diff --git a/docs/developer-operations-runbook.md b/docs/developer-operations-runbook.md
index d054508..23f8d03 100644
--- a/docs/developer-operations-runbook.md
+++ b/docs/developer-operations-runbook.md
@@ -159,19 +159,33 @@ REDIS_URL=redis://localhost:6379
 
 ### Frontend
 
+Each tenant has its own frontend directory on EC2. The `VITE_API_URL` is baked at build time so each build points to the correct sidecar.
+
 ```bash
 # Helper — reuse in all commands below
 EC2="SSHPASS='SasiSuman@2007' sshpass -P 'Enter passphrase' -e ssh -i ~/Downloads/fortytwoai_hostinger -o StrictHostKeyChecking=no ubuntu@13.234.31.194"
 EC2_RSYNC="SSHPASS='SasiSuman@2007' sshpass -P 'Enter passphrase' -e ssh -i ~/Downloads/fortytwoai_hostinger -o StrictHostKeyChecking=no"
 
-cd helix-engage && npm run build
+cd helix-engage
 
+# ── Ramaiah (production pilot — deploy stable builds only) ──
+VITE_API_URL=https://ramaiah.engage.healix360.net npm run build
 rsync -avz -e "$EC2_RSYNC" \
-  dist/ ubuntu@13.234.31.194:/opt/fortytwo/helix-engage-frontend/
+  dist/ ubuntu@13.234.31.194:/opt/fortytwo/frontend-ramaiah/
 
-eval $EC2 "cd /opt/fortytwo && sudo docker compose restart caddy"
+# ── Global (staging — new features land here first) ──
+VITE_API_URL=https://global.engage.healix360.net npm run build
+rsync -avz -e "$EC2_RSYNC" \
+  dist/ ubuntu@13.234.31.194:/opt/fortytwo/frontend-global/
 ```
 
+| Tenant | Frontend Dir | API URL (baked) | Caddy Root |
+|---|---|---|---|
+| Ramaiah | `/opt/fortytwo/frontend-ramaiah/` | `https://ramaiah.engage.healix360.net` | `/srv/engage-ramaiah` |
+| Global | `/opt/fortytwo/frontend-global/` | `https://global.engage.healix360.net` | `/srv/engage-global` |
+
+**Important:** Always build with the correct `VITE_API_URL` for the target tenant. A build without it (or with `localhost`) will break login and API calls.
+
 ### Sidecar
 
 ```bash
diff --git a/src/lib/api-client.ts b/src/lib/api-client.ts
index b0e8339..2d4b251 100644
--- a/src/lib/api-client.ts
+++ b/src/lib/api-client.ts
@@ -1,6 +1,9 @@
 import { notify } from './toast';
 
-const API_URL = import.meta.env.VITE_API_URL ?? 'http://localhost:4100';
+// In production, use the current origin — Caddy routes /api/* to the
+// correct per-tenant sidecar based on hostname. Only use VITE_API_URL
+// for local dev (pointing to a specific sidecar).
+const API_URL = import.meta.env.VITE_API_URL || window.location.origin;
 
 class AuthError extends Error {
     constructor(message = 'Authentication required') {