diff --git a/apps/web/wrangler.jsonc b/apps/web/wrangler.jsonc
index 9670f28..576dfcb 100644
--- a/apps/web/wrangler.jsonc
+++ b/apps/web/wrangler.jsonc
@@ -72,5 +72,45 @@
 	],
 	"triggers": {
 		"crons": ["*/5 * * * *"]
+	},
+
+	/**
+	 * Staging env for the `migration` branch — the diff-harness target.
+	 *   deploy: pnpm --filter @blento/web exec wrangler deploy --env staging
+	 *
+	 * It reuses prod's READ bindings (cache / custom-domains / contrail D1) so the harness diffs the
+	 * SAME data through the new code. No cron, and a separate analytics dataset so harness snapshots
+	 * don't pollute prod. CAVEAT: it shares prod KV/D1 — staging must not receive edit/write traffic
+	 * (writes would hit prod). For full isolation, point these at separate staging namespaces + a D1
+	 * copy. Adjust the domain/ids to your setup.
+	 */
+	"env": {
+		"staging": {
+			"name": "blento-staging",
+			"vars": {
+				"PUBLIC_HANDLE": "blento.app",
+				"PUBLIC_IS_SELFHOSTED": "",
+				"PUBLIC_DOMAIN": "https://staging.blento.app",
+				"PUBLIC_GIPHY_API_TOKEN": "ltXijv1bkNPrEgnpJ0tIdLWXjnAeE7bL"
+			},
+			"routes": [{ "pattern": "staging.blento.app", "custom_domain": true }],
+			"kv_namespaces": [
+				{ "binding": "USER_DATA_CACHE", "id": "d6ff203259de48538d332b0a5df258a7" },
+				{ "binding": "CUSTOM_DOMAINS", "id": "f449b3b5c8a349478405e2c04ed265f0" },
+				{ "binding": "OAUTH_SESSIONS", "id": "4d872b4630a042d69ecd63f87d6b2094" },
+				{ "binding": "OAUTH_STATES", "id": "c644b498d4af4c5892b3106d52c7760a" }
+			],
+			"d1_databases": [
+				{
+					"binding": "DB",
+					"database_name": "blento-v3",
+					"database_id": "83e7be08-8503-4b54-9f73-0bac105761b5",
+					"remote": false
+				}
+			],
+			"analytics_engine_datasets": [
+				{ "binding": "ANALYTICS", "dataset": "blento_staging_pageviews" }
+			]
+		}
 	}
 }