diff --git a/deploy/env.sh b/deploy/env.sh
index ef2c932..cda9bce 100755
--- a/deploy/env.sh
+++ b/deploy/env.sh
@@ -13,8 +13,7 @@ export STAGING_NAMESPACE="lomavuokraus-staging"
 export PROD_HOST="lomavuokraus.fi"
 export STAGING_HOST="staging.lomavuokraus.fi"
 export PROD_CLUSTER_ISSUER="letsencrypt-prod"
-# Use production issuer for staging too so browsers trust the cert chain
-export STAGING_CLUSTER_ISSUER="letsencrypt-prod"
+export STAGING_CLUSTER_ISSUER="letsencrypt-staging"
 
 # ---- Ingress class (k3s ships with Traefik by default) ----
 export INGRESS_CLASS="traefik"