diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index 5f948c7..5c0eecb 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -18,13 +18,13 @@ jobs:
       APP_URL: "http://localhost:3000"
       NEXT_PUBLIC_SITE_URL: "http://localhost:3000"
       DEPLOYMENT_ENVIRONMENT: "staging"
-      SESSION_SECRET: "ci-session-secret-change-me"
+      SESSION_SECRET: ${{ secrets.SESSION_SECRET }}
       DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/opensolve?schema=public"
       DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/opensolve?schema=public"
       LOG_LEVEL: "info"
       RATE_LIMIT_WINDOW_SECONDS: "60"
       RATE_LIMIT_MAX_REQUESTS: "250"
-      SENSITIVE_DATA_KEY: "ci-sensitive-data-key-change-me"
+      SENSITIVE_DATA_KEY: ${{ secrets.SENSITIVE_DATA_KEY }}
       REALTIME_WORKER_TOKEN: "ci-realtime-token"
       METRICS_ACCESS_TOKEN: "ci-metrics-token"
     services:
@@ -49,6 +49,7 @@ jobs:
           cache: "npm"
       - run: npm ci
       - run: npm run prisma:generate
+      - run: npx prisma migrate deploy
       - run: npm run lint
       - run: npm run typecheck
       - run: npm run test
@@ -63,13 +64,13 @@ jobs:
       APP_URL: "http://localhost:3000"
       NEXT_PUBLIC_SITE_URL: "http://localhost:3000"
       DEPLOYMENT_ENVIRONMENT: "staging"
-      SESSION_SECRET: "ci-session-secret-change-me"
+      SESSION_SECRET: ${{ secrets.SESSION_SECRET }}
       DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/opensolve?schema=public"
       DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/opensolve?schema=public"
       LOG_LEVEL: "info"
       RATE_LIMIT_WINDOW_SECONDS: "60"
       RATE_LIMIT_MAX_REQUESTS: "250"
-      SENSITIVE_DATA_KEY: "ci-sensitive-data-key-change-me"
+      SENSITIVE_DATA_KEY: ${{ secrets.SENSITIVE_DATA_KEY }}
       REALTIME_WORKER_TOKEN: "ci-realtime-token"
       METRICS_ACCESS_TOKEN: "ci-metrics-token"
     services:
diff --git a/lib/env.ts b/lib/env.ts
index b7c746e..8243947 100644
--- a/lib/env.ts
+++ b/lib/env.ts
@@ -25,7 +25,9 @@ export const env = createEnv({
   server: {
     DATABASE_URL: z.string().url(),
     DIRECT_URL: z.string().url().optional(),
-    SESSION_SECRET: z.string().min(32),
+    SESSION_SECRET: emptyToUndefined(z.string().min(32)).default(
+      "opensolve-test-session-secret-please-change-me-1234567890",
+    ),
     APP_URL: z.string().url(),
     DEPLOYMENT_ENVIRONMENT: z
       .enum(["development", "staging", "production", "preview"])
@@ -68,10 +70,9 @@ export const env = createEnv({
     JUDGE_SANDBOX_DRIVER: z.enum(["docker", "mock"]).default("docker"),
     JUDGE_SANDBOX_WORKDIR: emptyToUndefined(z.string()),
     REALTIME_WORKER_TOKEN: emptyToUndefined(z.string()),
-    SENSITIVE_DATA_KEY: z
-      .string()
-      .min(32, "SENSITIVE_DATA_KEY must be at least 32 characters")
-      .default("opensolve-sensitive-data-key-please-change-me-123"),
+    SENSITIVE_DATA_KEY: emptyToUndefined(
+      z.string().min(32, "SENSITIVE_DATA_KEY must be at least 32 characters"),
+    ).default("opensolve-sensitive-data-key-please-change-me-123"),
     METRICS_ACCESS_TOKEN: emptyToUndefined(z.string()),
   },
   client: {
diff --git a/package.json b/package.json
index 36b21f3..2ea43ec 100644
--- a/package.json
+++ b/package.json
@@ -13,8 +13,9 @@
     "typecheck": "tsc --noEmit",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "test": "cross-env SKIP_DB_SETUP=1 vitest run",
-    "test:watch": "cross-env SKIP_DB_SETUP=1 vitest watch",
+    "test": "cross-env SESSION_SECRET=\"test-session-secret-change-me-1234567890\" SENSITIVE_DATA_KEY=\"test-sensitive-data-key-change-me-1234567890\" vitest run",
+    "test:watch": "cross-env SESSION_SECRET=\"test-session-secret-change-me-1234567890\" SENSITIVE_DATA_KEY=\"test-sensitive-data-key-change-me-1234567890\" vitest watch",
+    "test:skip-db": "cross-env SKIP_DB_SETUP=1 SESSION_SECRET=\"test-session-secret-change-me-1234567890\" SENSITIVE_DATA_KEY=\"test-sensitive-data-key-change-me-1234567890\" vitest run",
     "prisma:generate": "prisma generate",
     "db:migrate:dev": "prisma migrate dev",
     "db:migrate:deploy": "prisma migrate deploy",
@@ -147,8 +148,5 @@
     "tw-animate-css": "^1.4.0",
     "typescript": "^5",
     "vitest": "^4.0.8"
-  },
-  "prisma": {
-    "seed": "tsx prisma/seed.ts"
   }
 }
diff --git a/prisma.config.mjs b/prisma.config.mjs
new file mode 100644
index 0000000..7178b27
--- /dev/null
+++ b/prisma.config.mjs
@@ -0,0 +1,5 @@
+import { defineConfig } from "prisma/config";
+
+export default defineConfig({
+  seed: "tsx prisma/seed.ts",
+});
diff --git a/vitest.setup.ts b/vitest.setup.ts
index 57ce4ac..0a790bf 100644
--- a/vitest.setup.ts
+++ b/vitest.setup.ts
@@ -26,7 +26,10 @@ if (skipDbSetup) {
   process.env.DATABASE_URL = dbUrl.toString();
   process.env.TEST_DB_SCHEMA = testSchema;
 
-  execSync(`DATABASE_URL=${process.env.DATABASE_URL} npx prisma migrate deploy`, {
-    stdio: "inherit",
-  });
+  execSync(
+    `DATABASE_URL=${process.env.DATABASE_URL} npx prisma db push --skip-generate --accept-data-loss`,
+    {
+      stdio: "inherit",
+    },
+  );
 }