diff --git a/.github/workflows/opentofu.yml b/.github/workflows/opentofu.yml
index eea0b24..82c8a8f 100644
--- a/.github/workflows/opentofu.yml
+++ b/.github/workflows/opentofu.yml
@@ -23,6 +23,14 @@ on:
         description: AWS IAM role to assume for SOPS KMS access
         type: string
         default: arn:aws:iam::332355796717:role/github-actions-sops-kms
+      gcp-workload-identity-provider:
+        description: Google Workload Identity Provider resource name
+        type: string
+        default: ""
+      gcp-service-account:
+        description: Google service account email to impersonate through Workload Identity Federation
+        type: string
+        default: ""
     secrets:
       SSH_PRIVATE_KEY:
         required: false
@@ -64,11 +72,19 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Configure AWS credentials for SOPS KMS
+        if: inputs.gcp-workload-identity-provider == ''
         uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           role-to-assume: ${{ inputs.aws-role-to-assume }}
           aws-region: ${{ inputs.aws-region }}
 
+      - name: Configure Google credentials through Workload Identity Federation
+        if: inputs.gcp-workload-identity-provider != ''
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
+        with:
+          workload_identity_provider: ${{ inputs.gcp-workload-identity-provider }}
+          service_account: ${{ inputs.gcp-service-account }}
+
       - name: Install SSH key
         if: ${{ inputs.setup-ssh }}
         uses: shimataro/ssh-key-action@87a8f067114a8ce263df83e9ed5c849953548bc3 # v2.8.1
@@ -147,11 +163,19 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Configure AWS credentials for SOPS KMS
+        if: inputs.gcp-workload-identity-provider == ''
         uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           role-to-assume: ${{ inputs.aws-role-to-assume }}
           aws-region: ${{ inputs.aws-region }}
 
+      - name: Configure Google credentials through Workload Identity Federation
+        if: inputs.gcp-workload-identity-provider != ''
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
+        with:
+          workload_identity_provider: ${{ inputs.gcp-workload-identity-provider }}
+          service_account: ${{ inputs.gcp-service-account }}
+
       - name: Install SSH key
         if: ${{ inputs.setup-ssh }}
         uses: shimataro/ssh-key-action@87a8f067114a8ce263df83e9ed5c849953548bc3 # v2.8.1
diff --git a/AGENTS.md b/AGENTS.md
index 108b1e4..bf2cadb 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -32,8 +32,10 @@ Reusable workflow for OpenTofu/Terraform root module repositories (`tfroot-*`).
 | `environment` | `production` | Environment for the apply job |
 | `aws-region` | `us-west-2` | AWS region for SOPS KMS access |
 | `aws-role-to-assume` | `arn:aws:iam::332355796717:role/github-actions-sops-kms` | IAM role assumed via GitHub OIDC for SOPS KMS decrypt/encrypt |
+| `gcp-workload-identity-provider` | empty | Google Workload Identity Provider resource name; when set, it replaces AWS authentication |
+| `gcp-service-account` | empty | Google service account to impersonate through Workload Identity Federation |
 
-The test job has only `contents: read` permission and does not receive AWS or SSH credentials. The plan job has `contents: read`, `id-token: write`, and `pull-requests: write`; the apply job has `contents: read` and `id-token: write`. Caller workflows must grant the permissions needed by credentialed plan and apply jobs. SOPS decryption for `tfroot-*` repos uses AWS KMS via OIDC; do not pass `SOPS_AGE_KEY` to this workflow.
+The test job has only `contents: read` permission and does not receive cloud or SSH credentials. The plan job has `contents: read`, `id-token: write`, and `pull-requests: write`; the apply job has `contents: read` and `id-token: write`. Caller workflows must grant the permissions needed by credentialed plan and apply jobs. By default, SOPS decryption for `tfroot-*` repos uses AWS KMS via OIDC; do not pass `SOPS_AGE_KEY` to this workflow. Set both GCP inputs to use Google Workload Identity Federation instead.
 
 There is no `container` input. The `arc-tf` runner pod IS the image, so adding `container:` on top would nest a container inside a container — don't do it.
 
diff --git a/README.md b/README.md
index 88929dc..878ba98 100644
--- a/README.md
+++ b/README.md
@@ -46,7 +46,8 @@ See [images](https://github.com/makeitworkcloud/images) for container source and
 
 ## Repository Setup
 
-1. Grant `id-token: write` in the caller workflow so GitHub OIDC can assume the SOPS KMS role.
-2. Ensure the default `aws-role-to-assume` exists (`arn:aws:iam::332355796717:role/github-actions-sops-kms`) or pass another role ARN.
-3. Create caller workflow in `.github/workflows/`.
-4. Ensure repository has required files (e.g., `Makefile` with expected targets).
+1. Grant `id-token: write` in the caller workflow so GitHub OIDC can authenticate the cloud provider.
+2. For AWS roots, ensure the default `aws-role-to-assume` exists (`arn:aws:iam::332355796717:role/github-actions-sops-kms`) or pass another role ARN.
+3. For GCP roots, pass both `gcp-workload-identity-provider` and `gcp-service-account`; this selects Google Workload Identity Federation instead of AWS credentials.
+4. Create caller workflow in `.github/workflows/`.
+5. Ensure repository has required files (e.g., `Makefile` with expected targets).