diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
new file mode 100644
index 00000000000..e8eb7450e55
--- /dev/null
+++ b/.github/workflows/deploy.yaml
@@ -0,0 +1,60 @@
+
+# Deploy workflow
+#
+# Website deployment to the FreeCAD staging or production containers.
+# Manual trigger only by workflow_dispatch. The chosen environment supplies the
+# host, account, and key, and its protection rules control the run.
+
+
+name: Deploy
+run-name: Deploy to ${{ inputs.environment }} by @${{ github.triggering_actor }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Environment to deploy to
+        type: choice
+        options:
+          - staging
+          - production
+        default: staging
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-${{ inputs.environment }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    timeout-minutes: 10
+
+    steps:
+      - name: Configure SSH
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
+          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
+        run: |
+          install -m 700 -d ~/.ssh
+          printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
+
+      # The server-side deploy is pinned as a forced command in the deploy
+      # account's authorized_keys, so no command is sent here.
+      - name: Deploy
+        env:
+          DEPLOY_TARGET: ${{ vars.DEPLOY_USER }}@${{ vars.DEPLOY_HOST }}
+        run: |
+          ssh \
+            -i ~/.ssh/deploy_key \
+            -o IdentitiesOnly=yes \
+            -o BatchMode=yes \
+            -o StrictHostKeyChecking=yes \
+            -o ConnectTimeout=15 \
+            -n \
+            "$DEPLOY_TARGET"
diff --git a/.github/workflows/staging.yaml b/.github/workflows/staging.yaml
deleted file mode 100644
index 6b1a569ca69..00000000000
--- a/.github/workflows/staging.yaml
+++ /dev/null
@@ -1,48 +0,0 @@
-# Staging action workflow
-#
-# Website deployment to FreeCAD staging server.
-# Manual trigger by workflow_dispatch.
-
-
-name: Staging deploy
-run-name: Staging deployment by @${{ github.triggering_actor }}
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: staging
-  cancel-in-progress: false
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    environment: staging
-    timeout-minutes: 10
-
-    steps:
-      - name: Configure SSH
-        env:
-          STAGING_DEPLOY_KEY: ${{ secrets.STAGING_DEPLOY_KEY }}
-          STAGING_KNOWN_HOSTS: ${{ secrets.STAGING_KNOWN_HOSTS }}
-        run: |
-          install -m 700 -d ~/.ssh
-          printf '%s\n' "$STAGING_DEPLOY_KEY" > ~/.ssh/staging_deploy
-          chmod 600 ~/.ssh/staging_deploy
-          printf '%s\n' "$STAGING_KNOWN_HOSTS" > ~/.ssh/known_hosts
-
-      # The remote deploy script is pinned as a forced command in the
-      # staging-deploy account authorized_keys, so no command is sent here.
-      - name: Deploy
-        run: |
-          ssh \
-            -i ~/.ssh/staging_deploy \
-            -o IdentitiesOnly=yes \
-            -o BatchMode=yes \
-            -o StrictHostKeyChecking=yes \
-            -o ConnectTimeout=15 \
-            -n \
-            staging-deploy@${{ vars.STAGING_DEPLOY_HOST }}