diff --git a/ci/pipelines/cf-deployment.yml b/ci/pipelines/cf-deployment.yml
index b111a71e4..857e96461 100644
--- a/ci/pipelines/cf-deployment.yml
+++ b/ci/pipelines/cf-deployment.yml
@@ -1155,6 +1155,7 @@ jobs:
         operations/use-s3-blobstore.yml
         operations/scale-database-cluster.yml
         operations/stop-skipping-tls-validation.yml
+        operations/enable-identity-aware-routing.yml
         operations/use-operator-provided-router-tls-certificates.yml
         operations/experimental/colocate-smoke-tests-on-cc-worker.yml
         operations/experimental/enable-oci-phase-1.yml
@@ -1211,6 +1212,7 @@ jobs:
         operations/use-s3-blobstore.yml
         operations/scale-database-cluster.yml
         operations/stop-skipping-tls-validation.yml
+        operations/enable-identity-aware-routing.yml
         operations/use-operator-provided-router-tls-certificates.yml
         operations/experimental/colocate-smoke-tests-on-cc-worker.yml
         operations/experimental/enable-oci-phase-1.yml
@@ -1240,6 +1242,15 @@ jobs:
         INSTANCE_GROUP_NAME: uaa
         SYSTEM_DOMAIN: cf.hermione.env.wg-ard.ci.cloudfoundry.org
         SECURITY_GROUP_NAME: uaa
+    - task: open-asgs-for-router
+      file: cf-deployment-concourse-tasks/open-asgs-for-bosh-instance-group/task.yml
+      input_mapping:
+        bbl-state: relint-envs
+      params:
+        BBL_STATE_DIR: environments/test/hermione/bbl-state
+        INSTANCE_GROUP_NAME: router
+        SYSTEM_DOMAIN: cf.hermione.env.wg-ard.ci.cloudfoundry.org
+        SECURITY_GROUP_NAME: identity-aware-routing-router
     - task: set-feature-flags
       file: cf-deployment-concourse-tasks/set-feature-flags/task.yml
       input_mapping:
@@ -1251,6 +1262,33 @@ jobs:
           diego_docker
           task_creation
           service_instance_sharing
+    - task: create-identity-aware-domain
+      input_mapping:
+        bbl-state: relint-envs
+      config:
+        platform: linux
+        image_resource:
+          type: registry-image
+          source:
+            repository: cloudfoundry/cf-deployment-concourse-tasks
+        inputs:
+          - name: bbl-state
+          - name: cf-deployment-concourse-tasks
+        params:
+          BBL_STATE_DIR: environments/test/hermione/bbl-state
+          SYSTEM_DOMAIN: cf.hermione.env.wg-ard.ci.cloudfoundry.org
+        run:
+          path: bash
+          args:
+            - -euc
+            - |
+              source cf-deployment-concourse-tasks/shared-functions
+              setup_bosh_env_vars
+              setup_password_from_credhub cf_admin_password
+              cf api "api.${SYSTEM_DOMAIN}"
+              set +x; cf auth admin "${cf_admin_password}"; set -x
+              cf create-shared-domain apps.identity --enforce-route-policies --scope org || true
+
 
 - name: experimental-ops-files
   public: true