diff --git a/.github/workflows/tofu-fmt-check-pr.yaml b/.github/workflows/tofu-fmt-check-pr.yaml
new file mode 100644
index 0000000..d4672cd
--- /dev/null
+++ b/.github/workflows/tofu-fmt-check-pr.yaml
@@ -0,0 +1,92 @@
+name: Validate tofu formatting on pull request
+
+on:
+  # Triggers the workflow on pull request events targeting the main or prod branches
+  pull_request_target:
+    branches:
+      - main
+      - prod
+  # Also triggers on direct pull requests to main or prod (for forks or direct pushes)
+  pull_request:
+    branches:
+      - main
+      - prod
+
+jobs:
+  validate:
+    name: tofu fmt check
+    runs-on: ubuntu-latest
+    # Permissions needed for the job
+    permissions:
+      contents: read # To check out the code
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+        with:
+          # Fetch depth 2 is needed for comparing changes in PRs
+          fetch-depth: 2
+
+      - name: Get changed files
+        id: changed_files # Assign an ID to refer to the outputs of this step
+        uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5
+        with:
+          # Specify the output format for the list of files
+          files_separator: " " # Use space as a separator for the loop below
+
+      - name: Setup OpenTofu
+        uses: opentofu/setup-opentofu@592200bd4b9bbf4772ace78f887668b1aee8f716 # v1.0.5
+        with:
+          tofu_version: latest
+
+      - name: Validate tofu fmt (added/modified)
+        run: |
+          # Allow the script to continue even if tofu fmt fails for one file
+          set +e
+
+          # Initialize check status (0 = success, 1 = failure)
+          CHECK_STATUS=0
+          echo "CHECK_STATUS=${CHECK_STATUS}" >> $GITHUB_ENV
+
+          echo "### Formatting Check for Changed Tofu Files" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          CHANGED_TOFU_FILES=""
+
+          # Loop through all files that were added or modified in the PR
+          # Use the output from the 'tj-actions/changed-files' step
+          for changed_file in ${{ steps.changed_files.outputs.all_changed_and_modified_files }}; do
+            echo "Checking tofu fmt on ${changed_file}..."
+
+            # Check if the file has a .tofu or .tfvars extension
+            if [[ $changed_file == *.tofu || $changed_file == *.tfvars ]]; then
+              CHANGED_TOFU_FILES="$CHANGED_TOFU_FILES $changed_file"
+              # Run tofu fmt in check mode. It exits with non-zero status if formatting is needed.
+              tofu fmt -check $changed_file
+              FMT_STATUS=$? # Capture the exit status of the tofu fmt command
+
+              # If tofu fmt failed (exit status is not 0)
+              if [[ $FMT_STATUS -ne 0 ]]; then
+                echo "- ❌ **${changed_file}** is not properly formatted. Please run \`tofu fmt\`." >> $GITHUB_STEP_SUMMARY
+                # Update the overall check status to failure
+                CHECK_STATUS=1
+                echo "CHECK_STATUS=${CHECK_STATUS}" >> $GITHUB_ENV
+              else
+                echo "- ✅ **${changed_file}** is properly formatted." >> $GITHUB_STEP_SUMMARY
+              fi
+            else
+              echo "Skipping non-tofu file: ${changed_file}"
+            fi
+          done
+
+          if [[ -z "$CHANGED_TOFU_FILES" ]]; then
+            echo "No changed or modified .tofu or .tfvars files found." >> $GITHUB_STEP_SUMMARY
+          fi
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Final check status: $CHECK_STATUS" >> $GITHUB_STEP_SUMMARY
+
+          # Exit the step with the final check status
+          # If CHECK_STATUS is 1, the step (and job) will fail. If 0, it succeeds.
+          echo "Final check status: $CHECK_STATUS"
+          exit $CHECK_STATUS
diff --git a/.github/workflows/tofu-fmt-check-scheduled.yaml b/.github/workflows/tofu-fmt-check-scheduled.yaml
new file mode 100644
index 0000000..7f211a4
--- /dev/null
+++ b/.github/workflows/tofu-fmt-check-scheduled.yaml
@@ -0,0 +1,62 @@
+name: Validate tofu formatting monthly
+
+on:
+  schedule:
+    # Runs at 00:00 UTC on the first day of every month
+    - cron: "0 0 1 * *"
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+jobs:
+  check_all:
+    name: Check all tofu file formatting
+    runs-on: ubuntu-latest
+    # Permissions needed for the job
+    permissions:
+      contents: read # To check out the code
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+
+      - name: Setup OpenTofu
+        uses: opentofu/setup-opentofu@592200bd4b9bbf4772ace78f887668b1aee8f716 # v1.0.5
+        with:
+          tofu_version: latest
+
+      - name: Validate tofu fmt for all files in tofu/ directory
+        run: |
+          # Allow the script to continue even if tofu fmt fails for one file
+          set +e
+
+          # Initialize overall check status (0 = success, 1 = failure)
+          CHECK_STATUS=0
+
+          echo "Searching for and checking .tofu and .tfvars files in the 'tofu/' directory recursively..."
+          echo "### Tofu Format Check Results" >> $GITHUB_STEP_SUMMARY # Add a header to the summary
+
+          # Use find to locate files and pipe them safely to a while loop
+          # This handles filenames with spaces or special characters correctly.
+          find tofu/ -type f \( -name '*.tofu' -o -name '*.tfvars' \) -print0 | while IFS= read -r -d $'\0' file; do
+            echo "Checking tofu fmt on ${file}..." # Log which file is being checked
+
+            # Run tofu fmt in check mode. It exits with non-zero status if formatting is needed.
+            tofu fmt -check "${file}"
+            FMT_STATUS=$?
+
+            # If tofu fmt failed (exit status is not 0)
+            if [[ $FMT_STATUS -ne 0 ]]; then
+              # Add a failure message to the GitHub Actions summary
+              echo "❌ **${file}**: Needs formatting. Run \`tofu fmt\`." >> $GITHUB_STEP_SUMMARY
+              # Update the overall check status to failure
+              CHECK_STATUS=1
+            else
+              # Add a success message to the GitHub Actions summary
+              echo "✅ **${file}**: Formatted correctly." >> $GITHUB_STEP_SUMMARY
+            fi
+          done
+
+          # Exit the step with the final check status
+          # If CHECK_STATUS is 1, the step (and job) will fail. If 0, it succeeds.
+          echo "Final check status: ${CHECK_STATUS}"
+          exit ${CHECK_STATUS}