diff --git a/docs/deployment/DEPLOYMENT_QUICK_REFERENCE.md b/docs/deployment/DEPLOYMENT_QUICK_REFERENCE.md
index 8f6316a..1238f27 100644
--- a/docs/deployment/DEPLOYMENT_QUICK_REFERENCE.md
+++ b/docs/deployment/DEPLOYMENT_QUICK_REFERENCE.md
@@ -158,12 +158,15 @@ kubectl logs -f <pod-name> -n the-order-dev
 ## Phase 11: Frontend Apps
 
 ```bash
-# Deploy portals
-kubectl apply -f infra/k8s/base/portal-public/
-kubectl apply -f infra/k8s/base/portal-internal/
+# Deploy frontend apps through the standard automation flow
+./scripts/deploy/deploy.sh --phase 11 --environment dev
+
+# Or run the phase directly
+ENVIRONMENT=dev IMAGE_TAG=<git-sha-or-release-tag> ./scripts/deploy/phase11-frontend-apps.sh
 
 # Verify
 kubectl get pods -l app=portal-public -n the-order-dev
+kubectl rollout status deployment/portal-public -n the-order-dev
 ```
 
 ---
@@ -309,4 +312,3 @@ Key environment variables needed (store in Key Vault):
 ---
 
 **See `DEPLOYMENT_GUIDE.md` for detailed instructions.**
-
diff --git a/infra/k8s/overlays/dev/configmap-patch.yaml b/infra/k8s/overlays/dev/configmap-patch.yaml
new file mode 100644
index 0000000..d1aaf99
--- /dev/null
+++ b/infra/k8s/overlays/dev/configmap-patch.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: the-order-config
+data:
+  ENVIRONMENT: dev
+  LOG_LEVEL: debug
diff --git a/infra/k8s/overlays/dev/kustomization.yaml b/infra/k8s/overlays/dev/kustomization.yaml
index 6f5bfa6..b3df728 100644
--- a/infra/k8s/overlays/dev/kustomization.yaml
+++ b/infra/k8s/overlays/dev/kustomization.yaml
@@ -11,11 +11,3 @@ patches:
     target:
       kind: ConfigMap
       name: the-order-config
-
-configMapGenerator:
-  - name: the-order-config
-    behavior: merge
-    literals:
-      - ENVIRONMENT=dev
-      - LOG_LEVEL=debug
-
diff --git a/infra/k8s/overlays/prod/configmap-patch.yaml b/infra/k8s/overlays/prod/configmap-patch.yaml
new file mode 100644
index 0000000..4b02089
--- /dev/null
+++ b/infra/k8s/overlays/prod/configmap-patch.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: the-order-config
+data:
+  ENVIRONMENT: prod
+  LOG_LEVEL: info
diff --git a/infra/k8s/overlays/prod/kustomization.yaml b/infra/k8s/overlays/prod/kustomization.yaml
index 55fec48..4e5f641 100644
--- a/infra/k8s/overlays/prod/kustomization.yaml
+++ b/infra/k8s/overlays/prod/kustomization.yaml
@@ -12,20 +12,14 @@ patches:
       kind: ConfigMap
       name: the-order-config
 
-configMapGenerator:
-  - name: the-order-config
-    behavior: merge
-    literals:
-      - ENVIRONMENT=prod
-      - LOG_LEVEL=info
-
 replicas:
-  - name: intake
+  - name: intake-service
     count: 3
-  - name: identity
+  - name: identity-service
     count: 3
-  - name: finance
+  - name: finance-service
     count: 2
-  - name: dataroom
+  - name: dataroom-service
     count: 2
-
+  - name: portal-public
+    count: 3
diff --git a/scripts/deploy/deploy.sh b/scripts/deploy/deploy.sh
index d318622..e152839 100755
--- a/scripts/deploy/deploy.sh
+++ b/scripts/deploy/deploy.sh
@@ -7,6 +7,17 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Pre-parse environment so config.sh can derive readonly values from it.
+for ((i = 1; i <= $#; i++)); do
+  if [ "${!i}" = "--environment" ] || [ "${!i}" = "-e" ]; then
+    next_index=$((i + 1))
+    if [ "${next_index}" -le "$#" ]; then
+      export ENVIRONMENT="${!next_index}"
+    fi
+  fi
+done
+
 source "${SCRIPT_DIR}/config.sh"
 
 # Usage
@@ -70,8 +81,6 @@ DRY_RUN=false
 while [[ $# -gt 0 ]]; do
   case $1 in
     -e|--environment)
-      ENVIRONMENT="$2"
-      export ENVIRONMENT
       shift 2
       ;;
     -p|--phase)
@@ -253,4 +262,3 @@ fi
 
 log_info "Deployment log: ${LOG_FILE}"
 log_info "State file: ${STATE_FILE}"
-
diff --git a/scripts/deploy/phase11-frontend-apps.sh b/scripts/deploy/phase11-frontend-apps.sh
index 62a2802..a95a78d 100755
--- a/scripts/deploy/phase11-frontend-apps.sh
+++ b/scripts/deploy/phase11-frontend-apps.sh
@@ -13,6 +13,8 @@ log_info "=========================================="
 log_info "Phase 11: Frontend Applications Deployment"
 log_info "=========================================="
 
+OVERLAY_DIR="${K8S_DIR}/overlays/${ENVIRONMENT}"
+
 # Verify Kubernetes access
 if ! kubectl cluster-info &> /dev/null; then
   az aks get-credentials --resource-group "${AKS_RESOURCE_GROUP}" \
@@ -23,6 +25,15 @@ fi
 # Ensure namespace exists
 kubectl create namespace "${NAMESPACE}" --dry-run=client -o yaml | kubectl apply -f -
 
+if [ -d "${OVERLAY_DIR}" ]; then
+  log_step "11.0 Validating and applying ${ENVIRONMENT} overlay..."
+  kubectl kustomize "${OVERLAY_DIR}" > /dev/null || error_exit "Failed to render overlay ${OVERLAY_DIR}"
+  kubectl apply -k "${OVERLAY_DIR}" || error_exit "Failed to apply overlay ${OVERLAY_DIR}"
+else
+  log_warning "Overlay not found for environment ${ENVIRONMENT}: ${OVERLAY_DIR}"
+  log_info "Falling back to per-app base manifests"
+fi
+
 # Deploy each app
 log_step "11.1 Deploying frontend applications..."
 
@@ -36,12 +47,21 @@ for app in "${APPS[@]}"; do
     continue
   fi
   
-  # Apply manifests
-  kubectl apply -f "${APP_DIR}" -n "${NAMESPACE}" || error_exit "Failed to deploy ${app}"
+  if [ ! -d "${OVERLAY_DIR}" ]; then
+    kubectl apply -f "${APP_DIR}" -n "${NAMESPACE}" || error_exit "Failed to deploy ${app}"
+  fi
+
+  IMAGE_NAME="${ACR_NAME}.azurecr.io/${app}:${IMAGE_TAG}"
+  CONTAINER_NAME="${app}"
+
+  log_info "Updating ${app} image to ${IMAGE_NAME}..."
+  kubectl set image deployment/"${app}" \
+    "${CONTAINER_NAME}"="${IMAGE_NAME}" \
+    -n "${NAMESPACE}" || error_exit "Failed to set image for ${app}"
   
   # Wait for deployment
   log_info "Waiting for ${app} deployment..."
-  kubectl wait --for=condition=available \
+  kubectl rollout status \
     deployment/"${app}" \
     -n "${NAMESPACE}" \
     --timeout=300s || log_warning "${app} deployment not ready yet"
@@ -54,6 +74,20 @@ for app in "${APPS[@]}"; do
   else
     log_warning "${app} pods not found"
   fi
+
+  if kubectl get svc "${app}" -n "${NAMESPACE}" &> /dev/null; then
+    PORT="${SERVICE_PORTS[$app]}"
+    if [ -n "${PORT}" ]; then
+      log_info "Testing ${app} health endpoint on port ${PORT}..."
+      kubectl run test-${app}-health \
+        --image=curlimages/curl \
+        --rm -i --restart=Never \
+        -n "${NAMESPACE}" -- \
+        curl -fsS "http://${app}:${PORT}/api/health" >/dev/null && \
+        log_success "${app} health check passed" || \
+        log_warning "${app} health check failed or endpoint not ready"
+    fi
+  fi
 done
 
 # Save state
@@ -62,4 +96,3 @@ save_state "phase11" "complete"
 log_success "=========================================="
 log_success "Phase 11: Frontend Applications - COMPLETE"
 log_success "=========================================="
-