diff --git a/.gitea/workflows/homelab-main.yml b/.gitea/workflows/homelab-main.yml
index 973e312..2aa58cc 100644
--- a/.gitea/workflows/homelab-main.yml
+++ b/.gitea/workflows/homelab-main.yml
@@ -140,7 +140,7 @@ jobs:
             exit "${diff_status}"
           fi
 
-          for stack in bootstrap/cluster bootstrap/platform bootstrap/apps bootstrap/edge; do
+          for stack in bootstrap/provisioning bootstrap/cluster bootstrap/platform bootstrap/apps bootstrap/edge; do
             tofu -chdir="${stack}" init -input=false
             tofu -chdir="${stack}" fmt -check
             tofu -chdir="${stack}" validate
@@ -161,7 +161,7 @@ jobs:
           fi
           printf '%s\n' "${changed_files}"
 
-          if printf '%s\n' "${changed_files}" | grep -Eq '^(bootstrap/(cluster|platform|edge)/|lab[.]sh|[.]gitea/workflows/)'; then
+          if printf '%s\n' "${changed_files}" | grep -Eq '^(bootstrap/(provisioning|cluster|platform|edge)/|lab[.]sh|[.]gitea/workflows/)'; then
             echo "High-impact bootstrap, runner, or workflow changes require a manual Debian run."
             exit 1
           fi
@@ -182,5 +182,5 @@ jobs:
             git -C "${deploy_dir}" remote add local-bootstrap /home/jv/git-server/my-homelab-configs.git
           git -C "${deploy_dir}" push local-bootstrap HEAD:main
 
-          "${deploy_dir}/lab.sh" up
+          "${deploy_dir}/lab.sh" apps
           kubectl --kubeconfig "${KUBECONFIG:-/home/jv/.kube/config}" -n argocd get applications
diff --git a/README.md b/README.md
index ff54333..ef29625 100644
--- a/README.md
+++ b/README.md
@@ -272,9 +272,10 @@ a repository-scoped Debian host runner with the label `homelab-debian`.
 
 The workflow validates shell syntax, Kubernetes manifests, and all OpenTofu
 stacks before deployment. It automatically stops when high-impact files under
-`bootstrap/cluster`, `bootstrap/platform`, `bootstrap/edge`, `lab.sh`, or
-`.gitea/workflows` change; those changes still require a manual Debian run.
-Lower-risk app changes proceed to `./lab.sh up` after validation passes.
+`bootstrap/provisioning`, `bootstrap/cluster`, `bootstrap/platform`,
+`bootstrap/edge`, `lab.sh`, or `.gitea/workflows` change; those changes still
+require a manual Debian run. Lower-risk app changes proceed to `./lab.sh apps`
+after validation passes, which skips Pimox, cluster, platform, and edge changes.
 
 Enable Actions for the repository in Gitea, then create a repository-level runner
 token from:
diff --git a/lab.sh b/lab.sh
index 0c0750e..ef771d7 100755
--- a/lab.sh
+++ b/lab.sh
@@ -968,7 +968,7 @@ refresh_argocd_application() {
     kubectl --kubeconfig "${KUBECONFIG}" patch application "${app}" -n argocd --type merge -p '{"metadata":{"annotations":{"argocd.argoproj.io/refresh":"hard"}}}' >/dev/null
 }
 
-up() {
+apps() {
     local buildx_builder_ready=false
     local demos_image_built=false
     local demos_image_ref
@@ -983,7 +983,7 @@ up() {
     local website_platforms
     local website_source_hash
 
-    require_debian_server "up"
+    require_debian_server "apps"
 
     registry_endpoint="$(website_registry_endpoint)"
     demos_registry_endpoint="$(demos_registry_endpoint)"
@@ -1009,13 +1009,9 @@ up() {
         exit 1
     fi
 
-    echo "Deploying the homelab infrastructure..."
+    echo "Deploying homelab applications..."
 
-    run_pimox_pipeline
-    run_tofu_stack "bootstrap/cluster"
-    run_tofu_stack "bootstrap/platform"
     apply_gitea_bootstrap_manifests
-    install_gitea_backup_timer
     run_tofu_stack "bootstrap/apps"
 
     refresh_argocd_application container-registry
@@ -1099,6 +1095,19 @@ up() {
         write_demos_image_state "${demos_image_state_file}" "${demos_source_hash}" "${demos_platforms}" "${demos_image_ref}"
     fi
 
+    echo "Application deployment successfully completed."
+}
+
+up() {
+    require_debian_server "up"
+
+    echo "Deploying the homelab infrastructure..."
+
+    run_pimox_pipeline
+    run_tofu_stack "bootstrap/cluster"
+    run_tofu_stack "bootstrap/platform"
+    install_gitea_backup_timer
+    apps
     run_tofu_stack "bootstrap/edge"
 
     echo "Deployment successfully completed."
@@ -1249,6 +1258,9 @@ case "${1:-}" in
     up)
         up
         ;;
+    apps)
+        apps
+        ;;
     backup-gitea)
         backup_gitea
         ;;
@@ -1259,7 +1271,7 @@ case "${1:-}" in
         nuke
         ;;
     *)
-        echo "Usage: $0 {up|backup-gitea|install-gitea-runner|nuke}"
+        echo "Usage: $0 {up|apps|backup-gitea|install-gitea-runner|nuke}"
         exit 1
         ;;
 esac