diff --git a/config/runtime.exs b/config/runtime.exs
index 2c90fae..a9acc73 100644
--- a/config/runtime.exs
+++ b/config/runtime.exs
@@ -2,12 +2,18 @@ import Config
 
 # Runtime secrets — each release only requires its own secret key
 if config_env() == :prod do
-  config :centralcloud_my, CentralcloudMy.Endpoint,
-    secret_key_base: System.get_env("MY_SECRET_KEY_BASE") || System.fetch_env!("MY_SECRET_KEY_BASE")
+  # RELEASE_NAME is set by the Elixir release scripts at startup.
+  # Each release only requires its own secret key.
+  release = System.get_env("RELEASE_NAME", "")
 
-  # STAFF_SECRET_KEY_BASE only required when running the centralcloud_staff release
-  if staff_key = System.get_env("OPS_SECRET_KEY_BASE") do
-    config :centralcloud_staff, CentralcloudStaff.Endpoint, secret_key_base: staff_key
+  if release != "centralcloud_staff" do
+    config :centralcloud_my, CentralcloudMy.Endpoint,
+      secret_key_base: System.fetch_env!("MY_SECRET_KEY_BASE")
+  end
+
+  if release != "centralcloud_my" do
+    config :centralcloud_staff, CentralcloudStaff.Endpoint,
+      secret_key_base: System.fetch_env!("OPS_SECRET_KEY_BASE")
   end
 end