diff --git a/.github/workflows/deploy-staging-ecs.yml b/.github/workflows/deploy-staging-ecs.yml
index dc780e83a..028807d3e 100644
--- a/.github/workflows/deploy-staging-ecs.yml
+++ b/.github/workflows/deploy-staging-ecs.yml
@@ -6,7 +6,7 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
-    environment: AWS_ENV_VARS
+    environment: Staging
 
     permissions:
       packages: write
@@ -22,7 +22,7 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6
         with:
-          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+          role-to-assume: ${{ secrets.DEPLOY_ROLE_ARN }}
           aws-region: ap-south-1
 
       - name: Login to Amazon ECR
diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index c5a60658d..6a6f12bfc 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,4 +1,4 @@
-name: Deploy Kaapi staging to EC2
+name: Deploy Kaapi to Staging EC2
 
 on:
   workflow_run:
@@ -14,7 +14,7 @@ concurrency:
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    environment: AWS_STAGING_ENV
+    environment: Staging
     # workflow_dispatch runs unconditionally; workflow_run only on a green CI.
     if: >-
       ${{ github.event_name == 'workflow_dispatch' ||
@@ -28,23 +28,24 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6
         with:
-          role-to-assume: ${{ secrets.STAGING_EC2_DEPLOY_ROLE_ARN }}
+          role-to-assume: ${{ secrets.DEPLOY_ROLE_ARN }}
           aws-region: ap-south-1
 
       - name: Trigger deploy on EC2 via SSM
         id: ssm
         env:
-          INSTANCE_ID: ${{ secrets.STAGING_EC2_INSTANCE_ID }}
-          SECRET_ID: ${{ vars.STAGING_SECRET_ID }}
+          INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
+          SECRET_IDs: ${{ vars.SECRET_MANAGER_IDS }}
+          APP_DIR: ${{ secrets.APP_DIR }}
           DEPLOY_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
         run: |
-          SECRET_ID=$(echo "$SECRET_ID" | tr -d '[:space:]')
-          echo "Deploying commit: $DEPLOY_SHA"
+          SECRET_IDs=$(echo "$SECRET_IDs" | tr -d '[:space:]')
+          : "${APP_DIR:?APP_DIR repo/environment variable is not set}"
 
-          DEPLOY_CMD="cd /data/kaapi-backend \
+          DEPLOY_CMD="cd $APP_DIR \
             && git fetch --all \
             && git checkout $DEPLOY_SHA \
-            && SECRET_ID=$SECRET_ID sh scripts/fetch-secrets.sh \
+            && SECRET_ID=$SECRET_IDs sh scripts/fetch-secrets.sh \
             && GIT_SHA=$DEPLOY_SHA docker compose -f docker-compose.staging.yml build \
             && docker compose -f docker-compose.staging.yml --profile migrate run --rm migrate \
             && docker compose -f docker-compose.staging.yml up -d --wait --remove-orphans \
@@ -54,7 +55,7 @@ jobs:
             --instance-ids "$INSTANCE_ID" \
             --document-name "AWS-RunShellScript" \
             --comment "Deploy kaapi-backend kaapi-staging" \
-            --parameters commands='["set -eux","chown -R ubuntu:ubuntu /data/kaapi-backend","sudo -iu ubuntu bash -lc \"'"$DEPLOY_CMD"'\""]' \
+            --parameters commands='["set -eux","sudo -iu ec2-user bash -lc \"'"$DEPLOY_CMD"'\""]' \
             --cloud-watch-output-config CloudWatchOutputEnabled=true \
             --query "Command.CommandId" --output text)
           echo "cmd_id=$CMD_ID" >> "$GITHUB_OUTPUT"
@@ -63,7 +64,7 @@ jobs:
       - name: Wait for SSM command to finish
         timeout-minutes: 10
         env:
-          INSTANCE_ID: ${{ secrets.STAGING_EC2_INSTANCE_ID }}
+          INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
           CMD_ID: ${{ steps.ssm.outputs.cmd_id }}
         run: |
           while true; do
@@ -108,7 +109,7 @@ jobs:
       - uses: ./.github/actions/discord-notify
         with:
           webhook-url: ${{ secrets.DISCORD_WEBHOOK_URL }}
-          name: kaapi-staging
+          name: kaapi-backend-staging
           release: "#${{ github.run_number }}"
           sha: ${{ github.event.workflow_run.head_sha || github.sha }}
           run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}