diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
index 7d4ae4b..4a85c6c 100644
--- a/.github/workflows/terraform.yml
+++ b/.github/workflows/terraform.yml
@@ -9,15 +9,15 @@ jobs:
     - name: fmt
       uses: hashicorp/terraform-github-actions@master
       with:
-        tf_actions_version: 0.12.20
+        tf_actions_version: 0.12.21
         tf_actions_subcommand: fmt
     - name: init
       uses: hashicorp/terraform-github-actions@master
       with:
-        tf_actions_version: 0.12.20
+        tf_actions_version: 0.12.21
         tf_actions_subcommand: init
     - name: validate
       uses: hashicorp/terraform-github-actions@master
       with:
-        tf_actions_version: 0.12.20
+        tf_actions_version: 0.12.21
         tf_actions_subcommand: validate
diff --git a/README.md b/README.md
index 142acc1..e0c6abd 100644
--- a/README.md
+++ b/README.md
@@ -71,6 +71,7 @@ module "digitalocean_spoke" {
 | region | Region in which all resources will be provisioned | `string` | `"nyc1"` | no |
 | resource\_prefix | Prefix prepended to resource names | `string` | `"spoke-"` | no |
 | server\_name | Server name used in nginx config | `string` | n/a | yes |
+| spoke\_version | Git ref of MoveOnOrg/Spoke to deploy | `string` | `"v5.2"` | no |
 | ssh\_keys | List of ssh public keys to pass to droplet provisioning | `list(string)` | n/a | yes |
 
 ## Outputs
diff --git a/main.tf b/main.tf
index f3be8fc..caf843b 100644
--- a/main.tf
+++ b/main.tf
@@ -102,6 +102,12 @@ variable "region" {
   type        = string
 }
 
+variable "spoke_version" {
+  description = "Git ref of MoveOnOrg/Spoke to deploy"
+  default     = "v5.2"
+  type        = "string"
+}
+
 variable "ssh_keys" {
   type        = list(string)
   description = "List of ssh public keys to pass to droplet provisioning"
@@ -188,24 +194,25 @@ resource "random_string" "pg_password" {
 
 locals {
   env_map = merge({
-    ASSETS_MAP_FILE   = "assets.json",
-    ASSETS_DIR        = "./build/client/assets",
-    BASE_URL          = var.base_url,
-    DATABASE_URL      = "postgres://spoke:${random_string.pg_password.result}@127.0.0.1:5432/spoke",
-    DB_HOST           = "localhost",
-    DB_NAME           = "spoke",
-    DB_PASSWORD       = random_string.pg_password.result,
-    DB_PORT           = "5432",
-    DB_TYPE           = "pg",
-    DB_USER           = "spoke",
-    DB_USE_SSL        = "true",
-    JOBS_SAME_PROCESS = "1",
-    NODE_ENV          = var.node_env,
-    NODE_OPTIONS      = var.node_options,
-    OUTPUT_DIR        = "./build",
-    PORT              = var.port,
-    REDIS_URL         = "redis://127.0.0.1:6379/0",
-    SESSION_SECRET    = random_string.session_secret.result,
+    ASSETS_MAP_FILE         = "assets.json",
+    ASSETS_DIR              = "./build/client/assets",
+    BASE_URL                = var.base_url,
+    DATABASE_URL            = "postgres://spoke:${random_string.pg_password.result}@127.0.0.1:5432/spoke",
+    DB_HOST                 = "localhost",
+    DB_NAME                 = "spoke",
+    DB_PASSWORD             = random_string.pg_password.result,
+    DB_PORT                 = "5432",
+    DB_TYPE                 = "pg",
+    DB_USER                 = "spoke",
+    DB_USE_SSL              = "true",
+    JOBS_SAME_PROCESS       = "1",
+    NODE_ENV                = var.node_env,
+    NODE_OPTIONS            = var.node_options,
+    OUTPUT_DIR              = "./build",
+    PORT                    = var.port,
+    REDIS_URL               = "redis://127.0.0.1:6379/0",
+    SESSION_SECRET          = random_string.session_secret.result,
+    TERRAFORM_SPOKE_VERSION = var.spoke_version,
   }, var.env)
 }
 
diff --git a/spoke-app-provision b/spoke-app-provision
index a042657..1d4795d 100755
--- a/spoke-app-provision
+++ b/spoke-app-provision
@@ -96,12 +96,17 @@ _run_system1() {
 _run_spoke0() {
   set -o xtrace
 
+  set -o allexport
+  source /tmp/app.env
+  set +o allexport
+
   git --version
   if [[ ! -d /home/spoke/app/.git ]]; then
     git clone https://github.com/MoveOnOrg/Spoke.git /home/spoke/app
   fi
+
   cd /home/spoke/app
-  git checkout -qf 'v5.1'
+  git checkout -qf "${TERRAFORM_SPOKE_VERSION}"
 
   cp -v /tmp/spoke-app-run /home/spoke/spoke-app-run
   chmod +x /home/spoke/spoke-app-run
@@ -122,10 +127,6 @@ _run_spoke0() {
   cp -v /tmp/app.env /home/spoke/app/.env
   sha1sum /home/spoke/app/.env
 
-  set -o allexport
-  source /home/spoke/app/.env
-  set +o allexport
-
   yarn --version
   yarn install --ignore-scripts --non-interactive --frozen-lockfile