diff --git a/.gitignore b/.gitignore
index 978e05fe..ad40059f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,3 +17,4 @@ opencode.jsonc
 skills-lock.json
 .DS_Store
 worker-configuration.d.ts
+wrangler.production.jsonc
diff --git a/README.md b/README.md
index e1e2eb72..da645be6 100644
--- a/README.md
+++ b/README.md
@@ -62,12 +62,20 @@ npm run dev
 1. Set your domain in `wrangler.jsonc`
 2. Create an R2 bucket named `agentic-inbox`: `wrangler r2 bucket create agentic-inbox`
 
+For production-specific values, keep a local `wrangler.production.jsonc` file. This file is ignored by git so real domains, mailbox addresses, Access values, and other deployment-specific settings are not committed. Use `wrangler.jsonc` as the shared example, copy it locally to `wrangler.production.jsonc`, then set production-only values such as `DOMAINS`, `EMAIL_ADDRESSES`, `POLICY_AUD`, and `TEAM_DOMAIN`.
+
 ### Deploy
 
 ```bash
 npm run deploy
 ```
 
+To deploy with the local production config:
+
+```bash
+npm run deploy:production
+```
+
 ## Prerequisites
 
 - Cloudflare account with a domain
diff --git a/package.json b/package.json
index 9d6f0272..670512f7 100644
--- a/package.json
+++ b/package.json
@@ -14,8 +14,11 @@
 	},
 	"scripts": {
 		"build": "react-router build",
+		"build:production": "CLOUDFLARE_CONFIG_PATH=wrangler.production.jsonc react-router build",
 		"cf-typegen": "wrangler types",
+		"cf-typegen:production": "wrangler types --config wrangler.production.jsonc",
 		"deploy": "npm run build && wrangler deploy",
+		"deploy:production": "npm run build:production && wrangler deploy",
 		"dev": "react-router dev",
 		"preview": "npm run build && vite preview",
 		"typecheck": "npm run cf-typegen && react-router typegen && tsc -b"
diff --git a/vite.config.ts b/vite.config.ts
index 2c7bfb64..7f616923 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -10,7 +10,10 @@ import tsconfigPaths from "vite-tsconfig-paths";
 
 export default defineConfig({
   plugins: [
-    cloudflare({ viteEnvironment: { name: "ssr" } }),
+    cloudflare({
+      configPath: process.env.CLOUDFLARE_CONFIG_PATH,
+      viteEnvironment: { name: "ssr" },
+    }),
     tailwindcss(),
     reactRouter(),
     tsconfigPaths(),