diff --git a/.github/workflows/prod-deploy.yml b/.github/workflows/prod-deploy.yml
index 7858ce16b..bf28d291b 100644
--- a/.github/workflows/prod-deploy.yml
+++ b/.github/workflows/prod-deploy.yml
@@ -54,6 +54,14 @@ jobs:
         run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}
 
       - name: Build
+        # NEXT_PUBLIC_POSTHOG_KEY comes from a repository variable: `vercel pull`
+        # writes the literal "[SENSITIVE]" for env vars flagged sensitive on
+        # Vercel, and that string was compiled into the bundle as the PostHog
+        # token (no event reached PostHog from 2026-08-24 to 2026-09-20).
+        # process.env wins over the pulled .env file. The token is public by
+        # nature (it ships to every browser), so a variable, not a secret.
+        env:
+          NEXT_PUBLIC_POSTHOG_KEY: ${{ vars.NEXT_PUBLIC_POSTHOG_KEY }}
         run: vercel build --prod --token=${{ secrets.VERCEL_TOKEN }}
 
       - name: Deploy to Production
diff --git a/.github/workflows/staging-deploy.yml b/.github/workflows/staging-deploy.yml
index 76b930fc6..06bca10bb 100644
--- a/.github/workflows/staging-deploy.yml
+++ b/.github/workflows/staging-deploy.yml
@@ -47,6 +47,10 @@ jobs:
         run: vercel pull --yes --environment=preview --token=${{ secrets.VERCEL_TOKEN }}
 
       - name: Build
+        # Same repository variable as prod-deploy.yml (see the note there).
+        # Staging events are excluded by the CRM's host filter.
+        env:
+          NEXT_PUBLIC_POSTHOG_KEY: ${{ vars.NEXT_PUBLIC_POSTHOG_KEY }}
         run: vercel build --token=${{ secrets.VERCEL_TOKEN }}
 
       - name: Deploy Preview