diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 1e3b3aa3..7113d1e6 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -56,7 +56,7 @@ def authenticate_if_needed
       return true if Rails.env.test?
       if (is_hidden || is_staging) && !is_api_or_pdf
         authenticate_or_request_with_http_basic do |username, password|
-          username == "samvera" && password == "hyku"
+          username == ENV.fetch("HYKU_DEMO_USER") && password == ENV.fetch("HYKU_DEMO_PASSWORD")
         end
       end
     end
diff --git a/ops/production-deploy.tmpl.yaml b/ops/production-deploy.tmpl.yaml
index e01bcd74..db6bf660 100644
--- a/ops/production-deploy.tmpl.yaml
+++ b/ops/production-deploy.tmpl.yaml
@@ -134,6 +134,10 @@ extraEnvVars: &envVars
     value: iro.bl.uk
   - name: HYKU_SMTP_SETTINGS
     value: '{"from":"openaccess@bl.uk","user_name":"apikey","password":"$SMTP_PASSWORD","address":"smtp.sendgrid.net","domain":"bl.uk","port":"587","authentication":"plain","enable_starttls_auto":true}'
+  - name: HYKU_DEMO_USER
+    value: "bl_hyku_demo_user"
+  - name: HYKU_DEMO_PASSWORD
+    value: $HYKU_DEMO_PASSWORD
   - name: SMTP_ADDRESS
     value: smtp.sendgrid.net
   - name: SMTP_DOMAIN
diff --git a/ops/staging-deploy.tmpl.yaml b/ops/staging-deploy.tmpl.yaml
index 5f57bcf7..51827de7 100644
--- a/ops/staging-deploy.tmpl.yaml
+++ b/ops/staging-deploy.tmpl.yaml
@@ -141,6 +141,10 @@ extraEnvVars: &envVars
     value: "true"
   - name: HYKU_ROOT_HOST
     value: bl-staging.notch8.cloud
+  - name: HYKU_DEMO_USER
+    value: "bl_hyku_demo_user"
+  - name: HYKU_DEMO_PASSWORD
+    value: $HYKU_DEMO_PASSWORD
   - name: S3_DOWNLOADS
     value: "true"
   - name: SMTP_ADDRESS