diff --git a/kustomize/base/frontend/deployment.yaml b/kustomize/base/frontend/deployment.yaml
index 771f078..ab825f0 100644
--- a/kustomize/base/frontend/deployment.yaml
+++ b/kustomize/base/frontend/deployment.yaml
@@ -16,7 +16,7 @@ spec:
         - name: gitea-registry
       containers:
         - name: frontend
-          image: rv32i.pl/trade/trade-frontend:k3s-20260106013603
+          image: rv32i.pl/trade/trade-frontend:sha-8217bae
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
diff --git a/kustomize/overlays/staging/frontend-auth-patch.yaml b/kustomize/overlays/staging/frontend-auth-patch.yaml
new file mode 100644
index 0000000..c7e9deb
--- /dev/null
+++ b/kustomize/overlays/staging/frontend-auth-patch.yaml
@@ -0,0 +1,12 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: trade-frontend
+spec:
+  template:
+    spec:
+      containers:
+        - name: frontend
+          env:
+            - name: BASIC_AUTH_MODE
+              value: "off"
diff --git a/kustomize/overlays/staging/frontend-ingress.yaml b/kustomize/overlays/staging/frontend-ingress.yaml
index b90468a..715d4d1 100644
--- a/kustomize/overlays/staging/frontend-ingress.yaml
+++ b/kustomize/overlays/staging/frontend-ingress.yaml
@@ -5,6 +5,7 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.middlewares: trade-staging-trade-basic-auth@kubernetescrd
 spec:
   ingressClassName: traefik
   tls:
diff --git a/kustomize/overlays/staging/kustomization.yaml b/kustomize/overlays/staging/kustomization.yaml
index 9f23b67..8fa28ec 100644
--- a/kustomize/overlays/staging/kustomization.yaml
+++ b/kustomize/overlays/staging/kustomization.yaml
@@ -6,10 +6,12 @@ namespace: trade-staging
 resources:
   - ../../base
   - pgadmin.yaml
+  - trade-basic-auth-middleware.yaml
   - frontend-ingress.yaml
 
 patchesStrategicMerge:
   - hasura-patch.yaml
+  - frontend-auth-patch.yaml
 
 commonLabels:
   env: staging
diff --git a/kustomize/overlays/staging/trade-basic-auth-middleware.yaml b/kustomize/overlays/staging/trade-basic-auth-middleware.yaml
new file mode 100644
index 0000000..1a4bd76
--- /dev/null
+++ b/kustomize/overlays/staging/trade-basic-auth-middleware.yaml
@@ -0,0 +1,9 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: trade-basic-auth
+spec:
+  basicAuth:
+    secret: trade-basic-auth
+    realm: trade
+    removeHeader: true