diff --git a/.woodpecker/bff.yml b/.woodpecker/bff.yml
index 34a7666b..52d6f099 100644
--- a/.woodpecker/bff.yml
+++ b/.woodpecker/bff.yml
@@ -5,7 +5,6 @@ matrix:
       BFF_MONGO_SECRET_PATH: sendico/db
       BFF_API_SECRET_PATH: sendico/api/endpoint
       BFF_VAULT_SECRET_PATH: sendico/edge/bff/vault
-      BFF_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -21,9 +20,10 @@ when:
         - api/payments/methods/go.sum
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/bff.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/.woodpecker/billing_documents.yml b/.woodpecker/billing_documents.yml
index 2add4db2..4ffdc2bf 100644
--- a/.woodpecker/billing_documents.yml
+++ b/.woodpecker/billing_documents.yml
@@ -3,7 +3,6 @@ matrix:
     - DOCUMENTS_IMAGE_PATH: billing/documents
       DOCUMENTS_DOCKERFILE: ci/prod/compose/billing_documents.dockerfile
       DOCUMENTS_MONGO_SECRET_PATH: sendico/db
-      DOCUMENTS_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -16,9 +15,10 @@ when:
         - api/billing/documents/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/billing_documents.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/.woodpecker/billing_fees.yml b/.woodpecker/billing_fees.yml
index 9288883e..dd90ae0f 100644
--- a/.woodpecker/billing_fees.yml
+++ b/.woodpecker/billing_fees.yml
@@ -3,7 +3,6 @@ matrix:
     - FEES_IMAGE_PATH: billing/fees
       FEES_DOCKERFILE: ci/prod/compose/billing_fees.dockerfile
       FEES_MONGO_SECRET_PATH: sendico/db
-      FEES_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -16,9 +15,10 @@ when:
         - api/billing/fees/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/billing_fees.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/.woodpecker/callbacks.yml b/.woodpecker/callbacks.yml
index 276af5d8..6dc4ef09 100644
--- a/.woodpecker/callbacks.yml
+++ b/.woodpecker/callbacks.yml
@@ -4,7 +4,6 @@ matrix:
       CALLBACKS_DOCKERFILE: ci/prod/compose/callbacks.dockerfile
       CALLBACKS_MONGO_SECRET_PATH: sendico/db
       CALLBACKS_VAULT_SECRET_PATH: sendico/edge/callbacks/vault
-      CALLBACKS_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -17,9 +16,10 @@ when:
         - api/edge/callbacks/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/callbacks.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/.woodpecker/db.yml b/.woodpecker/db.yml
index aa601be4..9389e737 100644
--- a/.woodpecker/db.yml
+++ b/.woodpecker/db.yml
@@ -46,9 +46,11 @@ steps:
       - apk add --no-cache bash openssh-client rsync coreutils
       - mkdir -p /root/.ssh
       - install -m 600 secrets/SSH_KEY /root/.ssh/id_rsa
-      - sed -i 's/\r$//' ./ci/prod/.env.runtime
+      - . ./ci/scripts/common/runtime_env.sh
+      - export RUNTIME_ENV_FILE="$(resolve_runtime_env_file "$(resolve_runtime_env_name)")"
+      - sed -i 's/\r$//' "${RUNTIME_ENV_FILE}"
       - set -a
-      - . ./ci/prod/.env.runtime
+      - . "${RUNTIME_ENV_FILE}"
       - . ./.env.version
       - set +a
       - bash ci/prod/scripts/bootstrap/network.sh
diff --git a/.woodpecker/discovery.yml b/.woodpecker/discovery.yml
index 43f58144..445ab2ef 100644
--- a/.woodpecker/discovery.yml
+++ b/.woodpecker/discovery.yml
@@ -2,7 +2,6 @@ matrix:
   include:
     - DISCOVERY_IMAGE_PATH: discovery/service
       DISCOVERY_DOCKERFILE: ci/prod/compose/discovery.dockerfile
-      DISCOVERY_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -15,9 +14,10 @@ when:
         - api/discovery/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/discovery.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/.woodpecker/frontend.yml b/.woodpecker/frontend.yml
index 79314c72..ea31555f 100644
--- a/.woodpecker/frontend.yml
+++ b/.woodpecker/frontend.yml
@@ -2,7 +2,6 @@ matrix:
   include:
     - FRONTEND_IMAGE_PATH: frontend/service
       FRONTEND_DOCKERFILE: ci/prod/compose/frontend.dockerfile
-      FRONTEND_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -17,9 +16,10 @@ when:
         - api/proto/**
         - frontend/**
         - interface/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/frontend.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/.woodpecker/fx_ingestor.yml b/.woodpecker/fx_ingestor.yml
index c6421233..f9be6270 100644
--- a/.woodpecker/fx_ingestor.yml
+++ b/.woodpecker/fx_ingestor.yml
@@ -6,7 +6,6 @@ matrix:
       FX_DEPLOY_TARGET: ingestor
       FX_MONGO_SECRET_PATH: sendico/db
       FX_NEEDS_NATS: "true"
-      FX_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -20,9 +19,10 @@ when:
         - api/fx/storage/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/fx_ingestor.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/.woodpecker/fx_oracle.yml b/.woodpecker/fx_oracle.yml
index a0d47719..cb16b427 100644
--- a/.woodpecker/fx_oracle.yml
+++ b/.woodpecker/fx_oracle.yml
@@ -6,7 +6,6 @@ matrix:
       FX_DEPLOY_TARGET: oracle
       FX_MONGO_SECRET_PATH: sendico/db
       FX_NEEDS_NATS: "true"
-      FX_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -20,9 +19,10 @@ when:
         - api/fx/storage/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/fx_oracle.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 
 steps:
diff --git a/.woodpecker/gateway_chain.yml b/.woodpecker/gateway_chain.yml
index 9addeb55..613716af 100644
--- a/.woodpecker/gateway_chain.yml
+++ b/.woodpecker/gateway_chain.yml
@@ -6,7 +6,6 @@ matrix:
       CHAIN_GATEWAY_RPC_SECRET_PATH: sendico/gateway/chain
       CHAIN_GATEWAY_WALLET_SECRET_PATH: sendico/gateway/chain/wallet
       CHAIN_GATEWAY_VAULT_SECRET_PATH: sendico/gateway/chain/vault
-      CHAIN_GATEWAY_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -20,9 +19,10 @@ when:
         - api/gateway/common/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/gateway_chain.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/.woodpecker/gateway_mntx.yml b/.woodpecker/gateway_mntx.yml
index fe78c8c4..35b1fd1a 100644
--- a/.woodpecker/gateway_mntx.yml
+++ b/.woodpecker/gateway_mntx.yml
@@ -2,7 +2,6 @@ matrix:
   include:
     - MNTX_GATEWAY_IMAGE_PATH: gateway/mntx
       MNTX_GATEWAY_DOCKERFILE: ci/prod/compose/mntx_gateway.dockerfile
-      MNTX_GATEWAY_ENV: prod
       MNTX_GATEWAY_MONETIX_SECRET_PATH: sendico/gateway/monetix
       MNTX_GATEWAY_NATS_SECRET_PATH: sendico/nats
       MNTX_GATEWAY_MONGO_SECRET_PATH: sendico/db
@@ -19,9 +18,10 @@ when:
         - api/gateway/common/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/gateway_mntx.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/.woodpecker/gateway_tgsettle.yml b/.woodpecker/gateway_tgsettle.yml
index e5ec9e8d..b3b97e23 100644
--- a/.woodpecker/gateway_tgsettle.yml
+++ b/.woodpecker/gateway_tgsettle.yml
@@ -3,7 +3,6 @@ matrix:
     - TGSETTLE_GATEWAY_IMAGE_PATH: gateway/tgsettle
       TGSETTLE_GATEWAY_DOCKERFILE: ci/prod/compose/tgsettle_gateway.dockerfile
       TGSETTLE_GATEWAY_MONGO_SECRET_PATH: sendico/db
-      TGSETTLE_GATEWAY_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -17,9 +16,10 @@ when:
         - api/gateway/common/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/gateway_tgsettle.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/.woodpecker/gateway_tron.yml b/.woodpecker/gateway_tron.yml
index 18352d26..2c88f15a 100644
--- a/.woodpecker/gateway_tron.yml
+++ b/.woodpecker/gateway_tron.yml
@@ -6,7 +6,6 @@ matrix:
       TRON_GATEWAY_RPC_SECRET_PATH: sendico/gateway/tron
       TRON_GATEWAY_WALLET_SECRET_PATH: sendico/gateway/tron/wallet
       TRON_GATEWAY_VAULT_SECRET_PATH: sendico/gateway/tron/vault
-      TRON_GATEWAY_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -20,9 +19,10 @@ when:
         - api/gateway/common/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/gateway_tron.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/.woodpecker/ledger.yml b/.woodpecker/ledger.yml
index 8d260857..54ba3350 100644
--- a/.woodpecker/ledger.yml
+++ b/.woodpecker/ledger.yml
@@ -3,7 +3,6 @@ matrix:
     - LEDGER_IMAGE_PATH: ledger/service
       LEDGER_DOCKERFILE: ci/prod/compose/ledger.dockerfile
       LEDGER_MONGO_SECRET_PATH: sendico/db
-      LEDGER_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -16,9 +15,10 @@ when:
         - api/ledger/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/ledger.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/.woodpecker/nats.yml b/.woodpecker/nats.yml
index c6651e60..4e7e7c3e 100644
--- a/.woodpecker/nats.yml
+++ b/.woodpecker/nats.yml
@@ -45,9 +45,11 @@ steps:
       - apk add --no-cache bash openssh-client rsync coreutils curl sed python3
       - mkdir -p /root/.ssh
       - install -m 600 secrets/SSH_KEY /root/.ssh/id_rsa
-      - sed -i 's/\r$//' ./ci/prod/.env.runtime
+      - . ./ci/scripts/common/runtime_env.sh
+      - export RUNTIME_ENV_FILE="$(resolve_runtime_env_file "$(resolve_runtime_env_name)")"
+      - sed -i 's/\r$//' "${RUNTIME_ENV_FILE}"
       - set -a
-      - . ./ci/prod/.env.runtime
+      - . "${RUNTIME_ENV_FILE}"
       - . ./.env.version
       - set +a
       - export NATS_USER="$(./ci/vlt kv_get kv sendico/nats user)"
diff --git a/.woodpecker/notification.yml b/.woodpecker/notification.yml
index af8a77f6..dd1be0cd 100644
--- a/.woodpecker/notification.yml
+++ b/.woodpecker/notification.yml
@@ -6,7 +6,6 @@ matrix:
       NOTIFICATION_MAIL_SECRET_PATH: sendico/notification/mail
       NOTIFICATION_API_SECRET_PATH: sendico/api/endpoint
       NOTIFICATION_TELEGRAM_SECRET_PATH: sendico/notification/telegram
-      NOTIFICATION_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -19,9 +18,10 @@ when:
         - api/notification/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/notification.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/.woodpecker/payments_methods.yml b/.woodpecker/payments_methods.yml
index 2dce8ff0..7cdaae1f 100644
--- a/.woodpecker/payments_methods.yml
+++ b/.woodpecker/payments_methods.yml
@@ -3,7 +3,6 @@ matrix:
     - PAYMENTS_METHODS_IMAGE_PATH: payments/methods
       PAYMENTS_METHODS_DOCKERFILE: ci/prod/compose/payments_methods.dockerfile
       PAYMENTS_METHODS_MONGO_SECRET_PATH: sendico/db
-      PAYMENTS_METHODS_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -17,9 +16,10 @@ when:
         - api/payments/storage/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/payments_methods.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/.woodpecker/payments_orchestrator.yml b/.woodpecker/payments_orchestrator.yml
index 3bfd3916..35de9dcb 100644
--- a/.woodpecker/payments_orchestrator.yml
+++ b/.woodpecker/payments_orchestrator.yml
@@ -3,7 +3,6 @@ matrix:
     - PAYMENTS_IMAGE_PATH: payments/orchestrator
       PAYMENTS_DOCKERFILE: ci/prod/compose/payments_orchestrator.dockerfile
       PAYMENTS_MONGO_SECRET_PATH: sendico/db
-      PAYMENTS_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -17,9 +16,10 @@ when:
         - api/payments/storage/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/payments_orchestrator.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/.woodpecker/payments_quotation.yml b/.woodpecker/payments_quotation.yml
index a88d3b1c..c5288ad0 100644
--- a/.woodpecker/payments_quotation.yml
+++ b/.woodpecker/payments_quotation.yml
@@ -3,7 +3,6 @@ matrix:
     - PAYMENTS_QUOTATION_IMAGE_PATH: payments/quotation
       PAYMENTS_QUOTATION_DOCKERFILE: ci/prod/compose/payments_quotation.dockerfile
       PAYMENTS_QUOTATION_MONGO_SECRET_PATH: sendico/db
-      PAYMENTS_QUOTATION_ENV: prod
 
 labels:
   platform: linux/amd64
@@ -17,9 +16,10 @@ when:
         - api/payments/storage/**
         - api/proto/**
         - api/pkg/**
-        - ci/prod/**
+        - ci/**
         - .woodpecker/payments_quotation.yml
-      ignore_message: '[rebuild]'
+  - event: tag
+    ref: refs/tags/v*
 
 steps:
   - name: version
diff --git a/README.md b/README.md
index 8d75ec61..f26233c9 100644
--- a/README.md
+++ b/README.md
@@ -110,6 +110,19 @@ make test-backend   # Run Go backend tests only
 make test-frontend  # Run Flutter tests only
 ```
 
+## Release Flow
+
+- Pushes to `main` build and deploy changed application services to the dev server.
+- Tags matching `v*` trigger a full production rebuild and deployment from that exact tagged revision.
+- Infrastructure workflows for `db` and `nats` remain separately controlled.
+
+Example production release:
+
+```bash
+git tag -a v1.4.0 <commit-sha>
+git push origin v1.4.0
+```
+
 ### Backend CI Bypass Tags
 
 Backend Woodpecker module pipelines now run both lint and tests before image build/deploy.
diff --git a/ci/devserver/.env.runtime b/ci/devserver/.env.runtime
new file mode 100644
index 00000000..f590aa0c
--- /dev/null
+++ b/ci/devserver/.env.runtime
@@ -0,0 +1,9 @@
+# Overrides for the shared prod-style runtime when deploying main to the dev server.
+
+AMPLI_ENVIRONMENT=development
+API_PROTOCOL=http
+SERVICE_HOST=178.57.67.136
+WS_PROTOCOL=ws
+
+SSH_HOST=178.57.67.136
+SSH_USER=cloud
diff --git a/ci/prod/compose/bff.yml b/ci/prod/compose/bff.yml
index dc732f6f..b6e5a332 100644
--- a/ci/prod/compose/bff.yml
+++ b/ci/prod/compose/bff.yml
@@ -24,7 +24,7 @@ services:
     container_name: sendico-bff
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/bff/service:${APP_V}
+    image: ${REGISTRY_URL}/bff/service:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       AMPLI_ENVIRONMENT: ${AMPLI_ENVIRONMENT}
diff --git a/ci/prod/compose/billing_documents.yml b/ci/prod/compose/billing_documents.yml
index 59382161..3a835aa3 100644
--- a/ci/prod/compose/billing_documents.yml
+++ b/ci/prod/compose/billing_documents.yml
@@ -16,7 +16,7 @@ services:
     container_name: sendico-billing-documents
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/billing/documents:${APP_V}
+    image: ${REGISTRY_URL}/billing/documents:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       DOCUMENTS_MONGO_HOST: ${DOCUMENTS_MONGO_HOST}
diff --git a/ci/prod/compose/billing_fees.yml b/ci/prod/compose/billing_fees.yml
index 5a996d17..87ff3642 100644
--- a/ci/prod/compose/billing_fees.yml
+++ b/ci/prod/compose/billing_fees.yml
@@ -16,7 +16,7 @@ services:
     container_name: sendico-billing-fees
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/billing/fees:${APP_V}
+    image: ${REGISTRY_URL}/billing/fees:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       FEES_MONGO_HOST: ${FEES_MONGO_HOST}
diff --git a/ci/prod/compose/callbacks.yml b/ci/prod/compose/callbacks.yml
index 3020c6b0..da596040 100644
--- a/ci/prod/compose/callbacks.yml
+++ b/ci/prod/compose/callbacks.yml
@@ -24,7 +24,7 @@ services:
     container_name: sendico-callbacks
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/edge/callbacks:${APP_V}
+    image: ${REGISTRY_URL}/edge/callbacks:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       CALLBACKS_MONGO_HOST: ${CALLBACKS_MONGO_HOST}
diff --git a/ci/prod/compose/chain_gateway.yml b/ci/prod/compose/chain_gateway.yml
index d052f537..2f69e95f 100644
--- a/ci/prod/compose/chain_gateway.yml
+++ b/ci/prod/compose/chain_gateway.yml
@@ -24,7 +24,7 @@ services:
     container_name: sendico-chain-gateway
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/gateway/chain:${APP_V}
+    image: ${REGISTRY_URL}/gateway/chain:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       CHAIN_GATEWAY_MONGO_HOST: ${CHAIN_GATEWAY_MONGO_HOST}
diff --git a/ci/prod/compose/discovery.yml b/ci/prod/compose/discovery.yml
index c9fd1840..63371056 100644
--- a/ci/prod/compose/discovery.yml
+++ b/ci/prod/compose/discovery.yml
@@ -16,7 +16,7 @@ services:
     container_name: sendico-discovery
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/discovery/service:${APP_V}
+    image: ${REGISTRY_URL}/discovery/service:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       NATS_URL: ${NATS_URL}
diff --git a/ci/prod/compose/frontend.yml b/ci/prod/compose/frontend.yml
index 938c3f01..fd53da66 100644
--- a/ci/prod/compose/frontend.yml
+++ b/ci/prod/compose/frontend.yml
@@ -19,7 +19,7 @@ services:
     <<: *common-env
     container_name: sendico-frontend
     restart: unless-stopped
-    image: ${REGISTRY_URL}/frontend/service:${APP_V}
+    image: ${REGISTRY_URL}/frontend/service:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       WS_PROTOCOL: ${WS_PROTOCOL}
diff --git a/ci/prod/compose/fx_ingestor.yml b/ci/prod/compose/fx_ingestor.yml
index da891368..53fa2c5e 100644
--- a/ci/prod/compose/fx_ingestor.yml
+++ b/ci/prod/compose/fx_ingestor.yml
@@ -16,7 +16,7 @@ services:
     container_name: sendico-fx-ingestor
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/fx/ingestor:${APP_V}
+    image: ${REGISTRY_URL}/fx/ingestor:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       FX_MONGO_HOST: ${FX_MONGO_HOST}
diff --git a/ci/prod/compose/fx_oracle.yml b/ci/prod/compose/fx_oracle.yml
index 0a9e7a47..ba4a30e0 100644
--- a/ci/prod/compose/fx_oracle.yml
+++ b/ci/prod/compose/fx_oracle.yml
@@ -16,7 +16,7 @@ services:
     container_name: sendico-fx-oracle
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/fx/oracle:${APP_V}
+    image: ${REGISTRY_URL}/fx/oracle:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       FX_MONGO_HOST: ${FX_MONGO_HOST}
diff --git a/ci/prod/compose/ledger.yml b/ci/prod/compose/ledger.yml
index 905fdcf4..e937a85f 100644
--- a/ci/prod/compose/ledger.yml
+++ b/ci/prod/compose/ledger.yml
@@ -16,7 +16,7 @@ services:
     container_name: sendico-ledger
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/ledger/service:${APP_V}
+    image: ${REGISTRY_URL}/ledger/service:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       LEDGER_MONGO_HOST: ${LEDGER_MONGO_HOST}
diff --git a/ci/prod/compose/mntx_gateway.yml b/ci/prod/compose/mntx_gateway.yml
index 5314c0f6..76f697eb 100644
--- a/ci/prod/compose/mntx_gateway.yml
+++ b/ci/prod/compose/mntx_gateway.yml
@@ -16,7 +16,7 @@ services:
     container_name: sendico-mntx-gateway
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/gateway/mntx:${APP_V}
+    image: ${REGISTRY_URL}/gateway/mntx:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       MNTX_GATEWAY_MONGO_HOST: ${MNTX_GATEWAY_MONGO_HOST}
diff --git a/ci/prod/compose/notification.yml b/ci/prod/compose/notification.yml
index 8e9116de..b4a03dfc 100644
--- a/ci/prod/compose/notification.yml
+++ b/ci/prod/compose/notification.yml
@@ -16,7 +16,7 @@ services:
     container_name: sendico-notification
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/notification/service:${APP_V}
+    image: ${REGISTRY_URL}/notification/service:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       AMPLI_ENVIRONMENT: ${AMPLI_ENVIRONMENT}
diff --git a/ci/prod/compose/payments_methods.yml b/ci/prod/compose/payments_methods.yml
index c62673c3..e8a379ee 100644
--- a/ci/prod/compose/payments_methods.yml
+++ b/ci/prod/compose/payments_methods.yml
@@ -16,7 +16,7 @@ services:
     container_name: sendico-payments-methods
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/payments/methods:${APP_V}
+    image: ${REGISTRY_URL}/payments/methods:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       PAYMENTS_MONGO_HOST: ${PAYMENTS_MONGO_HOST}
diff --git a/ci/prod/compose/payments_orchestrator.yml b/ci/prod/compose/payments_orchestrator.yml
index b42fa262..5d2e80f3 100644
--- a/ci/prod/compose/payments_orchestrator.yml
+++ b/ci/prod/compose/payments_orchestrator.yml
@@ -16,7 +16,7 @@ services:
     container_name: sendico-payments-orchestrator
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/payments/orchestrator:${APP_V}
+    image: ${REGISTRY_URL}/payments/orchestrator:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       PAYMENTS_MONGO_HOST: ${PAYMENTS_MONGO_HOST}
diff --git a/ci/prod/compose/payments_quotation.yml b/ci/prod/compose/payments_quotation.yml
index 09a47c1a..8f25111c 100644
--- a/ci/prod/compose/payments_quotation.yml
+++ b/ci/prod/compose/payments_quotation.yml
@@ -16,7 +16,7 @@ services:
     container_name: sendico-payments-quotation
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/payments/quotation:${APP_V}
+    image: ${REGISTRY_URL}/payments/quotation:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       PAYMENTS_MONGO_HOST: ${PAYMENTS_MONGO_HOST}
diff --git a/ci/prod/compose/tgsettle_gateway.yml b/ci/prod/compose/tgsettle_gateway.yml
index 1f505f7a..31d744ab 100644
--- a/ci/prod/compose/tgsettle_gateway.yml
+++ b/ci/prod/compose/tgsettle_gateway.yml
@@ -16,7 +16,7 @@ services:
     container_name: sendico-tgsettle-gateway
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/gateway/tgsettle:${APP_V}
+    image: ${REGISTRY_URL}/gateway/tgsettle:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       TGSETTLE_GATEWAY_MONGO_HOST: ${TGSETTLE_GATEWAY_MONGO_HOST}
diff --git a/ci/prod/compose/tron_gateway.yml b/ci/prod/compose/tron_gateway.yml
index c800b05d..1de76192 100644
--- a/ci/prod/compose/tron_gateway.yml
+++ b/ci/prod/compose/tron_gateway.yml
@@ -24,7 +24,7 @@ services:
     container_name: sendico-tron-gateway
     platform: linux/amd64
     restart: unless-stopped
-    image: ${REGISTRY_URL}/gateway/tron:${APP_V}
+    image: ${REGISTRY_URL}/gateway/tron:${IMAGE_TAG:-${APP_V}}
     pull_policy: always
     environment:
       TRON_GATEWAY_MONGO_HOST: ${TRON_GATEWAY_MONGO_HOST}
diff --git a/ci/prod/scripts/deploy/bff.sh b/ci/prod/scripts/deploy/bff.sh
index 2f1c91eb..4f85643d 100755
--- a/ci/prod/scripts/deploy/bff.sh
+++ b/ci/prod/scripts/deploy/bff.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-bff] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${BFF_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="bff.yml"
 SERVICE_NAMES="${BFF_SERVICE_NAME}"
 
@@ -68,7 +69,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -112,6 +113,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else
diff --git a/ci/prod/scripts/deploy/billing_documents.sh b/ci/prod/scripts/deploy/billing_documents.sh
index f9174e69..37f593b7 100755
--- a/ci/prod/scripts/deploy/billing_documents.sh
+++ b/ci/prod/scripts/deploy/billing_documents.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-billing-documents] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${DOCUMENTS_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="billing_documents.yml"
 SERVICE_NAMES="${DOCUMENTS_SERVICE_NAME}"
 
@@ -72,7 +73,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -118,6 +119,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else
diff --git a/ci/prod/scripts/deploy/billing_fees.sh b/ci/prod/scripts/deploy/billing_fees.sh
index 5f8fcc0e..2d7112cc 100644
--- a/ci/prod/scripts/deploy/billing_fees.sh
+++ b/ci/prod/scripts/deploy/billing_fees.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-billing-fees] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${FEES_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="billing_fees.yml"
 SERVICE_NAMES="${FEES_SERVICE_NAME}"
 
@@ -62,7 +63,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -103,6 +104,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else
diff --git a/ci/prod/scripts/deploy/callbacks.sh b/ci/prod/scripts/deploy/callbacks.sh
index c270769d..049456f1 100755
--- a/ci/prod/scripts/deploy/callbacks.sh
+++ b/ci/prod/scripts/deploy/callbacks.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-callbacks] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${CALLBACKS_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="callbacks.yml"
 SERVICE_NAMES="${CALLBACKS_SERVICE_NAME}"
 
@@ -66,7 +67,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -109,6 +110,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else
diff --git a/ci/prod/scripts/deploy/chain_gateway.sh b/ci/prod/scripts/deploy/chain_gateway.sh
index 126719fb..25f9476c 100755
--- a/ci/prod/scripts/deploy/chain_gateway.sh
+++ b/ci/prod/scripts/deploy/chain_gateway.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-chain-gateway] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${CHAIN_GATEWAY_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="chain_gateway.yml"
 SERVICE_NAMES="${CHAIN_GATEWAY_SERVICE_NAME}"
 
@@ -72,7 +73,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/compose/secrets ${REMOTE_DIR}/env"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -118,6 +119,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else
diff --git a/ci/prod/scripts/deploy/db.sh b/ci/prod/scripts/deploy/db.sh
index 471c2a45..2519ab7a 100755
--- a/ci/prod/scripts/deploy/db.sh
+++ b/ci/prod/scripts/deploy/db.sh
@@ -15,6 +15,7 @@ trap 'echo "[deploy-db] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${DB_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 
 # SSH options: quiet by default; add -vv in debug mode
 SSH_OPTS=(
@@ -37,7 +38,7 @@ ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 # Sync compose bundle and runtime env to the remote host
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/    "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 
 # Deploy on remote: pass AppRole creds ONLY to compose invocations.
 # The vault-agent container writes them into tmpfs and unsets them internally.
diff --git a/ci/prod/scripts/deploy/discovery.sh b/ci/prod/scripts/deploy/discovery.sh
index f9c2b4bd..5d9662a0 100644
--- a/ci/prod/scripts/deploy/discovery.sh
+++ b/ci/prod/scripts/deploy/discovery.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-discovery] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${DISCOVERY_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="discovery.yml"
 SERVICE_NAMES="${DISCOVERY_SERVICE_NAME}"
 
@@ -58,7 +59,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -97,6 +98,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else
diff --git a/ci/prod/scripts/deploy/frontend.sh b/ci/prod/scripts/deploy/frontend.sh
index 32433dfa..934c17d6 100755
--- a/ci/prod/scripts/deploy/frontend.sh
+++ b/ci/prod/scripts/deploy/frontend.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-frontend] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${FRONTEND_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="frontend.yml"
 SERVICE_NAMES="${FRONTEND_SERVICE_NAME}"
 
@@ -37,7 +38,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -73,6 +74,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 COMPOSE_PROJECT_NAME="$COMPOSE_PROJECT"
 export COMPOSE_PROJECT_NAME
 read -r -a SERVICES <<<"${SERVICES_LINE}"
diff --git a/ci/prod/scripts/deploy/fx.sh b/ci/prod/scripts/deploy/fx.sh
index 7826c62e..d2d1ea5d 100644
--- a/ci/prod/scripts/deploy/fx.sh
+++ b/ci/prod/scripts/deploy/fx.sh
@@ -15,6 +15,7 @@ SERVICE="$1"
 : "${SSH_HOST:?missing SSH_HOST}"
 
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 
 case "$SERVICE" in
   ingestor)
@@ -88,7 +89,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -129,6 +130,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else
diff --git a/ci/prod/scripts/deploy/ledger.sh b/ci/prod/scripts/deploy/ledger.sh
index f4b6bd85..a126a24f 100755
--- a/ci/prod/scripts/deploy/ledger.sh
+++ b/ci/prod/scripts/deploy/ledger.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-ledger] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${LEDGER_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="ledger.yml"
 SERVICE_NAMES="${LEDGER_SERVICE_NAME}"
 
@@ -62,7 +63,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -103,6 +104,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else
diff --git a/ci/prod/scripts/deploy/mntx_gateway.sh b/ci/prod/scripts/deploy/mntx_gateway.sh
index 397c3c64..986be6b6 100644
--- a/ci/prod/scripts/deploy/mntx_gateway.sh
+++ b/ci/prod/scripts/deploy/mntx_gateway.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-mntx-gateway] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${MNTX_GATEWAY_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="mntx_gateway.yml"
 SERVICE_NAMES="${MNTX_GATEWAY_SERVICE_NAME}"
 
@@ -66,7 +67,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/compose ${REMOTE_DIR}/env"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -109,6 +110,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else
diff --git a/ci/prod/scripts/deploy/nats.sh b/ci/prod/scripts/deploy/nats.sh
index 29bf6525..b1185c38 100755
--- a/ci/prod/scripts/deploy/nats.sh
+++ b/ci/prod/scripts/deploy/nats.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-nats] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${NATS_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 
 SSH_OPTS=(
   -i /root/.ssh/id_rsa
@@ -31,7 +32,7 @@ ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/nats.yml "$REMOTE_TARGET:${REMOTE_DIR}/compose/nats.yml"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/nats.dockerfile "$REMOTE_TARGET:${REMOTE_DIR}/compose/nats.dockerfile"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" \
   REMOTE_DIR="$REMOTE_DIR" \
diff --git a/ci/prod/scripts/deploy/notification.sh b/ci/prod/scripts/deploy/notification.sh
index 5f9a75a4..58c71bb4 100755
--- a/ci/prod/scripts/deploy/notification.sh
+++ b/ci/prod/scripts/deploy/notification.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-notification] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${NOTIFICATION_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="notification.yml"
 SERVICE_NAMES="${NOTIFICATION_SERVICE_NAME}"
 
@@ -73,7 +74,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -120,6 +121,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else
diff --git a/ci/prod/scripts/deploy/payments_methods.sh b/ci/prod/scripts/deploy/payments_methods.sh
index 01871ca3..d629889f 100755
--- a/ci/prod/scripts/deploy/payments_methods.sh
+++ b/ci/prod/scripts/deploy/payments_methods.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-payments-methods] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${PAYMENTS_METHODS_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="payments_methods.yml"
 SERVICE_NAMES="${PAYMENTS_METHODS_SERVICE_NAME}"
 
@@ -62,7 +63,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -103,6 +104,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else
diff --git a/ci/prod/scripts/deploy/payments_orchestrator.sh b/ci/prod/scripts/deploy/payments_orchestrator.sh
index 584ceb5a..8f9c37db 100755
--- a/ci/prod/scripts/deploy/payments_orchestrator.sh
+++ b/ci/prod/scripts/deploy/payments_orchestrator.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-payments-orchestrator] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${PAYMENTS_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="payments_orchestrator.yml"
 SERVICE_NAMES="${PAYMENTS_SERVICE_NAME}"
 
@@ -62,7 +63,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -103,6 +104,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else
diff --git a/ci/prod/scripts/deploy/payments_quotation.sh b/ci/prod/scripts/deploy/payments_quotation.sh
index 0637f8a1..3c25444e 100755
--- a/ci/prod/scripts/deploy/payments_quotation.sh
+++ b/ci/prod/scripts/deploy/payments_quotation.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-payments-quotation] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${PAYMENTS_QUOTATION_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="payments_quotation.yml"
 SERVICE_NAMES="${PAYMENTS_QUOTATION_SERVICE_NAME}"
 
@@ -62,7 +63,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -103,6 +104,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else
diff --git a/ci/prod/scripts/deploy/tgsettle_gateway.sh b/ci/prod/scripts/deploy/tgsettle_gateway.sh
index 2b4e9bac..3c58427f 100755
--- a/ci/prod/scripts/deploy/tgsettle_gateway.sh
+++ b/ci/prod/scripts/deploy/tgsettle_gateway.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-tgsettle-gateway] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${TGSETTLE_GATEWAY_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="tgsettle_gateway.yml"
 SERVICE_NAMES="${TGSETTLE_GATEWAY_SERVICE_NAME}"
 
@@ -62,7 +63,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -103,6 +104,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else
diff --git a/ci/prod/scripts/deploy/tron_gateway.sh b/ci/prod/scripts/deploy/tron_gateway.sh
index 65de2f3b..18d75464 100755
--- a/ci/prod/scripts/deploy/tron_gateway.sh
+++ b/ci/prod/scripts/deploy/tron_gateway.sh
@@ -12,6 +12,7 @@ trap 'echo "[deploy-tron-gateway] error at line $LINENO" >&2' ERR
 
 REMOTE_DIR="${REMOTE_BASE%/}/${TRON_GATEWAY_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+RUNTIME_ENV_FILE="${RUNTIME_ENV_FILE:-ci/prod/.env.runtime}"
 COMPOSE_FILE="tron_gateway.yml"
 SERVICE_NAMES="${TRON_GATEWAY_SERVICE_NAME}"
 
@@ -74,7 +75,7 @@ RSYNC_FLAGS=(-az --delete)
 ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/compose/secrets ${REMOTE_DIR}/env"
 
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" "${RUNTIME_ENV_FILE}" "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
 
 SERVICES_LINE="${SERVICE_NAMES}"
@@ -122,6 +123,9 @@ load_kv_file() {
 load_kv_file ../env/.env.version
 set +a
 
+IMAGE_TAG="${IMAGE_TAG:-${APP_V}-${GIT_REV}}"
+export IMAGE_TAG
+
 if base64 -d >/dev/null 2>&1 <<<'AA=='; then
   BASE64_DECODE_FLAG='-d'
 else
diff --git a/ci/scripts/bff/build-image.sh b/ci/scripts/bff/build-image.sh
index 7b9e0746..28c79b6a 100755
--- a/ci/scripts/bff/build-image.sh
+++ b/ci/scripts/bff/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-BFF_ENV_NAME="${BFF_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${BFF_ENV_NAME}/.env.runtime"
+BFF_ENV_NAME="${BFF_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${BFF_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[bff-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${BFF_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${BFF_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${BFF_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/bff/deploy.sh b/ci/scripts/bff/deploy.sh
index f646e608..ed5da034 100755
--- a/ci/scripts/bff/deploy.sh
+++ b/ci/scripts/bff/deploy.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-BFF_ENV_NAME="${BFF_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${BFF_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[bff-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+BFF_ENV_NAME="${BFF_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${BFF_ENV_NAME}"
 
 BFF_MONGO_SECRET_PATH="${BFF_MONGO_SECRET_PATH:?missing BFF_MONGO_SECRET_PATH}"
 BFF_API_SECRET_PATH="${BFF_API_SECRET_PATH:?missing BFF_API_SECRET_PATH}"
diff --git a/ci/scripts/billing_documents/build-image.sh b/ci/scripts/billing_documents/build-image.sh
index daec5262..ba967131 100755
--- a/ci/scripts/billing_documents/build-image.sh
+++ b/ci/scripts/billing_documents/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-DOCUMENTS_ENV_NAME="${DOCUMENTS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${DOCUMENTS_ENV_NAME}/.env.runtime"
+DOCUMENTS_ENV_NAME="${DOCUMENTS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${DOCUMENTS_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[billing-documents-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${DOCUMENTS_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${DOCUMENTS_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${DOCUMENTS_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/billing_documents/deploy.sh b/ci/scripts/billing_documents/deploy.sh
index ec9857e3..0b68b31b 100755
--- a/ci/scripts/billing_documents/deploy.sh
+++ b/ci/scripts/billing_documents/deploy.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-DOCUMENTS_ENV_NAME="${DOCUMENTS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${DOCUMENTS_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[billing-documents-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+DOCUMENTS_ENV_NAME="${DOCUMENTS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${DOCUMENTS_ENV_NAME}"
 
 DOCUMENTS_MONGO_SECRET_PATH="${DOCUMENTS_MONGO_SECRET_PATH:?missing DOCUMENTS_MONGO_SECRET_PATH}"
 
diff --git a/ci/scripts/billing_fees/build-image.sh b/ci/scripts/billing_fees/build-image.sh
index f3a6b44a..4ab659ac 100644
--- a/ci/scripts/billing_fees/build-image.sh
+++ b/ci/scripts/billing_fees/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-FEES_ENV_NAME="${FEES_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${FEES_ENV_NAME}/.env.runtime"
+FEES_ENV_NAME="${FEES_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${FEES_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[billing-fees-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${FEES_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${FEES_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${FEES_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/billing_fees/deploy.sh b/ci/scripts/billing_fees/deploy.sh
index afef72d3..d2e16ffb 100644
--- a/ci/scripts/billing_fees/deploy.sh
+++ b/ci/scripts/billing_fees/deploy.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-FEES_ENV_NAME="${FEES_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${FEES_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[billing-fees-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+FEES_ENV_NAME="${FEES_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${FEES_ENV_NAME}"
 
 FEES_MONGO_SECRET_PATH="${FEES_MONGO_SECRET_PATH:?missing FEES_MONGO_SECRET_PATH}"
 
diff --git a/ci/scripts/callbacks/build-image.sh b/ci/scripts/callbacks/build-image.sh
index 5728bdf3..805d1a61 100755
--- a/ci/scripts/callbacks/build-image.sh
+++ b/ci/scripts/callbacks/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-CALLBACKS_ENV_NAME="${CALLBACKS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${CALLBACKS_ENV_NAME}/.env.runtime"
+CALLBACKS_ENV_NAME="${CALLBACKS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${CALLBACKS_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[callbacks-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${CALLBACKS_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${CALLBACKS_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${CALLBACKS_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/callbacks/deploy.sh b/ci/scripts/callbacks/deploy.sh
index cee375ba..5bd5ce6c 100755
--- a/ci/scripts/callbacks/deploy.sh
+++ b/ci/scripts/callbacks/deploy.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-CALLBACKS_ENV_NAME="${CALLBACKS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${CALLBACKS_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[callbacks-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+CALLBACKS_ENV_NAME="${CALLBACKS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${CALLBACKS_ENV_NAME}"
 
 CALLBACKS_MONGO_SECRET_PATH="${CALLBACKS_MONGO_SECRET_PATH:?missing CALLBACKS_MONGO_SECRET_PATH}"
 CALLBACKS_VAULT_SECRET_PATH="${CALLBACKS_VAULT_SECRET_PATH:?missing CALLBACKS_VAULT_SECRET_PATH}"
diff --git a/ci/scripts/chain_gateway/build-image.sh b/ci/scripts/chain_gateway/build-image.sh
index d2419989..f352aac7 100755
--- a/ci/scripts/chain_gateway/build-image.sh
+++ b/ci/scripts/chain_gateway/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-CHAIN_GATEWAY_ENV_NAME="${CHAIN_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${CHAIN_GATEWAY_ENV_NAME}/.env.runtime"
+CHAIN_GATEWAY_ENV_NAME="${CHAIN_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${CHAIN_GATEWAY_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[chain-gateway-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -93,7 +85,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${CHAIN_GATEWAY_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${CHAIN_GATEWAY_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${CHAIN_GATEWAY_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/chain_gateway/deploy.sh b/ci/scripts/chain_gateway/deploy.sh
index fa89c68a..a064aa43 100755
--- a/ci/scripts/chain_gateway/deploy.sh
+++ b/ci/scripts/chain_gateway/deploy.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-CHAIN_GATEWAY_ENV_NAME="${CHAIN_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${CHAIN_GATEWAY_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[chain-gateway-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+CHAIN_GATEWAY_ENV_NAME="${CHAIN_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${CHAIN_GATEWAY_ENV_NAME}"
 
 CHAIN_GATEWAY_MONGO_SECRET_PATH="${CHAIN_GATEWAY_MONGO_SECRET_PATH:?missing CHAIN_GATEWAY_MONGO_SECRET_PATH}"
 CHAIN_GATEWAY_RPC_SECRET_PATH="${CHAIN_GATEWAY_RPC_SECRET_PATH:?missing CHAIN_GATEWAY_RPC_SECRET_PATH}"
diff --git a/ci/scripts/common/runtime_env.sh b/ci/scripts/common/runtime_env.sh
new file mode 100644
index 00000000..ff9c5efd
--- /dev/null
+++ b/ci/scripts/common/runtime_env.sh
@@ -0,0 +1,103 @@
+#!/bin/sh
+
+runtime_ci_event() {
+  if [ -n "${CI_PIPELINE_EVENT:-}" ]; then
+    printf '%s\n' "${CI_PIPELINE_EVENT}"
+    return
+  fi
+
+  if [ -n "${WOODPECKER_BUILD_EVENT:-}" ]; then
+    printf '%s\n' "${WOODPECKER_BUILD_EVENT}"
+    return
+  fi
+
+  printf 'local\n'
+}
+
+resolve_runtime_env_name() {
+  if [ -n "${CI_TARGET_ENV:-}" ]; then
+    printf '%s\n' "${CI_TARGET_ENV}"
+    return
+  fi
+
+  case "$(runtime_ci_event)" in
+    push)
+      printf 'devserver\n'
+      ;;
+    tag)
+      printf 'prod\n'
+      ;;
+    *)
+      printf 'prod\n'
+      ;;
+  esac
+}
+
+normalize_env_file() {
+  file="$1"
+  tmp="${file}.tmp.$$"
+  tr -d '\r' <"$file" >"$tmp"
+  mv "$tmp" "$file"
+}
+
+load_env_file() {
+  file="$1"
+  while IFS= read -r line || [ -n "$line" ]; do
+    case "$line" in
+      ''|\#*) continue ;;
+    esac
+    key="${line%%=*}"
+    value="${line#*=}"
+    key="$(printf '%s' "$key" | tr -d '[:space:]')"
+    value="${value#"${value%%[![:space:]]*}"}"
+    value="${value%"${value##*[![:space:]]}"}"
+    export "$key=$value"
+  done <"$file"
+}
+
+resolve_runtime_env_file() {
+  env_name="$1"
+  override_file="./ci/${env_name}/.env.runtime"
+
+  if [ ! -f "${override_file}" ]; then
+    echo "[runtime-env] runtime env file not found: ${override_file}" >&2
+    return 1
+  fi
+
+  if [ "${env_name}" = "prod" ]; then
+    printf '%s\n' "${override_file}"
+    return
+  fi
+
+  base_file="./ci/prod/.env.runtime"
+  if [ ! -f "${base_file}" ]; then
+    printf '%s\n' "${override_file}"
+    return
+  fi
+
+  merged_file="$(mktemp "${TMPDIR:-/tmp}/sendico-runtime.${env_name}.XXXXXX")"
+  cat "${base_file}" >"${merged_file}"
+  printf '\n' >>"${merged_file}"
+  cat "${override_file}" >>"${merged_file}"
+  printf '%s\n' "${merged_file}"
+}
+
+load_runtime_env_bundle() {
+  env_name="$1"
+  runtime_file="$(resolve_runtime_env_file "${env_name}")"
+
+  normalize_env_file "${runtime_file}"
+  normalize_env_file ./.env.version
+
+  load_env_file "${runtime_file}"
+  load_env_file ./.env.version
+
+  export CI_RUNTIME_ENV_NAME="${env_name}"
+  export RUNTIME_ENV_FILE="${runtime_file}"
+}
+
+compute_image_tag() {
+  : "${APP_V:?missing APP_V}"
+  : "${GIT_REV:?missing GIT_REV}"
+  printf '%s-%s\n' "${APP_V}" "${GIT_REV}"
+}
diff --git a/ci/scripts/discovery/build-image.sh b/ci/scripts/discovery/build-image.sh
index 20b9d621..5995231f 100644
--- a/ci/scripts/discovery/build-image.sh
+++ b/ci/scripts/discovery/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-DISCOVERY_ENV_NAME="${DISCOVERY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${DISCOVERY_ENV_NAME}/.env.runtime"
+DISCOVERY_ENV_NAME="${DISCOVERY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${DISCOVERY_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[discovery-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${DISCOVERY_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${DISCOVERY_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${DISCOVERY_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/discovery/deploy.sh b/ci/scripts/discovery/deploy.sh
index 3461415b..d227ff49 100644
--- a/ci/scripts/discovery/deploy.sh
+++ b/ci/scripts/discovery/deploy.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-DISCOVERY_ENV_NAME="${DISCOVERY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${DISCOVERY_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[discovery-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+DISCOVERY_ENV_NAME="${DISCOVERY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${DISCOVERY_ENV_NAME}"
 
 load_nats_env
 
diff --git a/ci/scripts/frontend/build-image.sh b/ci/scripts/frontend/build-image.sh
index 2952236d..9e0cf759 100755
--- a/ci/scripts/frontend/build-image.sh
+++ b/ci/scripts/frontend/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-FRONTEND_ENV_NAME="${FRONTEND_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${FRONTEND_ENV_NAME}/.env.runtime"
+FRONTEND_ENV_NAME="${FRONTEND_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${FRONTEND_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[frontend-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${FRONTEND_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${FRONTEND_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${FRONTEND_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/frontend/deploy.sh b/ci/scripts/frontend/deploy.sh
index 97d02a03..e6d43232 100755
--- a/ci/scripts/frontend/deploy.sh
+++ b/ci/scripts/frontend/deploy.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,8 @@ load_env_file() {
   done <"$file"
 }
 
-FRONTEND_ENV_NAME="${FRONTEND_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${FRONTEND_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[frontend-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+FRONTEND_ENV_NAME="${FRONTEND_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${FRONTEND_ENV_NAME}"
 
 if [ ! -s .env.version ]; then
   echo ".env.version is missing; run version step first" >&2
diff --git a/ci/scripts/fx/build-image.sh b/ci/scripts/fx/build-image.sh
index bce53aa0..b9cd092b 100755
--- a/ci/scripts/fx/build-image.sh
+++ b/ci/scripts/fx/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-FX_ENV_NAME="${FX_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${FX_ENV_NAME}/.env.runtime"
+FX_ENV_NAME="${FX_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${FX_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[fx-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${FX_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${FX_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${FX_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/fx/deploy.sh b/ci/scripts/fx/deploy.sh
index f9d38250..2ead545b 100755
--- a/ci/scripts/fx/deploy.sh
+++ b/ci/scripts/fx/deploy.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-FX_ENV_NAME="${FX_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${FX_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[fx-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+FX_ENV_NAME="${FX_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${FX_ENV_NAME}"
 
 FX_MONGO_SECRET_PATH="${FX_MONGO_SECRET_PATH:?missing FX_MONGO_SECRET_PATH}"
 FX_DEPLOY_TARGET="${FX_DEPLOY_TARGET:?missing FX_DEPLOY_TARGET}"
diff --git a/ci/scripts/ledger/build-image.sh b/ci/scripts/ledger/build-image.sh
index 2a3f9c91..511234f3 100755
--- a/ci/scripts/ledger/build-image.sh
+++ b/ci/scripts/ledger/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-LEDGER_ENV_NAME="${LEDGER_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${LEDGER_ENV_NAME}/.env.runtime"
+LEDGER_ENV_NAME="${LEDGER_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${LEDGER_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[ledger-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${LEDGER_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${LEDGER_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${LEDGER_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/ledger/deploy.sh b/ci/scripts/ledger/deploy.sh
index 31e2c81f..00f8a419 100755
--- a/ci/scripts/ledger/deploy.sh
+++ b/ci/scripts/ledger/deploy.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-LEDGER_ENV_NAME="${LEDGER_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${LEDGER_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[ledger-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+LEDGER_ENV_NAME="${LEDGER_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${LEDGER_ENV_NAME}"
 
 LEDGER_MONGO_SECRET_PATH="${LEDGER_MONGO_SECRET_PATH:?missing LEDGER_MONGO_SECRET_PATH}"
 
diff --git a/ci/scripts/mntx/build-image.sh b/ci/scripts/mntx/build-image.sh
index 81dd471a..7921781b 100644
--- a/ci/scripts/mntx/build-image.sh
+++ b/ci/scripts/mntx/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-MNTX_GATEWAY_ENV_NAME="${MNTX_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${MNTX_GATEWAY_ENV_NAME}/.env.runtime"
+MNTX_GATEWAY_ENV_NAME="${MNTX_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${MNTX_GATEWAY_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[mntx-gateway-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -93,7 +85,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${MNTX_GATEWAY_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${MNTX_GATEWAY_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${MNTX_GATEWAY_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/mntx/deploy.sh b/ci/scripts/mntx/deploy.sh
index 86f2f05c..09f510da 100644
--- a/ci/scripts/mntx/deploy.sh
+++ b/ci/scripts/mntx/deploy.sh
@@ -32,24 +32,14 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-MNTX_GATEWAY_ENV_NAME="${MNTX_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${MNTX_GATEWAY_ENV_NAME}/.env.runtime"
+MNTX_GATEWAY_ENV_NAME="${MNTX_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${MNTX_GATEWAY_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[mntx-gateway-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
 if [ ! -f ./.env.version ]; then
   echo "[mntx-gateway-deploy] .env.version is missing; run version step first" >&2
   exit 1
 fi
 
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
-
 MNTX_GATEWAY_MONGO_SECRET_PATH="${MNTX_GATEWAY_MONGO_SECRET_PATH:?missing MNTX_GATEWAY_MONGO_SECRET_PATH}"
 MNTX_GATEWAY_MONETIX_SECRET_PATH="${MNTX_GATEWAY_MONETIX_SECRET_PATH:-sendico/gateway/monetix}"
 MNTX_GATEWAY_NATS_SECRET_PATH="${MNTX_GATEWAY_NATS_SECRET_PATH:-sendico/nats}"
diff --git a/ci/scripts/notification/build-image.sh b/ci/scripts/notification/build-image.sh
index 31a3ccf3..b64b03a4 100755
--- a/ci/scripts/notification/build-image.sh
+++ b/ci/scripts/notification/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-NOTIFICATION_ENV_NAME="${NOTIFICATION_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${NOTIFICATION_ENV_NAME}/.env.runtime"
+NOTIFICATION_ENV_NAME="${NOTIFICATION_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${NOTIFICATION_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[notification-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${NOTIFICATION_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${NOTIFICATION_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${NOTIFICATION_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/notification/deploy.sh b/ci/scripts/notification/deploy.sh
index e6603e59..f83fe9fc 100755
--- a/ci/scripts/notification/deploy.sh
+++ b/ci/scripts/notification/deploy.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-NOTIFICATION_ENV_NAME="${NOTIFICATION_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${NOTIFICATION_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[notification-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+NOTIFICATION_ENV_NAME="${NOTIFICATION_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${NOTIFICATION_ENV_NAME}"
 
 NOTIFICATION_MONGO_SECRET_PATH="${NOTIFICATION_MONGO_SECRET_PATH:?missing NOTIFICATION_MONGO_SECRET_PATH}"
 NOTIFICATION_MAIL_SECRET_PATH="${NOTIFICATION_MAIL_SECRET_PATH:?missing NOTIFICATION_MAIL_SECRET_PATH}"
diff --git a/ci/scripts/payments_methods/build-image.sh b/ci/scripts/payments_methods/build-image.sh
index a2dce25a..24dedc17 100755
--- a/ci/scripts/payments_methods/build-image.sh
+++ b/ci/scripts/payments_methods/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-PAYMENTS_METHODS_ENV_NAME="${PAYMENTS_METHODS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${PAYMENTS_METHODS_ENV_NAME}/.env.runtime"
+PAYMENTS_METHODS_ENV_NAME="${PAYMENTS_METHODS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${PAYMENTS_METHODS_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[payments-methods-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${PAYMENTS_METHODS_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${PAYMENTS_METHODS_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${PAYMENTS_METHODS_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/payments_methods/deploy.sh b/ci/scripts/payments_methods/deploy.sh
index e81bc4b3..280c78be 100755
--- a/ci/scripts/payments_methods/deploy.sh
+++ b/ci/scripts/payments_methods/deploy.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-PAYMENTS_METHODS_ENV_NAME="${PAYMENTS_METHODS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${PAYMENTS_METHODS_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[payments-methods-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+PAYMENTS_METHODS_ENV_NAME="${PAYMENTS_METHODS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${PAYMENTS_METHODS_ENV_NAME}"
 
 PAYMENTS_METHODS_MONGO_SECRET_PATH="${PAYMENTS_METHODS_MONGO_SECRET_PATH:?missing PAYMENTS_METHODS_MONGO_SECRET_PATH}"
 
diff --git a/ci/scripts/payments_orchestrator/build-image.sh b/ci/scripts/payments_orchestrator/build-image.sh
index b86e318d..3a2edd4d 100755
--- a/ci/scripts/payments_orchestrator/build-image.sh
+++ b/ci/scripts/payments_orchestrator/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-PAYMENTS_ENV_NAME="${PAYMENTS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${PAYMENTS_ENV_NAME}/.env.runtime"
+PAYMENTS_ENV_NAME="${PAYMENTS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${PAYMENTS_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[payments-orchestrator-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${PAYMENTS_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${PAYMENTS_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${PAYMENTS_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/payments_orchestrator/deploy.sh b/ci/scripts/payments_orchestrator/deploy.sh
index 99a5e1ec..e528667d 100755
--- a/ci/scripts/payments_orchestrator/deploy.sh
+++ b/ci/scripts/payments_orchestrator/deploy.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-PAYMENTS_ENV_NAME="${PAYMENTS_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${PAYMENTS_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[payments-orchestrator-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+PAYMENTS_ENV_NAME="${PAYMENTS_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${PAYMENTS_ENV_NAME}"
 
 PAYMENTS_MONGO_SECRET_PATH="${PAYMENTS_MONGO_SECRET_PATH:?missing PAYMENTS_MONGO_SECRET_PATH}"
 
diff --git a/ci/scripts/payments_quotation/build-image.sh b/ci/scripts/payments_quotation/build-image.sh
index fd004439..8ff7229b 100755
--- a/ci/scripts/payments_quotation/build-image.sh
+++ b/ci/scripts/payments_quotation/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-PAYMENTS_QUOTATION_ENV_NAME="${PAYMENTS_QUOTATION_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${PAYMENTS_QUOTATION_ENV_NAME}/.env.runtime"
+PAYMENTS_QUOTATION_ENV_NAME="${PAYMENTS_QUOTATION_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${PAYMENTS_QUOTATION_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[payments-quotation-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -76,7 +68,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${PAYMENTS_QUOTATION_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${PAYMENTS_QUOTATION_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${PAYMENTS_QUOTATION_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/payments_quotation/deploy.sh b/ci/scripts/payments_quotation/deploy.sh
index 921a5931..0a41b9dd 100755
--- a/ci/scripts/payments_quotation/deploy.sh
+++ b/ci/scripts/payments_quotation/deploy.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-PAYMENTS_QUOTATION_ENV_NAME="${PAYMENTS_QUOTATION_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${PAYMENTS_QUOTATION_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[payments-quotation-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+PAYMENTS_QUOTATION_ENV_NAME="${PAYMENTS_QUOTATION_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${PAYMENTS_QUOTATION_ENV_NAME}"
 
 PAYMENTS_QUOTATION_MONGO_SECRET_PATH="${PAYMENTS_QUOTATION_MONGO_SECRET_PATH:?missing PAYMENTS_QUOTATION_MONGO_SECRET_PATH}"
 
diff --git a/ci/scripts/tgsettle/build-image.sh b/ci/scripts/tgsettle/build-image.sh
index a592afa1..5fff897b 100755
--- a/ci/scripts/tgsettle/build-image.sh
+++ b/ci/scripts/tgsettle/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-TGSETTLE_GATEWAY_ENV_NAME="${TGSETTLE_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${TGSETTLE_GATEWAY_ENV_NAME}/.env.runtime"
+TGSETTLE_GATEWAY_ENV_NAME="${TGSETTLE_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${TGSETTLE_GATEWAY_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[tgsettle-gateway-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -93,7 +85,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${TGSETTLE_GATEWAY_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${TGSETTLE_GATEWAY_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${TGSETTLE_GATEWAY_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/tgsettle/deploy.sh b/ci/scripts/tgsettle/deploy.sh
index 0edd27f4..8eb88568 100755
--- a/ci/scripts/tgsettle/deploy.sh
+++ b/ci/scripts/tgsettle/deploy.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-TGSETTLE_GATEWAY_ENV_NAME="${TGSETTLE_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${TGSETTLE_GATEWAY_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[tgsettle-gateway-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+TGSETTLE_GATEWAY_ENV_NAME="${TGSETTLE_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${TGSETTLE_GATEWAY_ENV_NAME}"
 
 TGSETTLE_GATEWAY_MONGO_SECRET_PATH="${TGSETTLE_GATEWAY_MONGO_SECRET_PATH:?missing TGSETTLE_GATEWAY_MONGO_SECRET_PATH}"
 
diff --git a/ci/scripts/tron_gateway/build-image.sh b/ci/scripts/tron_gateway/build-image.sh
index e1744f61..bd0a7ab4 100755
--- a/ci/scripts/tron_gateway/build-image.sh
+++ b/ci/scripts/tron_gateway/build-image.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -32,19 +33,10 @@ load_env_file() {
   done <"$file"
 }
 
-TRON_GATEWAY_ENV_NAME="${TRON_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${TRON_GATEWAY_ENV_NAME}/.env.runtime"
+TRON_GATEWAY_ENV_NAME="${TRON_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${TRON_GATEWAY_ENV_NAME}"
 
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[tron-gateway-build] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+IMAGE_TAG="$(compute_image_tag)"
 
 REGISTRY_URL="${REGISTRY_URL:?missing REGISTRY_URL}"
 APP_V="${APP_V:?missing APP_V}"
@@ -93,7 +85,7 @@ fi
 /kaniko/executor \
   --context "${BUILD_CONTEXT}" \
   --dockerfile "${TRON_GATEWAY_DOCKERFILE}" \
-  --destination "${REGISTRY_URL}/${TRON_GATEWAY_IMAGE_PATH}:${APP_V}" \
+  --destination "${REGISTRY_URL}/${TRON_GATEWAY_IMAGE_PATH}:${IMAGE_TAG}" \
   --build-arg APP_VERSION="${APP_V}" \
   --build-arg GIT_REV="${GIT_REV}" \
   --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
diff --git a/ci/scripts/tron_gateway/deploy.sh b/ci/scripts/tron_gateway/deploy.sh
index b0196bc6..c55c8e78 100755
--- a/ci/scripts/tron_gateway/deploy.sh
+++ b/ci/scripts/tron_gateway/deploy.sh
@@ -9,6 +9,7 @@ REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 cd "${REPO_ROOT}"
 
 sh ci/scripts/common/ensure_env_version.sh
+. ci/scripts/common/runtime_env.sh
 
 normalize_env_file() {
   file="$1"
@@ -34,19 +35,8 @@ load_env_file() {
 
 . ci/scripts/common/nats_env.sh
 
-TRON_GATEWAY_ENV_NAME="${TRON_GATEWAY_ENV:-prod}"
-RUNTIME_ENV_FILE="./ci/${TRON_GATEWAY_ENV_NAME}/.env.runtime"
-
-if [ ! -f "${RUNTIME_ENV_FILE}" ]; then
-  echo "[tron-gateway-deploy] runtime env file not found: ${RUNTIME_ENV_FILE}" >&2
-  exit 1
-fi
-
-normalize_env_file "${RUNTIME_ENV_FILE}"
-normalize_env_file ./.env.version
-
-load_env_file "${RUNTIME_ENV_FILE}"
-load_env_file ./.env.version
+TRON_GATEWAY_ENV_NAME="${TRON_GATEWAY_ENV:-$(resolve_runtime_env_name)}"
+load_runtime_env_bundle "${TRON_GATEWAY_ENV_NAME}"
 
 TRON_GATEWAY_MONGO_SECRET_PATH="${TRON_GATEWAY_MONGO_SECRET_PATH:?missing TRON_GATEWAY_MONGO_SECRET_PATH}"
 TRON_GATEWAY_RPC_SECRET_PATH="${TRON_GATEWAY_RPC_SECRET_PATH:?missing TRON_GATEWAY_RPC_SECRET_PATH}"
diff --git a/frontend/pweb/entrypoint.sh b/frontend/pweb/entrypoint.sh
index 977f5d36..fa025f19 100755
--- a/frontend/pweb/entrypoint.sh
+++ b/frontend/pweb/entrypoint.sh
@@ -1,25 +1,26 @@
 #!/bin/sh
+set -eu
 
-replace_env_var() {
-  local var_name=$1
-  local placeholder="%%$var_name%%"
-  local value=$(eval echo \$$var_name)
-  # inject value to the index.html
-  sed -i "s|$placeholder|$value|g" /usr/share/pweb/index.html
+js_escape() {
+  printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'
 }
 
-echo "Starting Container"
+write_app_config() {
+  cat <<EOF >/usr/share/pweb/app-config.js
+window.appConfig = {
+  apiProto: "$(js_escape "${API_PROTOCOL:-https}")",
+  apiHost: "$(js_escape "${SERVICE_HOST:-app.sendico.io}")",
+  apiEndpoint: "$(js_escape "${API_ENDPOINT:-/api/v1}")",
+  amplitudeSecret: "$(js_escape "${AMPLITUDE_SECRET:-}")",
+  defaultLocale: "$(js_escape "${DEFAULT_LOCALE:-en}")",
+  defaultCurrency: "$(js_escape "${DEFAULT_CURRENCY:-EUR}")",
+  wsProto: "$(js_escape "${WS_PROTOCOL:-wss}")",
+  wsEndpoint: "$(js_escape "${WS_ENDPOINT:-/ws}")"
+};
+EOF
+}
 
-replace_env_var "WS_PROTOCOL"
-replace_env_var "WS_ENDPOINT"
-replace_env_var "API_PROTOCOL"
-replace_env_var "SERVICE_HOST"
-replace_env_var "API_ENDPOINT"
-replace_env_var "AMPLITUDE_SECRET"
-replace_env_var "DEFAULT_LOCALE"
-replace_env_var "DEFAULT_CURRENCY"
+echo "Starting container"
+write_app_config
 
-echo "Passing by launch command"
-# Execute the passed command (e.g., starting Caddy)
-# exec "$@"
 exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
diff --git a/frontend/pweb/web/index.html b/frontend/pweb/web/index.html
index 02926d6c..89d3ef4f 100644
--- a/frontend/pweb/web/index.html
+++ b/frontend/pweb/web/index.html
@@ -33,6 +33,7 @@
   <link rel="manifest" href="manifest.json">
 </head>
 <body>
+  <script src="app-config.js"></script>
   <script src="flutter_bootstrap.js" async></script>
 </body>
 </html>