diff --git a/README.md b/README.md
index 30e804b..1ee8e81 100644
--- a/README.md
+++ b/README.md
@@ -113,13 +113,21 @@ cp env.example.json env.json
 # edit env.json and set "domain" to your domain
 ```
 
-`just deploy` reads `env.json` at deploy time and passes the base domain to
-wrangler — each worker is attached to its custom domain via `--domain
-<subdomain>.<domain>`, and the base domain is injected as the `DOMAIN` var so
-the `ns` service-discovery document and the api share-link base URL are built at
-runtime. Nothing in version control is rewritten; committed `wrangler.jsonc`
-files have no routes, and per-app subdomain overrides live under `subdomains` in
-`env.json`.
+`just deploy` resolves the base domain at deploy time and passes it to wrangler —
+each worker is attached to its custom domain via `--domain <subdomain>.<domain>`,
+and the base domain is injected as the `DOMAIN` var so the `ns` service-discovery
+document and the api share-link base URL are built at runtime. Nothing in version
+control is rewritten; committed `wrangler.jsonc` files have no routes.
+
+The domain is read from the `RECFLARE_DOMAIN` environment variable if set,
+otherwise from `env.json`. Per-app subdomain overrides come from
+`RECFLARE_SUBDOMAINS` (a JSON object, e.g. `{"playersettings":"settings"}`) or
+the `subdomains` key in `env.json`. For CI, set `RECFLARE_DOMAIN` as a secret and
+skip `env.json` entirely:
+
+```bash
+RECFLARE_DOMAIN=rec.example.com just deploy
+```
 
 **Run the development server:**
 
diff --git a/packages/tools/bin/run-wrangler-deploy b/packages/tools/bin/run-wrangler-deploy
index 79dfb81..3c17f3c 100755
--- a/packages/tools/bin/run-wrangler-deploy
+++ b/packages/tools/bin/run-wrangler-deploy
@@ -5,21 +5,31 @@ set -eu
 NAME=$(jq -r '.name' package.json)
 VERSION=$(get-version)
 
-# Resolve the base domain (and this worker's subdomain) from the gitignored
-# env.json at the repo root, then deploy onto the custom domain via `--domain`.
-# This keeps the real domain out of versioned files — committed wrangler.jsonc
-# has no routes, and the base domain is passed as the DOMAIN var at runtime.
-ROOT=$(git rev-parse --show-toplevel)
-ENV_JSON="$ROOT/env.json"
-if [ ! -f "$ENV_JSON" ]; then
-	echo "error: $ENV_JSON not found — copy env.example.json and set your domain" >&2
-	exit 1
+# Resolve the base domain (and this worker's subdomain), then deploy onto the
+# custom domain via `--domain`. This keeps the real domain out of versioned files
+# — committed wrangler.jsonc has no routes, and the base domain is passed as the
+# DOMAIN var at runtime.
+#
+# Source order: the RECFLARE_DOMAIN env var wins (handy for CI secrets), else the
+# gitignored env.json at the repo root. Per-app subdomain overrides come from
+# RECFLARE_SUBDOMAINS (a JSON object) or env.json's "subdomains".
+if [ -n "${RECFLARE_DOMAIN:-}" ]; then
+	DOMAIN="$RECFLARE_DOMAIN"
+	SUBDOMAINS_JSON=${RECFLARE_SUBDOMAINS:-}
+	[ -n "$SUBDOMAINS_JSON" ] || SUBDOMAINS_JSON='{}'
+else
+	ENV_JSON="$(git rev-parse --show-toplevel)/env.json"
+	if [ ! -f "$ENV_JSON" ]; then
+		echo "error: set RECFLARE_DOMAIN or create $ENV_JSON (copy env.example.json)" >&2
+		exit 1
+	fi
+	DOMAIN=$(jq -r '.domain' "$ENV_JSON")
+	SUBDOMAINS_JSON=$(jq -c '.subdomains // {}' "$ENV_JSON")
 fi
 
 DIR=$(basename "$PWD")
-DOMAIN=$(jq -r '.domain' "$ENV_JSON")
 # Per-app subdomain override, falling back to the worker's directory name.
-SUBDOMAIN=$(jq -r --arg d "$DIR" '.subdomains[$d] // $d' "$ENV_JSON")
+SUBDOMAIN=$(printf '%s' "$SUBDOMAINS_JSON" | jq -r --arg d "$DIR" '.[$d] // $d')
 HOST="$SUBDOMAIN.$DOMAIN"
 
 # Deploy with wrangler using the extracted values as binding variables