diff --git a/.github/workflows/cd-prod.yml b/.github/workflows/cd-prod.yml
index e6434c3..a12e58f 100644
--- a/.github/workflows/cd-prod.yml
+++ b/.github/workflows/cd-prod.yml
@@ -27,7 +27,12 @@ jobs:
   deploy:
     if: >
       github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
+      (
+        github.event_name == 'workflow_run' &&
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.event == 'push' &&
+        github.event.workflow_run.head_branch == 'main'
+      )
     runs-on: ubuntu-latest
     timeout-minutes: 20
 
diff --git a/src/main/java/com/michelet/gateway/infrastructure/config/SecurityConfig.java b/src/main/java/com/michelet/gateway/infrastructure/config/SecurityConfig.java
index 171c598..d1320de 100644
--- a/src/main/java/com/michelet/gateway/infrastructure/config/SecurityConfig.java
+++ b/src/main/java/com/michelet/gateway/infrastructure/config/SecurityConfig.java
@@ -28,7 +28,7 @@ public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http, Ga
                         exchanges-> exchanges.pathMatchers(
                                 "/api/*/auth/login",
                                 "/api/*/auth/reissue",
-                                "/api/*/users/signup", "/actuator/health", "/actuator/info"
+                                "/api/*/users/signup", "/actuator/health", "/actuator/info", "/actuator/prometheus"
                         ).permitAll()
                                 .pathMatchers("/api/*/admin/**").hasRole("MASTER")
                                 .anyExchange().authenticated()