diff --git a/.github/workflows/backend-cd-main.yml b/.github/workflows/backend-cd-main.yml
index 14fc5f1..0bbb2a2 100644
--- a/.github/workflows/backend-cd-main.yml
+++ b/.github/workflows/backend-cd-main.yml
@@ -47,7 +47,12 @@ jobs:
 
           docker pull $IMAGE
 
+          # Get the network Redis is on
+          REDIS_NETWORK=$(docker inspect rythmify-redis --format '{{range $k,$v := .NetworkSettings.Networks}}{{$k}}{{end}}')
+          echo "Redis is on network: $REDIS_NETWORK"
+
           docker run --rm \
+            --network $REDIS_NETWORK \
             -e DATABASE_URL="$DATABASE_URL" \
             $IMAGE \
             npm run migrate:up
@@ -58,6 +63,7 @@ jobs:
           docker run -d \
             --name rythmify-backend \
             --restart unless-stopped \
+            --network $REDIS_NETWORK \
             -p 8080:8080 \
             -e NODE_ENV=production \
             -e PORT=8080 \
@@ -85,7 +91,7 @@ jobs:
             -e FCM_CLIENT_EMAIL="$FCM_CLIENT_EMAIL" \
             -e FCM_PRIVATE_KEY="$FCM_PRIVATE_KEY" \
             -e REDIS_ENABLED=true \
-            -e REDIS_URL=redis://host.docker.internal:6379 \
+            -e REDIS_URL=redis://rythmify-redis:6379 \
             $IMAGE
 
           sleep 30
@@ -114,7 +120,8 @@ jobs:
           export IMAGE ACR_LOGIN_SERVER ACR_USERNAME ACR_PASSWORD \
                  DATABASE_URL JWT_SECRET AZURE_STORAGE_CONNECTION_STRING \
                  GOOGLE_CLIENT_ID GOOGLE_CLIENT_SECRET GMAIL_USER \
-                 GMAIL_APP_PASSWORD RECAPTCHA_SECRET
+                 GMAIL_APP_PASSWORD RECAPTCHA_SECRET STRIPE_SECRET_KEY \
+                 STRIPE_WEBHOOK_SECRET
           envsubst < deploy.sh > deploy-final.sh
         env:
           IMAGE: ${{ secrets.ACR_LOGIN_SERVER }}/backend:main
diff --git a/app.js b/app.js
index fb84f7b..b630ffb 100644
--- a/app.js
+++ b/app.js
@@ -37,7 +37,11 @@ const app = express();
 app.set('trust proxy', 1);
 
 // ── Global middleware ──────────────────────────────────────
-app.use(helmet());
+app.use(
+  helmet({
+    crossOriginOpenerPolicy: { policy: 'same-origin-allow-popups' },
+  })
+);
 
 const allowedOrigins = Array.from(
   new Set(
diff --git a/server.js b/server.js
index e33bee0..90d6315 100644
--- a/server.js
+++ b/server.js
@@ -17,10 +17,21 @@ const { registerAdminNotificationHandlers } = require('./src/sockets/admin-notif
 const server = http.createServer(app);
 
 const allowedOrigins = Array.from(
-  new Set([...env.CLIENT_URL.split(',').map((o) => o.trim()), env.APP_URL].filter(Boolean))
+  new Set(
+    [
+      ...env.CLIENT_URL.split(',').map((o) => o.trim()),
+      env.APP_URL,
+      'https://gray-grass-0ab138600.7.azurestaticapps.net',
+      'http://20.196.3.253',
+      'https://rythmify.duckdns.org',
+      'http://localhost:5173',
+      'https://rythmify-backend-dev.livelypebble-6b7965ef.uaenorth.azurecontainerapps.io',
+    ].filter(Boolean)
+  )
 );
 
 const io = new Server(server, {
+  path: '/socket.io',
   cors: { origin: allowedOrigins, methods: ['GET', 'POST'], credentials: true },
 });