diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 1881a65..bf3ecdc 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -150,6 +150,24 @@ jobs:
       # ----------------------------------------------------------------------
       # Deploy to staging VPS
       # ----------------------------------------------------------------------
+      - name: Sync configuration files to VPS
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1
+        with:
+          host: staging.barazo.forum
+          username: deploy
+          key: ${{ secrets.STAGING_SSH_KEY }}
+          script_stop: true
+          script: |
+            cd ${{ env.DEPLOY_PATH }}
+            echo "Syncing configuration files from repo (commit ${{ github.sha }})..."
+            BASE="https://raw.githubusercontent.com/barazo-forum/barazo-deploy/${{ github.sha }}"
+            for f in docker-compose.yml docker-compose.staging.yml Caddyfile .env.example; do
+              wget -qO "$f.tmp" "$BASE/$f"
+              mv "$f.tmp" "$f"
+              echo "  Updated $f"
+            done
+            echo "Configuration files synced"
+
       - name: Save current image digests (for rollback)
         uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1
         id: save-digests
@@ -304,17 +322,22 @@ jobs:
             cd ${{ env.DEPLOY_PATH }}
             echo "Verifying login endpoint returns valid redirect URL..."
 
-            # Test via internal Docker network (same as browser -> Caddy -> API)
-            RESPONSE=$(docker compose ${{ env.COMPOSE_FILES }} exec -T barazo-api \
-              wget -qO- "http://localhost:3000/api/auth/login?handle=test.bsky.social" 2>&1 || true)
+            # Retry up to 6 times (30s total) -- API may still be starting after deploy
+            for i in $(seq 1 6); do
+              RESPONSE=$(docker compose ${{ env.COMPOSE_FILES }} exec -T barazo-api \
+                wget -qO- "http://localhost:3000/api/auth/login?handle=test.bsky.social" 2>&1 || true)
 
-            if echo "$RESPONSE" | grep -q '"url"'; then
-              echo "Login endpoint OK: response contains redirect URL"
-            else
-              echo "::warning::Login endpoint did not return expected {url} field"
-              echo "Response: $RESPONSE"
-              echo "This may indicate an OAuth configuration issue"
-            fi
+              if echo "$RESPONSE" | grep -q '"url"'; then
+                echo "Login endpoint OK: response contains redirect URL (attempt $i/6)"
+                exit 0
+              fi
+              echo "Login check attempt $i/6 failed, retrying in 5s..."
+              sleep 5
+            done
+
+            echo "::warning::Login endpoint did not return expected {url} field after 6 attempts"
+            echo "Response: $RESPONSE"
+            echo "This may indicate an OAuth configuration issue"
 
       # ----------------------------------------------------------------------
       # Rollback on failure
diff --git a/docker-compose.yml b/docker-compose.yml
index 44e88ae..7621b62 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -99,6 +99,8 @@ services:
       COMMUNITY_DID: ${COMMUNITY_DID}
       COMMUNITY_NAME: ${COMMUNITY_NAME}
       COMMUNITY_MODE: ${COMMUNITY_MODE:-single}
+      CORS_ORIGINS: https://${COMMUNITY_DOMAIN}
+      PUBLIC_URL: https://${COMMUNITY_DOMAIN}
       OAUTH_CLIENT_ID: ${OAUTH_CLIENT_ID}
       OAUTH_REDIRECT_URI: ${OAUTH_REDIRECT_URI}
       PLUGINS_ENABLED: ${PLUGINS_ENABLED:-true}