diff --git a/deploy/env.sh b/deploy/env.sh
index cda9bce..ef2c932 100755
--- a/deploy/env.sh
+++ b/deploy/env.sh
@@ -13,7 +13,8 @@ export STAGING_NAMESPACE="lomavuokraus-staging"
 export PROD_HOST="lomavuokraus.fi"
 export STAGING_HOST="staging.lomavuokraus.fi"
 export PROD_CLUSTER_ISSUER="letsencrypt-prod"
-export STAGING_CLUSTER_ISSUER="letsencrypt-staging"
+# Use production issuer for staging too so browsers trust the cert chain
+export STAGING_CLUSTER_ISSUER="letsencrypt-prod"
 
 # ---- Ingress class (k3s ships with Traefik by default) ----
 export INGRESS_CLASS="traefik"