diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 03ffdb7..ff0be2d 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -9,8 +9,8 @@ jobs:
     name: Deploy to Production EC2
     runs-on: ubuntu-latest
     env:
-      AWS_REGION: ${{ secrets.AWS_REGION }}
-      EC2_SECURITY_GROUP_ID: ${{ secrets.EC2_SECURITY_GROUP_ID }}
+      AWS_REGION: ${{ vars.AWS_REGION || secrets.AWS_REGION }}
+      EC2_SECURITY_GROUP_ID: ${{ vars.EC2_SECURITY_GROUP_ID || secrets.EC2_SECURITY_GROUP_ID }}
 
     steps:
       - name: Configure AWS credentials
diff --git a/deploy/README.md b/deploy/README.md
index 60aba77..991ac1d 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -48,6 +48,8 @@ The deployment workflow (`.github/workflows/deploy.yml`) temporarily whitelists
 Required repository secrets for this automation:
 - `AWS_ACCESS_KEY_ID`
 - `AWS_SECRET_ACCESS_KEY`
+
+Required repository variables (or secrets) for this automation:
 - `AWS_REGION`
 - `EC2_SECURITY_GROUP_ID`