diff --git a/.github/workflows/build-and-stage.yml b/.github/workflows/build-and-stage.yml
index 66f19155..ba15502f 100644
--- a/.github/workflows/build-and-stage.yml
+++ b/.github/workflows/build-and-stage.yml
@@ -1,4 +1,5 @@
 name: build-website
+
 on:
   pull_request:
     branches:
@@ -8,12 +9,12 @@ on:
     - main
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 permissions:
-  contents: 'read'
-  pull-requests: 'write'
+  contents: read
+  pull-requests: write
 
 env:
   DOCFX_VERSION: 2.59.4
@@ -129,7 +130,7 @@ jobs:
     - name: Push image
       run: docker push ${{ vars.DOCKER_REGISTRY }}/documentation-metadata --all-tags
 
-  build-push-deploy:
+  build-push-final:
     name: Build and push documentation image
     needs: [ change-detection, build-push-docfx, build-push-metadata ]
     environment:
@@ -141,11 +142,6 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Login to Azure
-      uses: azure/login@v1
-      with:
-        creds: ${{ secrets.AZURE_CREDENTIALS }}
-
     - name: Login to container registry
       uses: azure/docker-login@v1
       with:
@@ -159,16 +155,29 @@ jobs:
     - name: Push image
       run: docker push ${{ vars.DOCKER_REGISTRY }}/documentation --all-tags
 
+  deploy:
+    name: Deploy
+    if: ${{ github.secret_source == 'Actions' }}
+    environment:
+      name: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || vars.STAGING_SLOT_NAME }}
+      url: ${{ steps.deploy-to-webapp.outputs.webapp-url }}
+    env:
+      SLOT_NAME: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || vars.STAGING_SLOT_NAME }}
+    needs: build-push-final
+    runs-on: ubuntu-latest
+    steps:
+    - name: Login to Azure
+      uses: azure/login@v2
+      with:
+        creds: ${{ secrets.AZURE_CREDENTIALS }}
+
     - name: If PR, create a new staging slot
       if: ${{ github.event_name == 'pull_request' }}
       run: az webapp deployment slot create --resource-group ${{ vars.AZURE_RESOURCE_GROUP }} --name ${{ vars.AZURE_WEBAPP_NAME}} --slot ${{ env.SLOT_NAME }} --configuration-source ${{ vars.STAGING_SLOT_NAME }}
 
-      # Need to pair a PR slot with a custom MainSite address?
-      # az webapp config appsettings set -g steeltoe --name docs-steeltoe --slot pr-310 --settings mainsite_host=https://www-steeltoe-pr-141.azurewebsites.net
-
     - name: Deploy to staging slot
-      uses: azure/webapps-deploy@v3
       id: deploy-to-webapp
+      uses: azure/webapps-deploy@v3
       with:
         app-name: ${{ vars.AZURE_WEBAPP_NAME }}
         images: ${{ vars.DOCKER_REGISTRY }}/documentation:${{ env.SITE_IMAGE_VERSION }}
@@ -184,5 +193,12 @@ jobs:
           - Your changes have been deployed to the preview site. The preview site will update as you add more commits to this branch.
           - The preview link is shareable, but will be deleted when the pull request is merged or closed.
 
+          ### Need to pair with a custom main site address?
+
+          A team member can use this az CLI command, replacing <this-PR-number> and <other-pr-number> for valid numbers:
+          ```bash
+          az webapp config appsettings set --resource-group steeltoe --name docs-steeltoe --slot pr-<this-PR-number> --settings mainsite_host=https://www-steeltoe-pr-<other-pr-number>.azurewebsites.net
+          ```
+
           > *This is an automated message.*
         repo-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pr-cleanup.yml b/.github/workflows/pr-cleanup.yml
index eb4e222d..eb50e4a3 100644
--- a/.github/workflows/pr-cleanup.yml
+++ b/.github/workflows/pr-cleanup.yml
@@ -2,7 +2,8 @@ name: Delete a preview environment
 
 on:
   pull_request:
-    types: [closed]
+    types:
+    - closed
 
 env:
   SLOT_NAME: pr-${{ github.event.number }}
@@ -13,7 +14,7 @@ jobs:
 
     steps:
     - name: Log into Azure CLI with service principal
-      uses: azure/login@v1
+      uses: azure/login@v2
       with:
         creds: ${{ secrets.AZURE_CREDENTIALS }}
 
diff --git a/.github/workflows/stage-prod-swap.yml b/.github/workflows/stage-prod-swap.yml
index 515058a9..efea94c1 100644
--- a/.github/workflows/stage-prod-swap.yml
+++ b/.github/workflows/stage-prod-swap.yml
@@ -8,12 +8,12 @@ jobs:
     name: Promote to production
     runs-on: ubuntu-latest
     environment:
-      name: 'Production'
+      name: Production
       url: 'https://${{ vars.AZURE_WEBAPP_NAME }}.azurewebsites.net/'
 
     steps:
     - name: Log into Azure CLI with service principal
-      uses: azure/login@v1
+      uses: azure/login@v2
       with:
         creds: ${{ secrets.AZURE_CREDENTIALS }}