diff --git a/web/cloudflare-worker/README.md b/web/cloudflare-worker/README.md
index 240e22d88fcd..7cbb1b0cefdd 100644
--- a/web/cloudflare-worker/README.md
+++ b/web/cloudflare-worker/README.md
@@ -107,11 +107,11 @@ The script diffs status, caching and security headers for a fixed set of paths.
 
 | Environment | Worker | Route | CSP |
 | --- | --- | --- | --- |
-| `test-staging` | `test-staging-new-expensify-assets` | `test-staging.new.expensify.com/*` | Staging |
+| `test-staging` | `test-staging-new-expensify-assets` | `test-staging.new.expensify.com/*` (managed in Cloudflare, not in `wrangler.jsonc`) | Staging |
 | `staging` | `staging-new-expensify-assets` | None until switchover, then `staging.new.expensify.com/*` | Staging |
 | `production` | `new-expensify-assets` | None until switchover, then `new.expensify.com/*` | Production |
 
-`test-staging` serves a staging build on a hostname nobody else uses. Every staging deploy also deploys the same build there (the `webDeployTestStaging` job in `.github/workflows/deploy.yml`), using `CLOUDFLARE_WORKERS_DEPLOY_TOKEN`, which can only edit this Worker. A failure there does not fail the staging deploy. To deploy it by hand, put a staging build in `dist/` and run:
+`test-staging` serves a staging build on a hostname nobody else uses. Every staging deploy also deploys the same build there (the `webDeployTestStaging` job in `.github/workflows/deploy.yml`), using `CLOUDFLARE_WORKERS_DEPLOY_TOKEN`, which can only edit this Worker. That token can't read zones, so the route isn't in `wrangler.jsonc`: wrangler would try to sync it and fail. A failure there does not fail the staging deploy. To deploy it by hand, put a staging build in `dist/` and run:
 
 ```bash
 npx wrangler deploy --env test-staging
diff --git a/web/cloudflare-worker/wrangler.jsonc b/web/cloudflare-worker/wrangler.jsonc
index 4a96b6d90679..611081288528 100644
--- a/web/cloudflare-worker/wrangler.jsonc
+++ b/web/cloudflare-worker/wrangler.jsonc
@@ -28,9 +28,10 @@
     },
     "env": {
         // Serves a staging build on a hostname nobody else uses, so it can be deployed and tested independently.
+        // Its route (test-staging.new.expensify.com/*) is managed in Cloudflare, not here: syncing routes needs zone
+        // access, and the CI deploy token can only edit this Worker.
         "test-staging": {
             "name": "test-staging-new-expensify-assets",
-            "routes": [{"pattern": "test-staging.new.expensify.com/*", "zone_name": "expensify.com"}],
             "vars": {
                 "ENVIRONMENT": "staging",
             },