diff --git a/.github/workflows/0-ci.yml b/.github/workflows/0-ci.yml
index a5239b6..dc6b4af 100644
--- a/.github/workflows/0-ci.yml
+++ b/.github/workflows/0-ci.yml
@@ -1,4 +1,4 @@
-# Pipeline: merge to main → 0-ci → 1-build-push → 4-deploy (EC2)
+# Pipeline: merge to main → 0-ci → 1-build-push (Docker Hub). Redeploy in Rancher manually.
 name: auth-engine-dashboard · Lint and Build
 
 on:
diff --git a/.github/workflows/1-build-push.yml b/.github/workflows/1-build-push.yml
index 689f311..185dbcd 100644
--- a/.github/workflows/1-build-push.yml
+++ b/.github/workflows/1-build-push.yml
@@ -107,7 +107,5 @@ jobs:
           echo "**Image:** \`${{ steps.image.outputs.full }}\`" >> $GITHUB_STEP_SUMMARY
           echo "**Digest:** \`${{ steps.build.outputs.digest }}\`" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "### Pull Command" >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
-          echo "docker pull ${{ steps.image.outputs.full }}" >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+          echo "### Next step — redeploy in Rancher" >> $GITHUB_STEP_SUMMARY
+          echo "Merge to \`main\` builds and pushes this image. Redeploy the **dashboard** workload in Rancher (or \`kubectl rollout restart deployment/dashboard -n authengine\`) to pick up \`:latest\`." >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/4-deploy.yml b/.github/workflows/4-deploy.yml
deleted file mode 100644
index a81b8da..0000000
--- a/.github/workflows/4-deploy.yml
+++ /dev/null
@@ -1,141 +0,0 @@
-# Runs after 1-build-push succeeds on main. Pulls image on EC2.
-name: auth-engine-dashboard · Deploy to Production
-
-on:
-  workflow_run:
-    workflows: ["auth-engine-dashboard · Build and Push Docker Image"]
-    types: [completed]
-    branches: [main]
-  workflow_dispatch:
-
-concurrency:
-  group: production-deploy-dashboard
-  cancel-in-progress: false
-
-env:
-  AWS_REGION: ${{ vars.AWS_REGION != '' && vars.AWS_REGION || 'ap-south-1' }}
-  EC2_INSTANCE_ID: ${{ vars.EC2_INSTANCE_ID }}
-
-jobs:
-  deploy:
-    name: Deploy dashboard to EC2
-    runs-on: ubuntu-latest
-    if: >
-      github.event_name == 'workflow_dispatch' ||
-      github.event.workflow_run.conclusion == 'success'
-    environment: production
-    permissions:
-      contents: read
-      deployments: write
-      id-token: write
-
-    steps:
-      - name: Require EC2 instance id
-        run: |
-          INSTANCE_ID="$(printf '%s' "${EC2_INSTANCE_ID}" | tr -d '[:space:]')"
-          if [ -z "${INSTANCE_ID}" ]; then
-            echo "Set repository variable EC2_INSTANCE_ID (e.g. i-05bd906b129c9acb2)" >&2
-            exit 1
-          fi
-          if ! printf '%s' "${INSTANCE_ID}" | grep -Eq '^i-[0-9a-f]{8,17}$'; then
-            echo "Invalid EC2_INSTANCE_ID: '${INSTANCE_ID}'" >&2
-            echo "Repository variable must be only the instance id, with no spaces or newlines." >&2
-            exit 1
-          fi
-          if [ "${INSTANCE_ID}" != "${EC2_INSTANCE_ID}" ]; then
-            echo "Trimmed whitespace from EC2_INSTANCE_ID (check the repo variable in GitHub Settings)." >&2
-          fi
-          echo "EC2_INSTANCE_ID=${INSTANCE_ID}" >> "${GITHUB_ENV}"
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ env.AWS_REGION }}
-
-      - name: Deploy via SSM
-        id: ssm
-        run: |
-          set -euo pipefail
-          REF="${{ github.event.workflow_run.head_sha || github.sha }}"
-          COMMENT="auth-engine-dashboard-deploy-${REF:0:7}"
-
-          PARAMS="$(mktemp)"
-          cat >"${PARAMS}" <<'JSON'
-          {
-            "commands": [
-              "set -euo pipefail",
-              "if ! docker compose version >/dev/null 2>&1; then ARCH=$(uname -m); mkdir -p /usr/local/lib/docker/cli-plugins; curl -fsSL https://github.com/docker/compose/releases/download/v2.32.4/docker-compose-linux-${ARCH} -o /usr/local/lib/docker/cli-plugins/docker-compose; chmod +x /usr/local/lib/docker/cli-plugins/docker-compose; fi",
-              "cd /opt/authengine/compose",
-              "docker compose --env-file /opt/authengine/.env -f docker-compose.prod.yml pull frontend",
-              "docker compose --env-file /opt/authengine/.env -f docker-compose.prod.yml up -d --force-recreate frontend",
-              "docker compose --env-file /opt/authengine/.env -f docker-compose.prod.yml ps"
-            ]
-          }
-          JSON
-
-          COMMAND_ID="$(aws ssm send-command \
-            --instance-ids "${EC2_INSTANCE_ID}" \
-            --document-name "AWS-RunShellScript" \
-            --comment "${COMMENT}" \
-            --parameters "file://${PARAMS}" \
-            --query 'Command.CommandId' \
-            --output text)"
-          rm -f "${PARAMS}"
-          echo "command_id=${COMMAND_ID}" >> "${GITHUB_OUTPUT}"
-
-          STATUS="InProgress"
-          while [ "${STATUS}" = "InProgress" ] || [ "${STATUS}" = "Pending" ]; do
-            sleep 5
-            STATUS="$(aws ssm get-command-invocation \
-              --command-id "${COMMAND_ID}" \
-              --instance-id "${EC2_INSTANCE_ID}" \
-              --query 'Status' \
-              --output text 2>/dev/null || echo InProgress)"
-          done
-
-          aws ssm get-command-invocation \
-            --command-id "${COMMAND_ID}" \
-            --instance-id "${EC2_INSTANCE_ID}" \
-            --query '[Status, StandardOutputContent, StandardErrorContent]' \
-            --output text
-
-          if [ "${STATUS}" != "Success" ]; then
-            echo "SSM deploy failed with status: ${STATUS}" >&2
-            exit 1
-          fi
-
-      - name: Register GitHub deployment
-        if: success()
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const sha = context.payload.workflow_run?.head_sha || context.sha;
-            const deployment = await github.rest.repos.createDeployment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              ref: sha,
-              environment: "production",
-              auto_merge: false,
-              required_contexts: [],
-              description: "EC2 SSM deploy (dashboard)"
-            });
-
-            await github.rest.repos.createDeploymentStatus({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              deployment_id: deployment.data.id,
-              state: "success",
-              environment_url: "https://app.authengine.org",
-              log_url: `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`
-            });
-
-      - name: Summary
-        if: always()
-        run: |
-          echo "## Production deploy (dashboard)" >> "${GITHUB_STEP_SUMMARY}"
-          echo "" >> "${GITHUB_STEP_SUMMARY}"
-          echo "- **Instance:** \`${EC2_INSTANCE_ID}\`" >> "${GITHUB_STEP_SUMMARY}"
-          echo "- **SSM command:** \`${{ steps.ssm.outputs.command_id }}\`" >> "${GITHUB_STEP_SUMMARY}"
-          echo "- **App:** https://app.authengine.org" >> "${GITHUB_STEP_SUMMARY}"
diff --git a/README.md b/README.md
index 7357656..08c74e3 100644
--- a/README.md
+++ b/README.md
@@ -52,7 +52,9 @@ cd auth-engine-infra/compose
 docker compose up -d --build
 ```
 
-Pre-built production images and CI/CD: [Deployment guide](https://docs.authengine.org/deployment/).
+Pre-built production images: [Deployment guide](https://docs.authengine.org/deployment/).
+
+**CI/CD:** merge to `main` runs lint/build and pushes `DOCKERHUB_USERNAME/authengine-dashboard:latest`. Redeploy the `dashboard` workload in Rancher after a new image is available.
 
 ## Contributing