diff --git a/infrastructure/open_cti.tf b/infrastructure/open_cti.tf
index 449c2959a..023fcf80d 100644
--- a/infrastructure/open_cti.tf
+++ b/infrastructure/open_cti.tf
@@ -83,7 +83,13 @@ resource "aws_iam_role_policy" "open_cti_ssm_read_secrets" {
         "ssm:GetParameters",
         "ssm:GetParametersByPath",
       ],
-      Resource = "arn:${var.aws_partition}:ssm:${var.aws_region}:*:parameter${var.open_cti_ssm_path_prefix}*"
+      Resource = [
+        "arn:${var.aws_partition}:ssm:${var.aws_region}:*:parameter${var.open_cti_ssm_path_prefix}*",
+        # install-deps.sh reads these to install the Wiz sensor.
+        "arn:${var.aws_partition}:ssm:${var.aws_region}:*:parameter${var.ssm_wiz_backend_env}",
+        "arn:${var.aws_partition}:ssm:${var.aws_region}:*:parameter${var.ssm_wiz_api_client_id}",
+        "arn:${var.aws_partition}:ssm:${var.aws_region}:*:parameter${var.ssm_wiz_api_client_secret}",
+      ]
     }]
   })
 }
@@ -256,16 +262,19 @@ locals {
     "set -euo pipefail",
     "",
     templatefile("${path.module}/open_cti_user_data_env.sh.tpl", {
-      ssm_path_prefix     = var.open_cti_ssm_path_prefix
-      repo_url            = var.open_cti_repo_url
-      repo_branch         = var.open_cti_repo_branch
-      opencti_host        = var.open_cti_host
-      opencti_admin_email = var.open_cti_admin_email
-      smtp_hostname       = var.open_cti_smtp_hostname
-      censys_org_id       = var.open_cti_censys_org_id
-      qualys_api_username = var.open_cti_qualys_api_username
-      xtm_one_host        = var.open_cti_xtm_one_host
-      xtm_one_admin_email = var.open_cti_xtm_one_admin_email
+      ssm_path_prefix                 = var.open_cti_ssm_path_prefix
+      repo_url                        = var.open_cti_repo_url
+      repo_branch                     = var.open_cti_repo_branch
+      opencti_host                    = var.open_cti_host
+      opencti_admin_email             = var.open_cti_admin_email
+      smtp_hostname                   = var.open_cti_smtp_hostname
+      censys_org_id                   = var.open_cti_censys_org_id
+      qualys_api_username             = var.open_cti_qualys_api_username
+      xtm_one_host                    = var.open_cti_xtm_one_host
+      xtm_one_admin_email             = var.open_cti_xtm_one_admin_email
+      wiz_backend_env_ssm_param       = var.ssm_wiz_backend_env
+      wiz_api_client_id_ssm_param     = var.ssm_wiz_api_client_id
+      wiz_api_client_secret_ssm_param = var.ssm_wiz_api_client_secret
     }),
     "",
     "cat > /opt/open-cti/install-deps.sh <<'INSTALL_DEPS_EOF'",
diff --git a/infrastructure/open_cti_user_data_env.sh.tpl b/infrastructure/open_cti_user_data_env.sh.tpl
index 2dd308e83..08be3b170 100644
--- a/infrastructure/open_cti_user_data_env.sh.tpl
+++ b/infrastructure/open_cti_user_data_env.sh.tpl
@@ -27,4 +27,7 @@ CENSYS_ORG_ID="${censys_org_id}"
 QUALYS_API_USERNAME="${qualys_api_username}"
 XTM_ONE_HOST="${xtm_one_host}"
 XTM_ONE_ADMIN_EMAIL="${xtm_one_admin_email}"
+WIZ_BACKEND_ENV_SSM_PARAM="${wiz_backend_env_ssm_param}"
+WIZ_API_CLIENT_ID_SSM_PARAM="${wiz_api_client_id_ssm_param}"
+WIZ_API_CLIENT_SECRET_SSM_PARAM="${wiz_api_client_secret_ssm_param}"
 ENV_DEPLOY_EOF
diff --git a/infrastructure/stage.tfvars b/infrastructure/stage.tfvars
index b86e1dc7a..9cc34d354 100644
--- a/infrastructure/stage.tfvars
+++ b/infrastructure/stage.tfvars
@@ -151,3 +151,6 @@ playwright_worker_repository_name            = "crossfeed-playwright-staging-wor
 zscaler_cert_bucket_name                     = "cisa-crossfeed-staging-zscaler"
 backend_api_log_group_name                   = "cyhy-staging-backend-api"
 backend_api_requests_log_group_name          = "cyhy-staging-backend-api-requests"
+ssm_wiz_backend_env                          = "/crossfeed/staging/WIZ_BACKEND_ENV"
+ssm_wiz_api_client_secret                    = "/crossfeed/staging/WIZ_API_CLIENT_SECRET"
+ssm_wiz_api_client_id                        = "/crossfeed/staging/WIZ_API_CLIENT_ID"
diff --git a/infrastructure/vars.tf b/infrastructure/vars.tf
index 03ce7b44e..395c5238d 100644
--- a/infrastructure/vars.tf
+++ b/infrastructure/vars.tf
@@ -1315,3 +1315,21 @@ variable "ssm_pe_s3_bucket" {
   type        = string
   default     = "/crossfeed/staging/PE_S3_BUCKET"
 }
+
+variable "ssm_wiz_backend_env" {
+  description = "ssm_wiz_backend_env"
+  type        = string
+  default     = "/crossfeed/staging/WIZ_BACKEND_ENV"
+}
+
+variable "ssm_wiz_api_client_secret" {
+  description = "ssm_wiz_api_client_secret"
+  type        = string
+  default     = "/crossfeed/staging/WIZ_API_CLIENT_SECRET"
+}
+
+variable "ssm_wiz_api_client_id" {
+  description = "ssm_wiz_api_client_id"
+  type        = string
+  default     = "/crossfeed/staging/WIZ_API_CLIENT_ID"
+}
diff --git a/open-cti/install-deps.sh b/open-cti/install-deps.sh
index 93067e9c9..b4f468c1d 100644
--- a/open-cti/install-deps.sh
+++ b/open-cti/install-deps.sh
@@ -95,3 +95,27 @@ if ! command -v aws >/dev/null 2>&1; then
   log "FATAL: aws CLI not found -- confirm the base AMI ships it." >&2
   exit 1
 fi
+
+# WIZ Sensor Installation - Variables fetched from SSM via env.deploy
+if [[ -d /opt/wiz/sensor ]] || systemctl list-unit-files 2>/dev/null | grep -qi '^wiz-sensor'; then
+  log "Wiz sensor already installed, skipping."
+else
+  log "Installing Wiz sensor..."
+  # shellcheck source=/dev/null
+  source /opt/open-cti/env.deploy
+  : "${WIZ_BACKEND_ENV_SSM_PARAM:?WIZ_BACKEND_ENV_SSM_PARAM must be set in /opt/open-cti/env.deploy}"
+  : "${WIZ_API_CLIENT_ID_SSM_PARAM:?WIZ_API_CLIENT_ID_SSM_PARAM must be set in /opt/open-cti/env.deploy}"
+  : "${WIZ_API_CLIENT_SECRET_SSM_PARAM:?WIZ_API_CLIENT_SECRET_SSM_PARAM must be set in /opt/open-cti/env.deploy}"
+
+  ssm_get() { aws ssm get-parameter --name "$1" --with-decryption --query 'Parameter.Value' --output text; }
+  WIZ_BACKEND_ENV=$(ssm_get "$WIZ_BACKEND_ENV_SSM_PARAM")
+  WIZ_API_CLIENT_ID=$(ssm_get "$WIZ_API_CLIENT_ID_SSM_PARAM")
+  WIZ_API_CLIENT_SECRET=$(ssm_get "$WIZ_API_CLIENT_SECRET_SSM_PARAM")
+  export WIZ_BACKEND_ENV WIZ_API_CLIENT_ID WIZ_API_CLIENT_SECRET
+
+  WIZ_INSTALLER=$(mktemp)
+  curl -fsSL https://downloads.wiz.us/sensor/sensor_install.sh -o "$WIZ_INSTALLER"
+  bash "$WIZ_INSTALLER"
+  rm -f "$WIZ_INSTALLER"
+  unset WIZ_API_CLIENT_ID WIZ_API_CLIENT_SECRET
+fi
diff --git a/open-cti/refresh-repo.sh b/open-cti/refresh-repo.sh
index 151cc1b4c..8e7ccddb8 100644
--- a/open-cti/refresh-repo.sh
+++ b/open-cti/refresh-repo.sh
@@ -15,11 +15,17 @@ source "$OPEN_CTI_DIR/env.deploy"
 : "${OPEN_CTI_REPO_URL:?OPEN_CTI_REPO_URL must be set in $OPEN_CTI_DIR/env.deploy}"
 : "${OPEN_CTI_REPO_BRANCH:?OPEN_CTI_REPO_BRANCH must be set in $OPEN_CTI_DIR/env.deploy}"
 
+# Sparse checkout: only open-cti/ is materialized under $REPO_DIR (paths unchanged, e.g.
+# $REPO_DIR/open-cti/bootstrap.sh); the rest of the monorepo is never written to disk.
+# --filter=blob:none also skips downloading blobs outside the sparse set.
 if [[ -d "$REPO_DIR/.git" ]]; then
+  # Idempotent -- also shrinks a pre-existing full checkout on its next boot.
+  git -C "$REPO_DIR" sparse-checkout set open-cti
   git -C "$REPO_DIR" fetch --depth 1 origin "$OPEN_CTI_REPO_BRANCH"
   git -C "$REPO_DIR" reset --hard "origin/$OPEN_CTI_REPO_BRANCH"
 else
-  git clone --depth 1 --branch "$OPEN_CTI_REPO_BRANCH" "$OPEN_CTI_REPO_URL" "$REPO_DIR"
+  git clone --depth 1 --filter=blob:none --sparse --branch "$OPEN_CTI_REPO_BRANCH" "$OPEN_CTI_REPO_URL" "$REPO_DIR"
+  git -C "$REPO_DIR" sparse-checkout set open-cti
 fi
 
 install -m 644 "$REPO_DIR/open-cti/systemd/open-cti-render-env.service" /etc/systemd/system/