diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index 7cf8c8be6..bfbdf292c 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -99,7 +99,7 @@ jobs:
           SURFSENSE_BACKEND_INTERNAL_URL: ${{ vars.NEXT_PUBLIC_FASTAPI_BACKEND_URL }}
           NEXT_PUBLIC_ZERO_CACHE_URL: ${{ vars.NEXT_PUBLIC_ZERO_CACHE_URL }}
           NEXT_PUBLIC_DEPLOYMENT_MODE: ${{ vars.NEXT_PUBLIC_DEPLOYMENT_MODE }}
-          NEXT_PUBLIC_FASTAPI_BACKEND_AUTH_TYPE: ${{ vars.NEXT_PUBLIC_FASTAPI_BACKEND_AUTH_TYPE }}
+          NEXT_PUBLIC_AUTH_TYPE: ${{ vars.NEXT_PUBLIC_AUTH_TYPE }}
           NEXT_PUBLIC_ETL_SERVICE: ${{ vars.NEXT_PUBLIC_ETL_SERVICE }}
           NEXT_PUBLIC_POSTHOG_KEY: ${{ secrets.NEXT_PUBLIC_POSTHOG_KEY }}
 
diff --git a/surfsense_web/components/providers/runtime-config.server.tsx b/surfsense_web/components/providers/runtime-config.server.tsx
index bbe242286..c515820c2 100644
--- a/surfsense_web/components/providers/runtime-config.server.tsx
+++ b/surfsense_web/components/providers/runtime-config.server.tsx
@@ -1,14 +1,18 @@
 import { connection } from "next/server";
 import { RuntimeConfigProvider } from "@/components/providers/runtime-config";
-import { AUTH_TYPE, DEPLOYMENT_MODE, ETL_SERVICE } from "@/lib/env-config";
+import {
+	BUILD_TIME_AUTH_TYPE,
+	BUILD_TIME_DEPLOYMENT_MODE,
+	BUILD_TIME_ETL_SERVICE,
+} from "@/lib/env-config";
 
 export async function RuntimeConfig({ children }: { children: React.ReactNode }) {
 	await connection();
 
 	const value = {
-		authType: process.env.AUTH_TYPE ?? AUTH_TYPE,
-		etlService: process.env.ETL_SERVICE ?? ETL_SERVICE,
-		deploymentMode: process.env.DEPLOYMENT_MODE ?? DEPLOYMENT_MODE,
+		authType: process.env.AUTH_TYPE ?? BUILD_TIME_AUTH_TYPE,
+		etlService: process.env.ETL_SERVICE ?? BUILD_TIME_ETL_SERVICE,
+		deploymentMode: process.env.DEPLOYMENT_MODE ?? BUILD_TIME_DEPLOYMENT_MODE,
 	};
 
 	return <RuntimeConfigProvider value={value}>{children}</RuntimeConfigProvider>;
diff --git a/surfsense_web/lib/env-config.ts b/surfsense_web/lib/env-config.ts
index e3c46e5bc..b34614820 100644
--- a/surfsense_web/lib/env-config.ts
+++ b/surfsense_web/lib/env-config.ts
@@ -9,8 +9,8 @@
 import packageJson from "../package.json";
 
 // Build-time fallback for packaged clients. Docker runtime reads plain AUTH_TYPE
-// through the runtime config provider instead.
-export const AUTH_TYPE = process.env.NEXT_PUBLIC_FASTAPI_BACKEND_AUTH_TYPE || "GOOGLE";
+// through the runtime config provider first, then falls back to this baked value.
+export const BUILD_TIME_AUTH_TYPE = process.env.NEXT_PUBLIC_AUTH_TYPE || "GOOGLE";
 
 // Backend API URL. An empty string is valid in proxy mode and means
 // same-origin relative requests (e.g. /api/v1/... and /auth/...).
@@ -63,12 +63,12 @@ export const SERVER_BACKEND_URL =
 	"http://backend:8000";
 
 // Build-time fallback for packaged clients. Docker runtime reads plain ETL_SERVICE
-// through the runtime config provider instead.
-export const ETL_SERVICE = process.env.NEXT_PUBLIC_ETL_SERVICE || "DOCLING";
+// through the runtime config provider first, then falls back to this baked value.
+export const BUILD_TIME_ETL_SERVICE = process.env.NEXT_PUBLIC_ETL_SERVICE || "DOCLING";
 
 // Build-time fallback for packaged clients. Docker runtime reads plain
-// DEPLOYMENT_MODE through the runtime config provider instead.
-export const DEPLOYMENT_MODE = process.env.NEXT_PUBLIC_DEPLOYMENT_MODE || "self-hosted";
+// DEPLOYMENT_MODE through the runtime config provider first, then falls back to this baked value.
+export const BUILD_TIME_DEPLOYMENT_MODE = process.env.NEXT_PUBLIC_DEPLOYMENT_MODE || "self-hosted";
 
 // App version - defaults to package.json version
 // Can be overridden at build time with NEXT_PUBLIC_APP_VERSION for full git tag version