diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 8abd7a8..12ae4cd 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -485,38 +485,18 @@ jobs:
             exit 1
           fi
 
-      - name: Pull production project settings
+      # Build remotely on Vercel so sensitive production environment variables
+      # remain available to the Vercel build and are never pulled into CI.
+      - name: Deploy production to Vercel
         env:
           VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
         run: >-
-          pnpm dlx vercel@${VERCEL_CLI_VERSION} pull
+          pnpm dlx vercel@${VERCEL_CLI_VERSION} deploy
           --project="${VERCEL_PROJECT_ID}"
-          --yes
-          --environment=production
-          --token="${VERCEL_TOKEN}"
-
-      - name: Build production deployment
-        env:
-          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
-        run: >-
-          pnpm dlx vercel@${VERCEL_CLI_VERSION} build
+          --scope=ontos-ai
           --prod
           --token="${VERCEL_TOKEN}"
 
-      - name: Deploy production build
-        env:
-          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          deployment_url="$(
-            pnpm dlx "vercel@${VERCEL_CLI_VERSION}" deploy \
-              --prebuilt \
-              --prod \
-              --token="${VERCEL_TOKEN}"
-          )"
-          echo "Production deployment: ${deployment_url}"
-
   attach-release-assets:
     name: Attach Release Assets
     if: ${{ github.event_name == 'release' }}