Comment by coding123

Another option, just give prod's creds to CI only.