diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..7d7027d
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,8 @@
+# Local defaults: one Express process serves both frontend and API.
+APP_ENV=local
+
+# Set only when building a separate static site in staging or production.
+# API_BASE_URL=https://your-api.onrender.com
+
+# Set only on staging/production API Web Services.
+# SITE_ORIGIN=https://your-static-site.onrender.com
diff --git a/.github/workflows/cd-production.yml b/.github/workflows/cd-production.yml
index f01f408..6e55d25 100644
--- a/.github/workflows/cd-production.yml
+++ b/.github/workflows/cd-production.yml
@@ -29,6 +29,9 @@ jobs:
         run: npm ci
 
       - name: Build
+        env:
+          APP_ENV: production
+          API_BASE_URL: ${{ vars.API_URL }}
         run: npm run build
 
       - name: Deploy to production
diff --git a/.github/workflows/cd-staging.yml b/.github/workflows/cd-staging.yml
index 2529ab9..8261b40 100644
--- a/.github/workflows/cd-staging.yml
+++ b/.github/workflows/cd-staging.yml
@@ -27,6 +27,9 @@ jobs:
         run: npm ci
 
       - name: Build
+        env:
+          APP_ENV: staging
+          API_BASE_URL: ${{ vars.API_URL }}
         run: npm run build
 
       - name: Deploy to staging
@@ -48,7 +51,7 @@ jobs:
         run: sleep 60
 
       - name: Smoke test staging site
-        run: curl -sSL "${{ vars.SITE_URL }}" | grep "Hello, World!"
+        run: curl -fsSL "${{ vars.SITE_URL }}" | grep -F "${{ vars.API_URL }}/api/hello"
 
       - name: Smoke test staging API
         run: curl -sSL "${{ vars.API_URL }}/api/hello" | grep "Hello, World!"
diff --git a/README.md b/README.md
index 1589003..504d5d7 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,39 @@
 # github-actions-demo
 
-Test the github action workflow on a simple test
+Express API plus static frontend CI/CD example.
+
+## Local development
+
+```sh
+cp .env.example .env
+npm ci
+npm run build
+npm start
+```
+
+`APP_ENV=local` is default. Express serves `dist` and `/api/hello` from one process, so frontend
+uses same-origin `/api/hello`.
+
+## Render: separate API and static site
+
+Staging and production each need two Render services. Do not host frontend through API Web Service.
+
+| Service | Render type | Build command             | Start/publish setting     |
+| ------- | ----------- | ------------------------- | ------------------------- |
+| API     | Web Service | `npm ci`                  | `npm start`               |
+| Site    | Static Site | `npm ci && npm run build` | Publish directory: `dist` |
+
+Set these environment variables in Render:
+
+| Environment | Static Site variables                                                              | API Web Service variables                                                  |
+| ----------- | ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
+| Staging     | `APP_ENV=staging`, `API_BASE_URL=https://<staging-api>.onrender.com`               | `APP_ENV=staging`, `SITE_ORIGIN=https://<staging-site>.onrender.com`       |
+| Production  | `APP_ENV=production`, `API_BASE_URL=https://github-actions-demo-tk0d.onrender.com` | `APP_ENV=production`, `SITE_ORIGIN=https://<production-site>.onrender.com` |
+
+`API_BASE_URL` is required for staging/production static builds and must be absolute HTTP(S).
+`SITE_ORIGIN` is required for staging/production API services and accepts comma-separated static
+site origins. Application exits at startup/build when deployed configuration is incomplete.
+
+GitHub `staging` and `production` environments need `SITE_URL` and `API_URL` variables plus
+separate `RENDER_SITE_DEPLOY_HOOK` and `RENDER_API_DEPLOY_HOOK` secrets. The deploy workflows
+trigger both independent Render services; Render builds the site using its own `API_BASE_URL`.
diff --git a/package.json b/package.json
index a32b6a4..a29c69c 100644
--- a/package.json
+++ b/package.json
@@ -5,8 +5,8 @@
   "main": "src/server.js",
   "type": "commonjs",
   "scripts": {
-    "build": "node scripts/build.js",
-    "start": "node src/server.js",
+    "build": "node --env-file-if-exists=.env scripts/build.js",
+    "start": "node --env-file-if-exists=.env src/server.js",
     "test": "jest --testPathPattern=tests/unit",
     "test:integration": "jest --testPathPattern=tests/integration",
     "test:all": "jest",
diff --git a/scripts/build.js b/scripts/build.js
index 1a35b7e..3f509e3 100644
--- a/scripts/build.js
+++ b/scripts/build.js
@@ -1,11 +1,13 @@
 const fs = require('fs');
 const path = require('path');
+const { getApiBaseUrl } = require('../src/config');
 
 const distDir = path.join(__dirname, '..', 'dist');
 
-// Simulate a "build": in a real app this might be webpack/vite/esbuild.
-// Here we just generate a static index.html that calls the API.
-const html = `<!DOCTYPE html>
+function createHtml(apiBaseUrl) {
+  const helloUrl = `${apiBaseUrl}/api/hello`;
+
+  return `<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8" />
@@ -14,7 +16,7 @@ const html = `<!DOCTYPE html>
 <body>
   <h1 id="message">Loading...</h1>
   <script>
-    fetch('/api/hello')
+    fetch(${JSON.stringify(helloUrl)})
       .then((res) => res.json())
       .then((data) => {
         document.getElementById('message').textContent = data.message;
@@ -26,8 +28,11 @@ const html = `<!DOCTYPE html>
 </body>
 </html>
 `;
+}
+
+function build({ apiBaseUrl = getApiBaseUrl() } = {}) {
+  const html = createHtml(apiBaseUrl);
 
-function build() {
   if (fs.existsSync(distDir)) {
     fs.rmSync(distDir, { recursive: true, force: true });
   }
@@ -37,4 +42,8 @@ function build() {
   console.log('Build complete: dist/index.html created');
 }
 
-build();
+if (require.main === module) {
+  build();
+}
+
+module.exports = { createHtml, getApiBaseUrl, build };
diff --git a/src/app.js b/src/app.js
index 598edb8..9ef059a 100644
--- a/src/app.js
+++ b/src/app.js
@@ -1,16 +1,33 @@
 const express = require('express');
 const path = require('path');
+const { getAllowedOrigins, getAppEnvironment } = require('./config');
 
-function createApp() {
+function createApp({
+  environment = getAppEnvironment(),
+  allowedOrigins = getAllowedOrigins(undefined, environment),
+  serveStatic = environment === 'local',
+} = {}) {
   const app = express();
 
+  app.use((req, res, next) => {
+    const origin = req.get('origin');
+
+    if (origin && allowedOrigins.includes(origin)) {
+      res.set('Access-Control-Allow-Origin', origin);
+      res.vary('Origin');
+    }
+
+    next();
+  });
+
   // API route - the backend part of "hello world"
   app.get('/api/hello', (req, res) => {
     res.json({ message: 'Hello, World!' });
   });
 
-  // Serve the built static frontend from /dist
-  app.use(express.static(path.join(__dirname, '..', 'dist')));
+  if (serveStatic) {
+    app.use(express.static(path.join(__dirname, '..', 'dist')));
+  }
 
   return app;
 }
diff --git a/src/config.js b/src/config.js
new file mode 100644
index 0000000..36e7a4e
--- /dev/null
+++ b/src/config.js
@@ -0,0 +1,49 @@
+const APP_ENVIRONMENTS = ['local', 'staging', 'production'];
+
+function getAppEnvironment(value = process.env.APP_ENV) {
+  const environment = value || 'local';
+
+  if (!APP_ENVIRONMENTS.includes(environment)) {
+    throw new Error(`APP_ENV must be one of: ${APP_ENVIRONMENTS.join(', ')}.`);
+  }
+
+  return environment;
+}
+
+function getApiBaseUrl(value = process.env.API_BASE_URL, environment = getAppEnvironment()) {
+  if (!value) {
+    if (environment === 'local') {
+      return '';
+    }
+
+    throw new Error(`API_BASE_URL is required when APP_ENV is ${environment}.`);
+  }
+
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error('API_BASE_URL must be an absolute HTTP(S) URL.');
+  }
+
+  if (!['http:', 'https:'].includes(url.protocol)) {
+    throw new Error('API_BASE_URL must use HTTP or HTTPS.');
+  }
+
+  return url.toString().replace(/\/$/, '');
+}
+
+function getAllowedOrigins(value = process.env.SITE_ORIGIN, environment = getAppEnvironment()) {
+  const origins = (value || '')
+    .split(',')
+    .map((origin) => origin.trim())
+    .filter(Boolean);
+
+  if (environment !== 'local' && origins.length === 0) {
+    throw new Error(`SITE_ORIGIN is required when APP_ENV is ${environment}.`);
+  }
+
+  return origins;
+}
+
+module.exports = { getAllowedOrigins, getApiBaseUrl, getAppEnvironment };
diff --git a/tests/integration/api.integration.test.js b/tests/integration/api.integration.test.js
index eb2d8f7..2960c15 100644
--- a/tests/integration/api.integration.test.js
+++ b/tests/integration/api.integration.test.js
@@ -4,7 +4,11 @@ const { createApp } = require('../../src/app');
 // Integration test: exercises the real Express routing + middleware stack,
 // not just an isolated function. This is what should run in CI before merge.
 describe('GET /api/hello (integration)', () => {
-  const app = createApp();
+  const app = createApp({
+    environment: 'staging',
+    allowedOrigins: ['https://github-actions-demo-site-staging.onrender.com'],
+    serveStatic: false,
+  });
 
   it('responds with 200 and the hello world message', async () => {
     const response = await request(app).get('/api/hello');
@@ -17,4 +21,28 @@ describe('GET /api/hello (integration)', () => {
     const response = await request(app).get('/api/hello');
     expect(response.headers['content-type']).toMatch(/json/);
   });
+
+  it('allows requests from configured static site origin', async () => {
+    const response = await request(app)
+      .get('/api/hello')
+      .set('Origin', 'https://github-actions-demo-site-staging.onrender.com');
+
+    expect(response.headers['access-control-allow-origin']).toBe(
+      'https://github-actions-demo-site-staging.onrender.com'
+    );
+  });
+
+  it('does not allow requests from unconfigured origins', async () => {
+    const response = await request(app)
+      .get('/api/hello')
+      .set('Origin', 'https://untrusted.example');
+
+    expect(response.headers['access-control-allow-origin']).toBeUndefined();
+  });
+
+  it('does not serve frontend assets', async () => {
+    const response = await request(app).get('/');
+
+    expect(response.status).toBe(404);
+  });
 });
diff --git a/tests/unit/app.unit.test.js b/tests/unit/app.unit.test.js
index 4e384b4..7dc4431 100644
--- a/tests/unit/app.unit.test.js
+++ b/tests/unit/app.unit.test.js
@@ -1,4 +1,6 @@
 const { createApp } = require('../../src/app');
+const { build } = require('../../scripts/build');
+const request = require('supertest');
 
 describe('createApp (unit)', () => {
   it('returns an Express app instance', () => {
@@ -6,4 +8,17 @@ describe('createApp (unit)', () => {
     expect(typeof app).toBe('function'); // Express apps are callable functions
     expect(typeof app.get).toBe('function');
   });
+
+  it('serves frontend only in local environment', async () => {
+    build({ apiBaseUrl: '' });
+
+    const localApp = createApp({ environment: 'local' });
+    const deployedApp = createApp({
+      environment: 'staging',
+      allowedOrigins: ['https://site.example.com'],
+    });
+
+    expect((await request(localApp).get('/')).status).toBe(200);
+    expect((await request(deployedApp).get('/')).status).toBe(404);
+  });
 });
diff --git a/tests/unit/build.unit.test.js b/tests/unit/build.unit.test.js
new file mode 100644
index 0000000..23e4c95
--- /dev/null
+++ b/tests/unit/build.unit.test.js
@@ -0,0 +1,31 @@
+const { createHtml, getApiBaseUrl } = require('../../scripts/build');
+
+describe('getApiBaseUrl', () => {
+  it('uses same-origin requests when API_BASE_URL is unset', () => {
+    expect(getApiBaseUrl('', 'local')).toBe('');
+  });
+
+  it('removes a trailing slash from an API URL', () => {
+    expect(getApiBaseUrl('https://api.example.com/')).toBe('https://api.example.com');
+  });
+
+  it('rejects non-HTTP API URLs', () => {
+    expect(() => getApiBaseUrl('ftp://api.example.com')).toThrow(
+      'API_BASE_URL must use HTTP or HTTPS.'
+    );
+  });
+
+  it('requires API_BASE_URL outside local development', () => {
+    expect(() => getApiBaseUrl('', 'staging')).toThrow(
+      'API_BASE_URL is required when APP_ENV is staging.'
+    );
+  });
+});
+
+describe('createHtml', () => {
+  it('uses configured API URL in client request', () => {
+    expect(createHtml('https://api.example.com')).toContain(
+      'fetch("https://api.example.com/api/hello")'
+    );
+  });
+});