diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index e0322c5..398acbe 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -54,8 +54,11 @@ jobs:
   deploy:
     name: build + publish civfix-admin
     runs-on: ubuntu-latest
+    # One expression decides both (the YAML alias below), so a production deploy always waits for
+    # reviewer approval and can never run from a ref other than main or a v* tag.
+    environment: &deploy_env ${{ startsWith(github.ref, 'refs/tags/v') && 'production' || 'staging' }}
     env:
-      DEPLOY_ENV: ${{ startsWith(github.ref, 'refs/tags/v') && 'production' || 'staging' }}
+      DEPLOY_ENV: *deploy_env
     steps:
       - name: Refuse a deploy from any ref but main or a v* release tag
         # The Pages branch below decides production-vs-preview, so the set of refs that can reach it has