diff --git a/.github/build-setup.yml b/.github/build-setup.yml
index 2d98e0f..188b7a7 100644
--- a/.github/build-setup.yml
+++ b/.github/build-setup.yml
@@ -1,7 +1,9 @@
 - name: Install Doppler CLI
   uses: dopplerhq/cli-action@v4
 - name: Generate .env from Doppler secrets
-  run: doppler secrets download --no-file --format env > .env
+  # Only the keys build.rs compiles into the binary
+  shell: bash
+  run: doppler secrets download --no-file --format env | grep -E '^(SITE_HOST|CONVEX_HTTP_URL|PLAYSITE_HOST)=' > .env
   env:
     DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }}
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d6b4375..e69830b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -130,7 +130,8 @@ jobs:
       - name: "Install Doppler CLI"
         uses: "dopplerhq/cli-action@v4"
       - name: "Generate .env from Doppler secrets"
-        run: "doppler secrets download --no-file --format env > .env"
+        run: "doppler secrets download --no-file --format env | grep -E '^(SITE_HOST|CONVEX_HTTP_URL|PLAYSITE_HOST)=' > .env"
+        shell: "bash"
         env:
           "DOPPLER_TOKEN": "${{ secrets.DOPPLER_TOKEN }}"
       - name: Install dist
diff --git a/build.rs b/build.rs
index f52ccdb..3e3fb94 100644
--- a/build.rs
+++ b/build.rs
@@ -22,20 +22,9 @@ fn main() {
     };
     println!("cargo:rustc-env=CONFIG_DIR={}", config_dir);
 
-    // Optional Cloudflare Access credentials (only needed for staging)
-    let optional = ["CF_ACCESS_CLIENT_ID", "CF_ACCESS_CLIENT_SECRET"];
-
-    for var in optional {
-        if let Ok(value) = std::env::var(var) {
-            println!("cargo:rustc-env={}={}", var, value);
-        }
-    }
-
     println!("cargo:rerun-if-changed=.env");
     println!("cargo:rerun-if-env-changed=SITE_HOST");
     println!("cargo:rerun-if-env-changed=CONVEX_HTTP_URL");
     println!("cargo:rerun-if-env-changed=PLAYSITE_HOST");
-    println!("cargo:rerun-if-env-changed=CF_ACCESS_CLIENT_ID");
-    println!("cargo:rerun-if-env-changed=CF_ACCESS_CLIENT_SECRET");
 }
 
diff --git a/src/config.rs b/src/config.rs
index 526b900..9b15026 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -54,8 +54,6 @@ struct Config {
     /// — serves the default-entrypoint scripts `wavedash dev` boots engine
     /// builds with. https-prefixed here like site_host.
     playsite_host: String,
-    cf_access_client_id: Option<String>,
-    cf_access_client_secret: Option<String>,
 }
 
 impl Config {
@@ -77,8 +75,6 @@ impl Config {
             open_browser_website_host: site_host,
             api_host: env!("CONVEX_HTTP_URL").to_string(),
             playsite_host,
-            cf_access_client_id: option_env!("CF_ACCESS_CLIENT_ID").map(|s| s.to_string()),
-            cf_access_client_secret: option_env!("CF_ACCESS_CLIENT_SECRET").map(|s| s.to_string()),
         })
     }
 }
@@ -103,38 +99,14 @@ pub fn credentials_path() -> Result<PathBuf> {
 /// "please upgrade" prompts without parsing User-Agent.
 pub const CLI_VERSION_HEADER: &str = "X-Wavedash-CLI-Version";
 
-/// Create an HTTP client configured with the CLI version header (always)
-/// and Cloudflare Access headers (only on staging when creds are baked in).
+/// Create an HTTP client configured with the CLI version header.
 pub fn create_http_client() -> Result<reqwest::Client> {
-    let config = Config::load()?;
-
     let mut headers = reqwest::header::HeaderMap::new();
     headers.insert(
         CLI_VERSION_HEADER,
         reqwest::header::HeaderValue::from_static(env!("CARGO_PKG_VERSION")),
     );
 
-    let api_host = &config.api_host;
-    let needs_cf_headers = api_host
-        .trim_start_matches("https://")
-        .trim_start_matches("http://")
-        .ends_with("staging.wavedash.gg");
-
-    if needs_cf_headers {
-        if let (Some(client_id), Some(client_secret)) =
-            (&config.cf_access_client_id, &config.cf_access_client_secret)
-        {
-            headers.insert(
-                "CF-Access-Client-Id",
-                reqwest::header::HeaderValue::from_str(client_id)?,
-            );
-            headers.insert(
-                "CF-Access-Client-Secret",
-                reqwest::header::HeaderValue::from_str(client_secret)?,
-            );
-        }
-    }
-
     Ok(reqwest::Client::builder().default_headers(headers).build()?)
 }