diff --git a/README.md b/README.md
index 00d4f11..20f4327 100644
--- a/README.md
+++ b/README.md
@@ -135,28 +135,19 @@ Infrastructure is provisioned using Terraform.
 
 ### Prerequisites
 
-1. Install [Terraform](https://developer.hashicorp.com/terraform/install)
-2. Install TFLint
+1. [Install Terraform](https://developer.hashicorp.com/terraform/install)
 
-```bash
-# macOS
-brew install tflint
-```
-
-3. Install TFSec
+2. [Install TFLint](https://github.com/terraform-linters/tflint?utm_source=chatgpt.com)
 
-```bash
-# macOS
-brew install tfsec
-```
+3. [Install TFSec](https://aquasecurity.github.io/tfsec/v0.63.1/getting-started/installation/)
 
 ### Configuration
 
-Create environment variable files for each Terraform environment:
+Terraform non-secret environment configuration lives in:
 
-```bash
-cp infra/staging.tfvars.example infra/staging.tfvars
-cp infra/prod.tfvars.example infra/prod.tfvars
+```text
+infra/staging.tfvars
+infra/prod.tfvars
 ```
 
 ### Workflow
@@ -168,13 +159,15 @@ cd infra
 
 terraform init # one-off
 
-make plan-staging
-make apply-staging
-make destroy-staging
+make plan
+make apply
+make destroy
+```
+
+Commands default to the staging environment. In prod:
 
-make plan-prod
-make apply-prod
-make destroy-prod
+```bash
+make apply ENV=prod
 ```
 
 ## One-off Infrastructure Setup (GCP)
diff --git a/infra/.gitignore b/infra/.gitignore
index 71742f3..7de2754 100644
--- a/infra/.gitignore
+++ b/infra/.gitignore
@@ -4,7 +4,3 @@
 *.tfstate
 *.tfstate.*
 .terraform/
-
-# Terraform variables (may contain secrets)
-*.tfvars
-*.tfvars.json
diff --git a/infra/Makefile b/infra/Makefile
index 0b570ab..08fe2ba 100644
--- a/infra/Makefile
+++ b/infra/Makefile
@@ -1,3 +1,5 @@
+ENV ?= staging
+
 fmt:
 	terraform fmt -recursive
 
@@ -6,23 +8,13 @@ validate:
 
 lint:
 	tflint
-	
-plan-staging: fmt validate lint
-	terraform plan -var-file=staging.tfvars
-
-apply-staging: fmt validate lint
-	terraform apply -var-file=staging.tfvars
-
-plan-prod: fmt validate lint
-	terraform plan -var-file=prod.tfvars
 
-apply-prod: fmt validate lint
-	terraform apply -var-file=prod.tfvars
+plan: fmt validate lint
+	terraform plan -var-file=$(ENV).tfvars
 
-destroy-staging: fmt validate lint
-	@read -p "Destroy STAGING resources? (yes/no): " confirm && [ "$$confirm" = "yes" ]
-	terraform destroy -var-file=staging.tfvars
+apply: fmt validate lint
+	terraform apply -var-file=$(ENV).tfvars
 
-destroy-prod: fmt validate lint
-	@read -p "Destroy PROD resources? (yes/no): " confirm && [ "$$confirm" = "yes" ]
-	terraform destroy -var-file=prod.tfvars
\ No newline at end of file
+destroy: fmt validate lint
+	@read -p "Destroy $(ENV) resources? (yes/no): " confirm && [ "$$confirm" = "yes" ]
+	terraform destroy -var-file=$(ENV).tfvars
diff --git a/infra/staging.tfvars b/infra/staging.tfvars
new file mode 100644
index 0000000..cd265d9
--- /dev/null
+++ b/infra/staging.tfvars
@@ -0,0 +1,2 @@
+project_id  = "student-progress-staging"
+environment = "staging"