diff --git a/.github/workflows/frontend-gh-pages.yml b/.github/workflows/frontend-gh-pages.yml
index 5e61a99f..2bd02e86 100644
--- a/.github/workflows/frontend-gh-pages.yml
+++ b/.github/workflows/frontend-gh-pages.yml
@@ -43,7 +43,6 @@ jobs:
           touch .env
           echo VITE_APP_API_URL=${{ secrets.VITE_APP_API_URL }} >> .env
           echo VITE_APP_FULL_URL=${{ secrets.VITE_APP_FULL_URL }} >> .env
-          echo VITE_OAUTH2_REDIRECT_URL=${{ secrets.VITE_OAUTH2_REDIRECT_URL }} >> .env
           echo VITE_APP_BASE=${{ secrets.VITE_APP_BASE }} >> .env
           cp .env ../.env
       - name: Install dependencies
diff --git a/app/docker-compose.yml b/app/docker-compose.yml
index 54ca2960..3f5023c1 100644
--- a/app/docker-compose.yml
+++ b/app/docker-compose.yml
@@ -18,8 +18,11 @@ services:
   
   frontend:
     image: frontend
+    env_file:
+      - .env
     build:
       dockerfile: ./frontend/Dockerfile
+      context: ./
     ports:
       - 8080:5003
     restart: unless-stopped
diff --git a/app/env.template b/app/env.template
index 1deedd5f..0a368497 100644
--- a/app/env.template
+++ b/app/env.template
@@ -40,4 +40,4 @@ OAUTH2_REDIRECT_URL=https://localhost/api/auth/cuahsi/callback
 # VITE_OAUTH2_REDIRECT_URL="${VITE_APP_FULL_URL}#/auth-redirect"
 VITE_OAUTH2_REDIRECT_URL="https://localhost/#/auth-redirect"
 
-OIDC_BASE_URL=https://auth.cuahsi.io/realms/CUAHSI/protocol/openid-connect/
\ No newline at end of file
+OIDC_BASE_URL=https://auth.cuahsi.org/realms/CUAHSI/protocol/openid-connect/
\ No newline at end of file
diff --git a/app/frontend/.dockerignore b/app/frontend/.dockerignore
index b512c09d..76add878 100644
--- a/app/frontend/.dockerignore
+++ b/app/frontend/.dockerignore
@@ -1 +1,2 @@
-node_modules
\ No newline at end of file
+node_modules
+dist
\ No newline at end of file
diff --git a/app/frontend/Dockerfile b/app/frontend/Dockerfile
index 26c3a62e..23a13003 100644
--- a/app/frontend/Dockerfile
+++ b/app/frontend/Dockerfile
@@ -1,13 +1,24 @@
+# in order to get the required .env, context must be app/
+# docker build -f app/frontend/Dockerfile app/
 FROM node:20.9.0 as build-stage
+WORKDIR /tmp
+# COPY *env* ./
+# RUN [ -f ".env" ] || cp env.template .env
+# RUN grep '^VITE' .env > /.env
+
 WORKDIR /app
-COPY .env ../.env
-COPY ./frontend .
+ADD frontend .
 RUN npm update
 RUN npm run build
 
 FROM nginx:1.24.0 as production-stage
 RUN mkdir /app
 COPY --from=build-stage /app/dist /app
-COPY --from=build-stage /.env .env
+# COPY --from=build-stage .env .env
 COPY --from=build-stage /app/nginx.conf /etc/nginx/nginx.conf
+
+# Allow substitution of env vars at runtime
+COPY frontend/docker-entrypoint.sh /
+RUN chmod +x /docker-entrypoint.sh
+ENTRYPOINT ["/docker-entrypoint.sh"]
 EXPOSE 5003
\ No newline at end of file
diff --git a/app/frontend/docker-entrypoint.sh b/app/frontend/docker-entrypoint.sh
index b4bfc75d..1f50e151 100755
--- a/app/frontend/docker-entrypoint.sh
+++ b/app/frontend/docker-entrypoint.sh
@@ -1,6 +1,14 @@
-#!/bin/bash
+#!/bin/sh
+ROOT_DIR=/app
+# Replace env vars in files served by NGINX
+for file in $ROOT_DIR/assets/*.js $ROOT_DIR/index.html;
+do
+    echo "Processing $file ...";
+    # LC_ALL=C sed -i "" 's|VITE_APP_API_URL_PLACEHOLDER|'${VITE_APP_API_URL}'|g' $file
+    sed -i 's|VITE_APP_API_URL_PLACEHOLDER|'${VITE_APP_API_URL}'|g' $file
+    sed -i 's|VITE_APP_FULL_URL_PLACEHOLDER|'${VITE_APP_FULL_URL}'|g' $file
+    sed -i 's|VITE_APP_BASE_PLACEHOLDER|'${VITE_APP_BASE}'|g' $file
+done
 
-npm i @vue/cli-service
-npm install
-npm run build
-npm run serve -- --port 5003
\ No newline at end of file
+echo "Starting Nginx"
+nginx -g 'daemon off;'
\ No newline at end of file
diff --git a/app/frontend/src/auth.js b/app/frontend/src/auth.js
index cd8f8b18..4a765cf9 100644
--- a/app/frontend/src/auth.js
+++ b/app/frontend/src/auth.js
@@ -12,7 +12,7 @@ export async function logIn(callback) {
   const authUrl = new URL(json.authorization_url)
   // TODO: use an env var for auth redirect instead of hard-coding
   // "#" hash routing was not passed from github env secret so had to hard code here.
-  authUrl.searchParams.set('redirect_uri', `${APP_URL}#/auth-redirect`)
+  authUrl.searchParams.set('redirect_uri', `${APP_URL}/#/auth-redirect`)
   window.open(
     authUrl.toString(),
     '_blank',
diff --git a/app/frontend/src/constants.js b/app/frontend/src/constants.js
index c5bb16c6..4a2e77df 100644
--- a/app/frontend/src/constants.js
+++ b/app/frontend/src/constants.js
@@ -1,8 +1,7 @@
-export const APP_NAME = import.meta.env.VITE_APP_NAME || "";
-export const APP_URL = import.meta.env.VITE_APP_FULL_URL || "";
-export const APP_BASE = import.meta.env.VITE_APP_BASE || "";
+export const APP_URL = import.meta.env.VITE_APP_FULL_URL || "VITE_APP_FULL_URL_PLACEHOLDER";
+export const APP_BASE = import.meta.env.VITE_APP_BASE || "VITE_APP_BASE_PLACEHOLDER";
 
-export const API_BASE = import.meta.env.VITE_APP_API_URL || "";
+export const API_BASE = import.meta.env.VITE_APP_API_URL || "VITE_APP_API_URL_PLACEHOLDER";
 export const ENDPOINTS = {
   openapi: `${API_BASE}/openapi.json`,
   authCuahsiAuthorize: `${API_BASE}/auth/front/authorize`,