diff --git a/.github/workflows/reset-2fa.yml b/.github/workflows/reset-2fa.yml
new file mode 100644
index 000000000..ec88326d1
--- /dev/null
+++ b/.github/workflows/reset-2fa.yml
@@ -0,0 +1,44 @@
+name: Provision environment
+run-name: Provision ${{ github.event.inputs.environment }}
+on:
+  workflow_dispatch:
+    inputs:
+      user:
+        description: User to remove 2FA from
+        required: true
+      environment:
+        type: choice
+        description: Machine to provision
+        default: qa
+        required: true
+        options:
+          - development
+          - staging
+          - qa
+          - production
+
+jobs:
+  provision:
+    environment: ${{ github.event.inputs.environment }}
+    runs-on: ubuntu-20.04
+    outputs:
+      outcome: ${{ steps.deploy.outcome }}
+    timeout-minutes: 60
+    steps:
+      - name: Read known hosts
+        run: |
+          cd ${{ github.event.repository.name }}
+          echo "KNOWN_HOSTS<<EOF" >> $GITHUB_ENV
+          sed -i -e '$a\' ./infrastructure/.known-hosts
+          cat ./infrastructure/.known-hosts >> $GITHUB_ENV
+          echo "EOF" >> $GITHUB_ENV
+
+      - name: Install SSH Key
+        uses: shimataro/ssh-key-action@v2
+        with:
+          key: ${{ secrets.SSH_KEY }}
+          known_hosts: ${{ env.KNOWN_HOSTS }}
+
+      - name: Remove 2FA
+        run: |
+          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} -p ${{ secrets.SMTP_PORT }} "rm /home/${{ github.event.inputs.user }}/.google_authenticator"