diff --git a/.github/workflows/build_and_deploy.yml b/.github/workflows/build_and_deploy.yml
index 1b83168f..4f11abd3 100644
--- a/.github/workflows/build_and_deploy.yml
+++ b/.github/workflows/build_and_deploy.yml
@@ -23,13 +23,34 @@ jobs:
       dockerfile: Dockerfile
     secrets: inherit
 
+  get_envs:
+    uses: hotosm/gh-workflows/.github/workflows/env_vars.yml@2.0.5
+    with:
+      environment: ${{ github.ref_name }}
+    secrets: inherit
+
+  encode_envs:
+    runs-on: ubuntu-latest
+    needs: 
+      - get_envs
+    outputs:
+      base64_env: ${{ steps.to_base64.outputs.base64_env }}
+    steps:
+      - name: Export env to base64 for frontend build
+        id: to_base64
+        run: |
+          echo "base64_env=`${{ needs.get_envs.outputs.all_vars }}' | base64`" >> "$GITHUB_OUTPUT"
+
   frontend-build:
     uses: hotosm/gh-workflows/.github/workflows/image_build.yml@2.0.5
+    needs: 
+      - encode_envs
     with:
       context: ./src/frontend
       build_target: live
       image_name: ghcr.io/${{ github.repository }}/frontend
       dockerfile: Dockerfile
+      extra_build_args: B64_ARGS_TO_ENV=${{ needs.encode_envs.outputs.base64_env }}
     secrets: inherit
 
   postgres-vol-creation:
diff --git a/docker-compose.yml b/docker-compose.yml
index 81e05f6b..ac2f6960 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -32,6 +32,8 @@ services:
       context: src/frontend
       dockerfile: Dockerfile
       target: ${FRONTEND_TARGET_OVERRIDE:-development}
+      args:
+        B64_ARGS_TO_ENV: <USE FOR LIVE. Base64 encoded env variables>
     ports:
       - ${FRONTEND_WEB_APP_PORT:-3040}:3040
     depends_on:
diff --git a/src/frontend/Dockerfile b/src/frontend/Dockerfile
index 32663992..57eb23bf 100644
--- a/src/frontend/Dockerfile
+++ b/src/frontend/Dockerfile
@@ -1,29 +1,30 @@
 # ARG for the base image
 ARG NODE_BASE=18.16.0-bullseye-slim
 ARG MINIO_TAG=RELEASE.2024-08-03T04-33-23Z
+ARG B64_ARGS_TO_ENV
 
 # Base image with frontend code
 FROM node:${NODE_BASE} AS base
-
 RUN mkdir -p /app
 WORKDIR /app
-COPY ./package.json .
-RUN ["/bin/sh", "-c", "env | tee .env"]
-RUN yarn
 
 # Run development environment
 FROM base AS development
-COPY . /app
-ENTRYPOINT ["/bin/sh", "-c", "yarn start --host 0.0.0.0;"]
+ENTRYPOINT ["/bin/sh", "-c", "yarn; yarn start --host 0.0.0.0;"]
 
 # Generate frontend build files
 FROM base AS build
+ARG B64_ARGS_TO_ENV
+COPY ./package.json .
+RUN yarn
 COPY . /app
+RUN ( echo ${B64_ARGS_TO_ENV} | base64 -d ) > .env
 RUN yarn build
 
 # Copy static files to minio and generated index.html to volume
 FROM docker.io/minio/minio:${MINIO_TAG} AS live
 COPY --from=build /app/dist /tmp/dist
+RUN ( echo ${B64_ARGS_TO_ENV} | base64 -d ) > /.env
 VOLUME /tmp/frontend_html
 COPY ./docker-entrypoint.sh /docker-entrypoint.sh
 ENTRYPOINT [ "/docker-entrypoint.sh" ]
diff --git a/src/frontend/docker-entrypoint.sh b/src/frontend/docker-entrypoint.sh
index b2ba7878..c1671d06 100755
--- a/src/frontend/docker-entrypoint.sh
+++ b/src/frontend/docker-entrypoint.sh
@@ -1,6 +1,8 @@
 #!/bin/sh
 set -e
 
+source /.env
+
 if [[ -z "${S3_ACCESS_KEY}" ]]; then
   echo "Missing environment variable S3_ACCESS_KEY"
   exit 0