubernetes.io/name: authorization-e2e
-    command: ["sleep", "infinity"]
-    workingDir: /opt/app/data
-    sync:
-      - path: ./:/opt/app/data
-        excludePaths:
-          - .git/
-          - .devspace/
-          - /.gen/
-          - /tmp/