diff --git a/.github/workflows/deploy-gnocchi.yml b/.github/workflows/deploy-gnocchi.yml
index f41409c8..5b174fc5 100644
--- a/.github/workflows/deploy-gnocchi.yml
+++ b/.github/workflows/deploy-gnocchi.yml
@@ -31,6 +31,10 @@ jobs:
 
       - name: Build gnocchi
         run: pnpm --filter @gnocchi.biscuits/web... run build
+        env:
+          VITE_API_ORIGIN: ${{ vars.API_ORIGIN }}
+          VITE_HOME_ORIGIN: ${{ vars.HOME_ORIGIN }}
+          VITE_PUBLIC_URL: https://gnocchi.biscuits.club
 
       - name: Deploy gnocchi to S3
         uses: jakejarvis/s3-sync-action@master
diff --git a/.github/workflows/deploy-home.yml b/.github/workflows/deploy-home.yml
index 3596f26e..2dca5fdd 100644
--- a/.github/workflows/deploy-home.yml
+++ b/.github/workflows/deploy-home.yml
@@ -31,6 +31,10 @@ jobs:
 
       - name: Build site
         run: pnpm --filter @biscuits/web... run build
+        env:
+          VITE_API_ORIGIN: ${{ vars.API_ORIGIN }}
+          VITE_HOME_ORIGIN: ${{ vars.HOME_ORIGIN }}
+          VITE_PUBLIC_URL: https://biscuits.club
 
       - name: Deploy site to S3
         uses: jakejarvis/s3-sync-action@master
diff --git a/.github/workflows/deploy-shopping.yml b/.github/workflows/deploy-shopping.yml
index ea73f2d7..37e1f957 100644
--- a/.github/workflows/deploy-shopping.yml
+++ b/.github/workflows/deploy-shopping.yml
@@ -31,6 +31,10 @@ jobs:
 
       - name: Build shopping
         run: pnpm --filter @shopping.biscuits/web... run build
+        env:
+          VITE_API_ORIGIN: ${{ vars.API_ORIGIN }}
+          VITE_HOME_ORIGIN: ${{ vars.HOME_ORIGIN }}
+          VITE_PUBLIC_URL: https://shopping.biscuits.club
 
       - name: Deploy shopping to S3
         uses: jakejarvis/s3-sync-action@master
diff --git a/.github/workflows/deploy-trip-tick.yml b/.github/workflows/deploy-trip-tick.yml
index 68e35c1d..63b76a42 100644
--- a/.github/workflows/deploy-trip-tick.yml
+++ b/.github/workflows/deploy-trip-tick.yml
@@ -31,6 +31,10 @@ jobs:
 
       - name: Build trip-tick
         run: pnpm --filter @trip-tick.biscuits/web... run build
+        env:
+          VITE_API_ORIGIN: ${{ vars.API_ORIGIN }}
+          VITE_HOME_ORIGIN: ${{ vars.HOME_ORIGIN }}
+          VITE_PUBLIC_URL: https://trip-tick.biscuits.club
 
       - name: Deploy trip-tick to S3
         uses: jakejarvis/s3-sync-action@master
diff --git a/cdk/lib/cdk-stack.ts b/cdk/lib/cdk-stack.ts
index 48dd3622..89d24c9c 100644
--- a/cdk/lib/cdk-stack.ts
+++ b/cdk/lib/cdk-stack.ts
@@ -35,7 +35,6 @@ export class CdkStack extends cdk.Stack {
         bucketProps: {
           blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
           versioned: false,
-          removalPolicy: cdk.RemovalPolicy.DESTROY,
           bucketName: `${props.appId}.biscuits.club`,
           lifecycleRules: [],
         },
@@ -44,8 +43,22 @@ export class CdkStack extends cdk.Stack {
           domainNames: [`${props.appId}.biscuits.club`],
           priceClass: PriceClass.PRICE_CLASS_100,
           comment: `${props.appId} app distribution`,
+          defaultRootObject: 'index.html',
+          errorResponses: [
+            {
+              httpStatus: 403,
+              responseHttpStatus: 200,
+              responsePagePath: '/index.html',
+            },
+            {
+              httpStatus: 404,
+              responseHttpStatus: 200,
+              responsePagePath: '/index.html',
+            },
+          ],
         },
         logS3AccessLogs: false,
+        insertHttpSecurityHeaders: false,
       },
     );