diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index b955989..d8853f7 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -36,18 +36,6 @@ jobs:
         client-id: ${{ secrets.AZURE_CLIENT_ID }}
         tenant-id: ${{ secrets.AZURE_TENANT_ID }}
         subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-    - name: Open Bastion tunnel
-      uses: azure/cli@v2
-      with:
-        azcliversion: latest
-        inlineScript: |
-          az config set extension.dynamic_install_allow_preview=true
-
-          echo Opening tunnel
-          az network bastion tunnel --name ${{ secrets.BASTION_NAME }} --resource-group ${{ secrets.RESOURCE_GROUP }} --target-resource-id ${{ secrets.RESOURCE_ID }} --resource-port 22 --port 50022 --debug &
-
-          echo Wait for bastion tunnel to open
-          az network bastion wait --created --name ${{ secrets.BASTION_NAME }} --resource-group ${{ secrets.RESOURCE_GROUP }} --debug
     - run: |
           ARGS="-avh --delete"
           USERNAME=risa
@@ -58,6 +46,14 @@ jobs:
           echo "$DEPLOY_KEY" > "$SSHPATH/key"
           chmod 600 "$SSHPATH/key"
 
+          az config set extension.dynamic_install_allow_preview=true
+
+          echo Opening tunnel
+          az network bastion tunnel --name ${{ secrets.BASTION_NAME }} --resource-group ${{ secrets.RESOURCE_GROUP }} --target-resource-id ${{ secrets.RESOURCE_ID }} --resource-port 22 --port 50022 --debug &
+
+          echo Wait for bastion tunnel to open
+          az network bastion wait --created --name ${{ secrets.BASTION_NAME }} --resource-group ${{ secrets.RESOURCE_GROUP }} --debug
+
           echo Upload new libraries
           FOLDER=build/install/risa/lib
           sh -c "rsync $ARGS  -e 'ssh -i $SSHPATH/key -o StrictHostKeyChecking=no -p 50022' $GITHUB_WORKSPACE/$FOLDER $USERNAME@127.0.0.1:$SERVER_DESTINATION"