diff --git a/.github/workflows/sandbox-down.yml b/.github/workflows/sandbox-down.yml
new file mode 100644
index 0000000000..45fe7254d7
--- /dev/null
+++ b/.github/workflows/sandbox-down.yml
@@ -0,0 +1,83 @@
+name: Sandbox Tear-Down
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+      - sandbox
+
+# Share the concurrency group with sandbox-up so they can't run simultaneously.
+concurrency:
+  group: sandbox
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  tear-down:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    if: github.event.pull_request.merged == true
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+
+      - name: Check if sandbox exists
+        id: check
+        run: |
+          STATUS=$(aws elasticbeanstalk describe-environments \
+            --environment-names finishline-sandbox-env \
+            --region us-east-2 \
+            --query "Environments[0].Status" \
+            --output text 2>/dev/null || echo "None")
+
+          if [ "$STATUS" = "None" ] || [ "$STATUS" = "" ] || [ "$STATUS" = "Terminated" ]; then
+            echo "No active sandbox found, nothing to tear down."
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "Sandbox found with status: $STATUS, proceeding with teardown."
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Setup Terraform
+        if: steps.check.outputs.exists == 'true'
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "~1.0"
+          terraform_wrapper: false
+
+      - name: Terraform init
+        if: steps.check.outputs.exists == 'true'
+        working-directory: infrastructure/environments/sandbox
+        run: terraform init
+
+      - name: Terraform destroy
+        if: steps.check.outputs.exists == 'true'
+        working-directory: infrastructure/environments/sandbox
+        env:
+          # Terraform requires all required variables to have values even for destroy.
+          # The actual values are irrelevant since destroy only reads state.
+          TF_VAR_db_master_password: "unused"
+          TF_VAR_session_secret: "unused"
+          TF_VAR_encryption_key: "unused"
+          TF_VAR_google_client_secret: "unused"
+          TF_VAR_drive_refresh_token: "unused"
+          TF_VAR_calendar_refresh_token: "unused"
+          TF_VAR_slack_bot_token: "unused"
+          TF_VAR_slack_token_secret: "unused"
+          TF_VAR_slack_signing_secret: "unused"
+          TF_VAR_notification_endpoint_secret: "unused"
+        run: terraform destroy -auto-approve
+
+      - name: Tag-based cleanup safety net
+        if: steps.check.outputs.exists == 'true'
+        run: bash infrastructure/scripts/cleanup-sandbox.sh
diff --git a/.github/workflows/sandbox-up.yml b/.github/workflows/sandbox-up.yml
new file mode 100644
index 0000000000..7c91a11e42
--- /dev/null
+++ b/.github/workflows/sandbox-up.yml
@@ -0,0 +1,329 @@
+name: Sandbox Spin-Up
+
+on:
+  pull_request:
+    branches:
+      - sandbox
+    types: [opened, synchronize, reopened]
+  workflow_dispatch:
+
+# Only one sandbox may exist at a time.
+concurrency:
+  group: sandbox
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  spin-up:
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    environment: sandbox
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+
+      - name: Fail fast if sandbox already exists
+        run: |
+          STATUS=$(aws elasticbeanstalk describe-environments \
+            --environment-names finishline-sandbox-env \
+            --region us-east-2 \
+            --query "Environments[0].Status" \
+            --output text 2>/dev/null || echo "None")
+
+          if [ "$STATUS" != "None" ] && [ "$STATUS" != "" ] && [ "$STATUS" != "Terminated" ]; then
+            echo "Sandbox already exists with status: $STATUS"
+            echo "Tear it down first with the sandbox-down workflow."
+            exit 1
+          fi
+
+      - name: Take prod RDS snapshot
+        id: snapshot
+        run: |
+          SNAPSHOT_ID="finishline-prod-presandbox-$(date +%Y%m%d%H%M%S)"
+
+          aws rds create-db-snapshot \
+            --db-instance-identifier finishline-production-db \
+            --db-snapshot-identifier "$SNAPSHOT_ID" \
+            --region us-east-1
+
+          echo "Waiting for snapshot to become available (~5 min)..."
+          aws rds wait db-snapshot-available \
+            --db-snapshot-identifier "$SNAPSHOT_ID" \
+            --region us-east-1
+
+          echo "us_east_1_snapshot_id=$SNAPSHOT_ID" >> "$GITHUB_OUTPUT"
+
+      - name: Copy snapshot to us-east-2
+        id: snapshot_copy
+        run: |
+          SOURCE_SNAPSHOT="${{ steps.snapshot.outputs.us_east_1_snapshot_id }}"
+          COPY_ID="${SOURCE_SNAPSHOT}-us-east-2"
+          SOURCE_ARN=$(aws rds describe-db-snapshots \
+            --db-snapshot-identifier "$SOURCE_SNAPSHOT" \
+            --region us-east-1 \
+            --query "DBSnapshots[0].DBSnapshotArn" \
+            --output text)
+
+          aws rds copy-db-snapshot \
+            --source-db-snapshot-identifier "$SOURCE_ARN" \
+            --target-db-snapshot-identifier "$COPY_ID" \
+            --kms-key-id alias/aws/rds \
+            --region us-east-2
+
+          echo "Waiting for snapshot copy to become available (~5 min)..."
+          aws rds wait db-snapshot-available \
+            --db-snapshot-identifier "$COPY_ID" \
+            --region us-east-2
+
+          echo "snapshot_id=$COPY_ID" >> "$GITHUB_OUTPUT"
+
+      - name: Pull prod secrets from Secrets Manager
+        run: |
+          fetch() {
+            aws secretsmanager get-secret-value \
+              --secret-id "finishline/production/$1" \
+              --region us-east-1 \
+              --query SecretString \
+              --output text
+          }
+
+          SESSION_SECRET=$(fetch session-secret)
+          ENCRYPTION_KEY=$(fetch encryption-key)
+          GOOGLE_CLIENT_SECRET=$(fetch google-client-secret)
+          DRIVE_REFRESH_TOKEN=$(fetch drive-refresh-token)
+          CALENDAR_REFRESH_TOKEN=$(fetch calendar-refresh-token)
+          SLACK_BOT_TOKEN=$(fetch slack-bot-token)
+          SLACK_SIGNING_SECRET=$(fetch slack-signing-secret)
+          NOTIFICATION_ENDPOINT_SECRET=$(fetch notification-endpoint-secret)
+
+          echo "::add-mask::$SESSION_SECRET"
+          echo "::add-mask::$ENCRYPTION_KEY"
+          echo "::add-mask::$GOOGLE_CLIENT_SECRET"
+          echo "::add-mask::$DRIVE_REFRESH_TOKEN"
+          echo "::add-mask::$CALENDAR_REFRESH_TOKEN"
+          echo "::add-mask::$SLACK_BOT_TOKEN"
+          echo "::add-mask::$SLACK_SIGNING_SECRET"
+          echo "::add-mask::$NOTIFICATION_ENDPOINT_SECRET"
+
+          {
+            echo "TF_VAR_session_secret=$SESSION_SECRET"
+            echo "TF_VAR_encryption_key=$ENCRYPTION_KEY"
+            echo "TF_VAR_google_client_secret=$GOOGLE_CLIENT_SECRET"
+            echo "TF_VAR_drive_refresh_token=$DRIVE_REFRESH_TOKEN"
+            echo "TF_VAR_calendar_refresh_token=$CALENDAR_REFRESH_TOKEN"
+            echo "TF_VAR_slack_bot_token=$SLACK_BOT_TOKEN"
+            echo "TF_VAR_slack_signing_secret=$SLACK_SIGNING_SECRET"
+            echo "TF_VAR_notification_endpoint_secret=$NOTIFICATION_ENDPOINT_SECRET"
+          } >> "$GITHUB_ENV"
+
+      - name: Pull non-secret config from prod EB environment
+        run: |
+          eb_var() {
+            aws elasticbeanstalk describe-configuration-settings \
+              --application-name finishline-production \
+              --environment-name finishline-production-env \
+              --region us-east-1 \
+              --query "ConfigurationSettings[0].OptionSettings[?Namespace=='aws:elasticbeanstalk:application:environment'&&OptionName=='$1'].Value" \
+              --output text
+          }
+
+          SLACK_TOKEN_SECRET=$(eb_var SLACK_TOKEN_SECRET)
+          echo "::add-mask::$SLACK_TOKEN_SECRET"
+
+          {
+            echo "TF_VAR_slack_token_secret=$SLACK_TOKEN_SECRET"
+            echo "TF_VAR_google_client_id=$(eb_var GOOGLE_CLIENT_ID)"
+            echo "TF_VAR_google_drive_folder_id=$(eb_var GOOGLE_DRIVE_FOLDER_ID)"
+            echo "TF_VAR_slack_id=$(eb_var SLACK_ID)"
+            echo "TF_VAR_user_email=$(eb_var USER_EMAIL)"
+            echo "TF_VAR_admin_user_id=$(eb_var ADMIN_USER_ID)"
+          } >> "$GITHUB_ENV"
+
+      - name: Generate sandbox DB password
+        run: |
+          DB_PASSWORD=$(openssl rand -base64 24 | tr -d "=+/")
+          echo "::add-mask::$DB_PASSWORD"
+          echo "TF_VAR_db_master_password=$DB_PASSWORD" >> "$GITHUB_ENV"
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "~1.0"
+          terraform_wrapper: false
+
+      - name: Terraform init
+        working-directory: infrastructure/environments/sandbox
+        run: terraform init
+
+      - name: Terraform apply
+        working-directory: infrastructure/environments/sandbox
+        env:
+          TF_VAR_snapshot_identifier: ${{ steps.snapshot_copy.outputs.snapshot_id }}
+        run: terraform apply -auto-approve
+
+      - name: Wait for Amplify custom domain to become active
+        working-directory: infrastructure/environments/sandbox
+        run: |
+          APP_ID=$(terraform output -raw amplify_app_id)
+          DOMAIN="qa.finishlinebyner.com"
+
+          # finishlinebyner.com's hosted zone is in this same AWS account, so Amplify
+          # automatically creates and manages the cert-verification and subdomain
+          # routing DNS records itself — no manual Route53 writes needed here.
+          echo "Waiting for Amplify domain to become active..."
+          while true; do
+            STATUS=$(aws amplify get-domain-association \
+              --app-id "$APP_ID" \
+              --domain-name "$DOMAIN" \
+              --region us-east-2 \
+              --query "domainAssociation.domainStatus" \
+              --output text)
+            echo "  domain status: $STATUS"
+            case "$STATUS" in
+              AVAILABLE) echo "Domain is active."; break ;;
+              FAILED) echo "Domain verification failed."; exit 1 ;;
+              *) sleep 30 ;;
+            esac
+          done
+
+      - name: Build and deploy frontend to Amplify
+        working-directory: infrastructure/environments/sandbox
+        run: |
+          APP_ID=$(terraform output -raw amplify_app_id)
+
+          # Install deps and build
+          cd "$GITHUB_WORKSPACE"
+          yarn install --frozen-lockfile
+          yarn workspace shared build
+
+          # Set Vite env vars required at build time
+          # Must use the custom domain, not the raw EB CNAME: the backend's
+          # cert only matches qa.api.finishlinebyner.com.
+          export VITE_REACT_APP_BACKEND_URL=$(cd infrastructure/environments/sandbox && terraform output -raw backend_url)
+          export VITE_REACT_APP_GOOGLE_AUTH_CLIENT_ID="$TF_VAR_google_client_id"
+
+          yarn workspace frontend build
+
+          # Zip the built artifacts (files at root, not nested)
+          cd src/frontend/dist
+          zip -r /tmp/frontend.zip .
+          cd "$GITHUB_WORKSPACE"
+
+          # Create a manual deployment slot and get the upload URL
+          DEPLOY=$(aws amplify create-deployment \
+            --app-id "$APP_ID" \
+            --branch-name develop \
+            --region us-east-2)
+          JOB_ID=$(echo "$DEPLOY" | jq -r '.jobId')
+          UPLOAD_URL=$(echo "$DEPLOY" | jq -r '.zipUploadUrl')
+
+          # Upload the artifact
+          curl -X PUT "$UPLOAD_URL" \
+            -H "Content-Type: application/zip" \
+            --data-binary @/tmp/frontend.zip
+
+          # Start the deployment
+          aws amplify start-deployment \
+            --app-id "$APP_ID" \
+            --branch-name develop \
+            --job-id "$JOB_ID" \
+            --region us-east-2
+
+          echo "Waiting for Amplify deployment..."
+          while true; do
+            STATUS=$(aws amplify get-job \
+              --app-id "$APP_ID" \
+              --branch-name develop \
+              --job-id "$JOB_ID" \
+              --region us-east-2 \
+              --query "job.summary.status" \
+              --output text)
+            echo "  status: $STATUS"
+            case "$STATUS" in
+              SUCCEED) echo "Frontend deployed."; break ;;
+              FAILED|CANCELLED) echo "Amplify deployment $STATUS."; exit 1 ;;
+              *) sleep 30 ;;
+            esac
+          done
+
+      - name: Get sandbox URLs
+        id: urls
+        working-directory: infrastructure/environments/sandbox
+        run: |
+          echo "eb_url=$(terraform output -raw eb_environment_url)" >> "$GITHUB_OUTPUT"
+          echo "eb_cname=$(terraform output -raw eb_cname)" >> "$GITHUB_OUTPUT"
+          echo "frontend_url=$(terraform output -raw frontend_url)" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push candidate image to prod ECR repo
+        run: |
+          ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+          ECR_REGISTRY="${ACCOUNT_ID}.dkr.ecr.us-east-1.amazonaws.com"
+
+          aws ecr get-login-password --region us-east-1 | \
+            docker login --username AWS --password-stdin "$ECR_REGISTRY"
+          ECR_REPOSITORY="finishline-production"
+
+          # Build from this branch and push to the SAME prod ECR repo (no separate
+          # sandbox repo — ECR has no concept of environments) under a distinct tag,
+          # so sandbox tests the exact image that would be promoted to prod, rather
+          # than whatever was last actually deployed to prod.
+          SANDBOX_IMAGE_TAG="sandbox-${{ github.sha }}"
+          docker build --tag "$ECR_REGISTRY/$ECR_REPOSITORY:$SANDBOX_IMAGE_TAG" .
+          docker push "$ECR_REGISTRY/$ECR_REPOSITORY:$SANDBOX_IMAGE_TAG"
+
+          echo "SANDBOX_IMAGE_TAG=$SANDBOX_IMAGE_TAG" >> "$GITHUB_ENV"
+          echo "ECR_REGISTRY=$ECR_REGISTRY" >> "$GITHUB_ENV"
+          echo "ECR_REPOSITORY=$ECR_REPOSITORY" >> "$GITHUB_ENV"
+
+      - name: Deploy app to sandbox EB
+        run: |
+          cat > Dockerrun.aws.json <<EOF
+          {
+            "AWSEBDockerrunVersion": "1",
+            "Image": {
+              "Name": "$ECR_REGISTRY/$ECR_REPOSITORY:$SANDBOX_IMAGE_TAG",
+              "Update": "true"
+            },
+            "Ports": [
+              {
+                "ContainerPort": 3001,
+                "HostPort": 3001
+              }
+            ]
+          }
+          EOF
+
+          zip -r deploy.zip Dockerrun.aws.json .ebextensions/ .ebignore
+
+      - name: Deploy to sandbox Elastic Beanstalk
+        uses: einaregilsson/beanstalk-deploy@v21
+        with:
+          aws_access_key: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws_secret_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          application_name: finishline-sandbox
+          environment_name: finishline-sandbox-env
+          version_label: "sandbox-${{ github.run_id }}"
+          region: us-east-2
+          deployment_package: deploy.zip
+          wait_for_deployment: true
+          wait_for_environment_recovery: 300
+
+      - name: Sandbox is ready
+        run: |
+          echo "Sandbox is up!"
+          echo ""
+          echo "Frontend: https://qa.finishlinebyner.com"
+          echo "Backend:  ${{ steps.urls.outputs.eb_url }}"
+          echo ""
+          echo "Register https://qa.finishlinebyner.com in Google OAuth once, then it works on every spin-up."
diff --git a/infrastructure/bootstrap/main.tf b/infrastructure/bootstrap/main.tf
index a482c9645e..17b0372bf3 100644
--- a/infrastructure/bootstrap/main.tf
+++ b/infrastructure/bootstrap/main.tf
@@ -9,6 +9,7 @@
 # 1. S3 bucket for Terraform state storage
 # 2. DynamoDB table for state locking
 # 3. S3 bucket for Elastic Beanstalk application versions
+# 4. IAM permissions for the github-actions-finishline CI/CD user
 
 terraform {
   required_version = ">= 1.0"
@@ -32,9 +33,9 @@ provider "aws" {
 
   default_tags {
     tags = {
-      Project     = "finishline"
-      ManagedBy   = "Terraform"
-      Purpose     = "Bootstrap"
+      Project   = "finishline"
+      ManagedBy = "Terraform"
+      Purpose   = "Bootstrap"
     }
   }
 }
@@ -55,7 +56,6 @@ resource "aws_s3_bucket" "terraform_state" {
   }
 }
 
-# Versioning for state file history and recovery
 resource "aws_s3_bucket_versioning" "terraform_state" {
   bucket = aws_s3_bucket.terraform_state.id
 
@@ -64,7 +64,6 @@ resource "aws_s3_bucket_versioning" "terraform_state" {
   }
 }
 
-# Server-side encryption for state files
 resource "aws_s3_bucket_server_side_encryption_configuration" "terraform_state" {
   bucket = aws_s3_bucket.terraform_state.id
 
@@ -75,7 +74,6 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "terraform_state"
   }
 }
 
-# Block all public access to state bucket
 resource "aws_s3_bucket_public_access_block" "terraform_state" {
   bucket = aws_s3_bucket.terraform_state.id
 
@@ -85,7 +83,6 @@ resource "aws_s3_bucket_public_access_block" "terraform_state" {
   restrict_public_buckets = true
 }
 
-# Delete old versions of state files after 90 days
 resource "aws_s3_bucket_lifecycle_configuration" "terraform_state" {
   bucket = aws_s3_bucket.terraform_state.id
 
@@ -106,7 +103,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "terraform_state" {
 #############
 resource "aws_dynamodb_table" "terraform_locks" {
   name         = var.locks_table_name
-  billing_mode = "PAY_PER_REQUEST"  # On-demand pricing, no minimum cost
+  billing_mode = "PAY_PER_REQUEST"
   hash_key     = "LockID"
 
   attribute {
@@ -136,7 +133,6 @@ resource "aws_s3_bucket" "eb_versions" {
   }
 }
 
-# Enable versioning for EB application versions
 resource "aws_s3_bucket_versioning" "eb_versions" {
   bucket = aws_s3_bucket.eb_versions.id
 
@@ -145,7 +141,6 @@ resource "aws_s3_bucket_versioning" "eb_versions" {
   }
 }
 
-# Block public access to EB versions bucket
 resource "aws_s3_bucket_public_access_block" "eb_versions" {
   bucket = aws_s3_bucket.eb_versions.id
 
@@ -155,7 +150,6 @@ resource "aws_s3_bucket_public_access_block" "eb_versions" {
   restrict_public_buckets = true
 }
 
-# Clean up old EB versions after 90 days
 resource "aws_s3_bucket_lifecycle_configuration" "eb_versions" {
   bucket = aws_s3_bucket.eb_versions.id
 
@@ -166,7 +160,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "eb_versions" {
     filter {}
 
     expiration {
-      days = 90 
+      days = 90
     }
 
     noncurrent_version_expiration {
@@ -174,3 +168,143 @@ resource "aws_s3_bucket_lifecycle_configuration" "eb_versions" {
     }
   }
 }
+
+#############
+# IAM Permissions for github-actions-finishline
+# The user was created manually outside of Terraform.
+# Managed policies cover provisioning sandbox resources via Terraform.
+# The inline policy covers sandbox-workflow-specific operations.
+#############
+
+locals {
+  github_actions_user = "github-actions-finishline"
+  managed_policies = {
+    ec2        = "arn:aws:iam::aws:policy/AmazonEC2FullAccess"
+    rds        = "arn:aws:iam::aws:policy/AmazonRDSFullAccess"
+    iam        = "arn:aws:iam::aws:policy/IAMFullAccess"
+    eb         = "arn:aws:iam::aws:policy/AdministratorAccess-AWSElasticBeanstalk"
+    s3         = "arn:aws:iam::aws:policy/AmazonS3FullAccess"
+    cloudwatch = "arn:aws:iam::aws:policy/CloudWatchFullAccess"
+    amplify    = "arn:aws:iam::aws:policy/AdministratorAccess-Amplify"
+    logs       = "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
+  }
+}
+
+resource "aws_iam_user_policy_attachment" "github_actions_managed" {
+  for_each   = local.managed_policies
+  user       = local.github_actions_user
+  policy_arn = each.value
+}
+
+resource "aws_iam_user_policy" "github_actions_sandbox" {
+  name = "sandbox-workflow-permissions"
+  user = local.github_actions_user
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid    = "TerraformStateS3"
+        Effect = "Allow"
+        Action = [
+          "s3:GetObject",
+          "s3:PutObject",
+          "s3:DeleteObject",
+          "s3:ListBucket"
+        ]
+        Resource = [
+          "arn:aws:s3:::finishline-terraform-state",
+          "arn:aws:s3:::finishline-terraform-state/*"
+        ]
+      },
+      {
+        Sid    = "TerraformStateDynamoDB"
+        Effect = "Allow"
+        Action = [
+          "dynamodb:GetItem",
+          "dynamodb:PutItem",
+          "dynamodb:DeleteItem"
+        ]
+        Resource = "arn:aws:dynamodb:us-east-1:830877454256:table/finishline-terraform-locks"
+      },
+      {
+        Sid    = "RDSSnapshotOperations"
+        Effect = "Allow"
+        Action = [
+          "rds:CreateDBSnapshot",
+          "rds:DescribeDBSnapshots",
+          "rds:CopyDBSnapshot",
+          "rds:DeleteDBSnapshot",
+          "rds:ListTagsForResource",
+          "rds:AddTagsToResource"
+        ]
+        Resource = "*"
+      },
+      {
+        Sid    = "KMSForSnapshotCopy"
+        Effect = "Allow"
+        Action = [
+          "kms:CreateGrant",
+          "kms:DescribeKey",
+          "kms:GenerateDataKey",
+          "kms:Decrypt",
+          "kms:ReEncryptFrom",
+          "kms:ReEncryptTo"
+        ]
+        Resource = "*"
+        Condition = {
+          StringLike = {
+            "kms:ViaService" = [
+              "rds.us-east-1.amazonaws.com",
+              "rds.us-east-2.amazonaws.com"
+            ]
+          }
+        }
+      },
+      {
+        Sid    = "SecretsManagerReadProd"
+        Effect = "Allow"
+        Action = [
+          "secretsmanager:GetSecretValue",
+          "secretsmanager:DescribeSecret"
+        ]
+        Resource = "arn:aws:secretsmanager:us-east-1:830877454256:secret:finishline/production/*"
+      },
+      {
+        Sid    = "ElasticBeanstalkDescribeProd"
+        Effect = "Allow"
+        Action = [
+          "elasticbeanstalk:DescribeConfigurationSettings",
+          "elasticbeanstalk:DescribeEnvironments"
+        ]
+        Resource = "*"
+      },
+      {
+        Sid    = "Route53SandboxDNS"
+        Effect = "Allow"
+        Action = [
+          "route53:ChangeResourceRecordSets",
+          "route53:ListHostedZonesByName",
+          "route53:ListHostedZones",
+          "route53:GetHostedZone",
+          "route53:GetChange",
+          "route53:ListTagsForResource"
+        ]
+        Resource = "*"
+      },
+      {
+        Sid    = "ACMSandboxCerts"
+        Effect = "Allow"
+        Action = [
+          "acm:RequestCertificate",
+          "acm:DeleteCertificate",
+          "acm:AddTagsToResource",
+          "acm:RemoveTagsFromResource",
+          "acm:AddTagsToCertificate",
+          "acm:RemoveTagsFromCertificate"
+        ]
+        Resource = "*"
+      }
+    ]
+  })
+}
diff --git a/infrastructure/bootstrap/outputs.tf b/infrastructure/bootstrap/outputs.tf
index 3cf708b582..170bd66ea9 100644
--- a/infrastructure/bootstrap/outputs.tf
+++ b/infrastructure/bootstrap/outputs.tf
@@ -34,19 +34,19 @@ output "next_steps" {
   description = "Instructions for next steps"
   value       = <<-EOT
     Bootstrap Complete!
-    
+
     The following resources have been created:
     - S3 Bucket for Terraform State: ${aws_s3_bucket.terraform_state.id}
     - DynamoDB Table for State Locking: ${aws_dynamodb_table.terraform_locks.id}
     - S3 Bucket for EB Versions: ${aws_s3_bucket.eb_versions.id}
-    
+
     Next Steps:
     1. The backend configuration in ../backend.tf is already configured to use these resources
     2. Navigate to your environment directory: cd ../environments/production
     3. Initialize Terraform: terraform init
     4. Review the plan: terraform plan
     5. Apply the infrastructure: terraform apply
-    
+
     Note: Keep this bootstrap state file safe! It's stored locally in this directory.
   EOT
 }
diff --git a/infrastructure/bootstrap/variables.tf b/infrastructure/bootstrap/variables.tf
index da098bc007..d8465ccb18 100644
--- a/infrastructure/bootstrap/variables.tf
+++ b/infrastructure/bootstrap/variables.tf
@@ -23,3 +23,4 @@ variable "eb_versions_bucket_name" {
   type        = string
   default     = "finishline-eb-versions"
 }
+
diff --git a/infrastructure/environments/sandbox/.terraform.lock.hcl b/infrastructure/environments/sandbox/.terraform.lock.hcl
new file mode 100644
index 0000000000..cdc1668d41
--- /dev/null
+++ b/infrastructure/environments/sandbox/.terraform.lock.hcl
@@ -0,0 +1,25 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "5.100.0"
+  constraints = "~> 5.0"
+  hashes = [
+    "h1:Ijt7pOlB7Tr7maGQIqtsLFbl7pSMIj06TVdkoSBcYOw=",
+    "zh:054b8dd49f0549c9a7cc27d159e45327b7b65cf404da5e5a20da154b90b8a644",
+    "zh:0b97bf8d5e03d15d83cc40b0530a1f84b459354939ba6f135a0086c20ebbe6b2",
+    "zh:1589a2266af699cbd5d80737a0fe02e54ec9cf2ca54e7e00ac51c7359056f274",
+    "zh:6330766f1d85f01ae6ea90d1b214b8b74cc8c1badc4696b165b36ddd4cc15f7b",
+    "zh:7c8c2e30d8e55291b86fcb64bdf6c25489d538688545eb48fd74ad622e5d3862",
+    "zh:99b1003bd9bd32ee323544da897148f46a527f622dc3971af63ea3e251596342",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:9f8b909d3ec50ade83c8062290378b1ec553edef6a447c56dadc01a99f4eaa93",
+    "zh:aaef921ff9aabaf8b1869a86d692ebd24fbd4e12c21205034bb679b9caf883a2",
+    "zh:ac882313207aba00dd5a76dbd572a0ddc818bb9cbf5c9d61b28fe30efaec951e",
+    "zh:bb64e8aff37becab373a1a0cc1080990785304141af42ed6aa3dd4913b000421",
+    "zh:dfe495f6621df5540d9c92ad40b8067376350b005c637ea6efac5dc15028add4",
+    "zh:f0ddf0eaf052766cfe09dea8200a946519f653c384ab4336e2a4a64fdd6310e9",
+    "zh:f1b7e684f4c7ae1eed272b6de7d2049bb87a0275cb04dbb7cda6636f600699c9",
+    "zh:ff461571e3f233699bf690db319dfe46aec75e58726636a0d97dd9ac6e32fb70",
+  ]
+}
diff --git a/infrastructure/environments/sandbox/main.tf b/infrastructure/environments/sandbox/main.tf
new file mode 100644
index 0000000000..7f0afc60dd
--- /dev/null
+++ b/infrastructure/environments/sandbox/main.tf
@@ -0,0 +1,205 @@
+# Sandbox Environment - Main Configuration
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+
+  backend "s3" {
+    bucket         = "finishline-terraform-state"
+    key            = "sandbox/terraform.tfstate"
+    region         = "us-east-1"
+    encrypt        = true
+    dynamodb_table = "finishline-terraform-locks"
+  }
+}
+
+provider "aws" {
+  region = "us-east-2"
+
+  default_tags {
+    tags = {
+      Project     = "finishline"
+      Environment = "sandbox"
+      ManagedBy   = "Terraform"
+    }
+  }
+}
+
+#############
+# Network Module
+#############
+module "network" {
+  source = "../../modules/network"
+
+  project_name = "finishline"
+  environment  = "sandbox"
+  aws_region   = "us-east-2"
+  vpc_cidr     = "10.1.0.0/16"
+}
+
+#############
+# IAM Module
+#############
+module "iam" {
+  source = "../../modules/iam"
+
+  project_name          = "finishline"
+  environment           = "sandbox"
+  aws_region            = "us-east-2"
+  create_cloudfront_oai = false
+}
+
+#############
+# RDS Module
+#############
+module "rds" {
+  source = "../../modules/rds"
+
+  project_name = "finishline"
+  environment  = "sandbox"
+
+  # Network
+  db_subnet_group_name = module.network.db_subnet_group_name
+  security_group_id    = module.network.rds_security_group_id
+
+  # Instance config - downsized for sandbox
+  instance_class    = "db.t3.micro"
+  allocated_storage = 20
+
+  # Sandbox-specific: no backups, no deletion protection, no final snapshot
+  backup_retention_period = 0
+  deletion_protection     = false
+  skip_final_snapshot     = true
+  alarm_actions           = []
+
+  # Restore from a prod snapshot when provided (passed in by CI/CD pipeline)
+  snapshot_identifier     = var.snapshot_identifier
+
+  # Credentials
+  database_name   = "finishline"
+  master_username = "finishline"
+  master_password = var.db_master_password
+}
+
+#############
+# Backend domain (fixed CNAME prefix so the ACM cert's validation record and
+# Route53 CNAME can be created before the EB environment exists, avoiding a
+# dependency cycle between module.dns and module.elasticbeanstalk)
+#############
+locals {
+  eb_cname_prefix = "finishline-sandbox"
+  eb_cname        = "${local.eb_cname_prefix}.us-east-2.elasticbeanstalk.com"
+  backend_domain  = "qa.api.finishlinebyner.com"
+}
+
+#############
+# DNS Module (backend HTTPS cert + Route53 record)
+#############
+module "dns" {
+  source = "../../modules/dns"
+
+  project_name     = "finishline"
+  environment      = "sandbox"
+  hosted_zone_name = "finishlinebyner.com"
+  frontend_domain  = "qa.finishlinebyner.com"
+  backend_domain   = local.backend_domain
+  backend_cname    = local.eb_cname
+}
+
+#############
+# Elastic Beanstalk Module
+#############
+module "elasticbeanstalk" {
+  source = "../../modules/elasticbeanstalk"
+
+  project_name = "finishline"
+  environment  = "sandbox"
+  vpc_id       = module.network.vpc_id
+  subnet_ids   = module.network.public_subnet_ids
+  elb_subnet_ids = module.network.public_subnet_ids
+
+  # IAM
+  instance_profile_name = module.iam.eb_ec2_instance_profile_name
+  eb_service_role_name  = module.iam.eb_service_role_name
+  eb_service_role_arn   = module.iam.eb_service_role_arn
+
+  # Security
+  instance_security_group_id = module.network.eb_instance_security_group_id
+  alb_security_group_id      = module.network.alb_security_group_id
+
+  # Sandbox-specific: single instance, fast deploys
+  min_instance_count  = 1
+  max_instance_count  = 1
+  deployment_policy   = "AllAtOnce"
+  cname_prefix        = local.eb_cname_prefix
+  enable_https        = true
+  ssl_certificate_arn = module.dns.backend_certificate_arn
+  health_check_path   = "/health"
+  log_retention_days  = 7
+  ec2_key_name        = "finishline-sandbox"
+
+  environment_variables = {
+    DATABASE_URL = module.rds.database_url
+
+    SESSION_SECRET               = var.session_secret
+    ENCRYPTION_KEY               = var.encryption_key
+    GOOGLE_CLIENT_SECRET         = var.google_client_secret
+    DRIVE_REFRESH_TOKEN          = var.drive_refresh_token
+    CALENDAR_REFRESH_TOKEN       = var.calendar_refresh_token
+    SLACK_BOT_TOKEN              = var.slack_bot_token
+    SLACK_TOKEN_SECRET           = var.slack_token_secret
+    SLACK_SIGNING_SECRET         = var.slack_signing_secret
+    NOTIFICATION_ENDPOINT_SECRET = var.notification_endpoint_secret
+
+    NODE_ENV                             = "sandbox"
+    LOG_LEVEL                            = "info"
+    GOOGLE_CLIENT_ID                     = var.google_client_id
+    REACT_APP_GOOGLE_AUTH_CLIENT_ID      = var.google_client_id
+    GOOGLE_DRIVE_FOLDER_ID               = var.google_drive_folder_id
+    SLACK_ID                             = var.slack_id
+    USER_EMAIL                           = var.user_email
+    ADMIN_USER_ID                        = var.admin_user_id
+  }
+}
+
+#############
+# Amplify Frontend Module
+#############
+module "frontend" {
+  source = "../../modules/amplify-frontend"
+
+  project_name     = "finishline"
+  environment      = "sandbox"
+  main_branch_name = "develop"
+  backend_api_url  = module.dns.backend_url
+
+  domain_name                  = "qa.finishlinebyner.com"
+  enable_pull_request_preview  = false
+  enable_auto_branch_creation  = false
+  create_webhook               = false
+  # The workflow polls for domain ACTIVE status after applying DNS records
+  wait_for_domain_verification = false
+}
+
+# Route53 hosted zone for finishlinebyner.com
+data "aws_route53_zone" "main" {
+  name         = "finishlinebyner.com"
+  private_zone = false
+}
+
+#############
+# CloudWatch Log Group (skip full monitoring module — no dashboards or alarms needed for sandbox)
+#############
+resource "aws_cloudwatch_log_group" "eb_logs" {
+  name              = "/aws/elasticbeanstalk/finishline-sandbox"
+  retention_in_days = 7
+
+  tags = {
+    Name = "finishline-sandbox-eb-logs"
+  }
+}
\ No newline at end of file
diff --git a/infrastructure/environments/sandbox/outputs.tf b/infrastructure/environments/sandbox/outputs.tf
new file mode 100644
index 0000000000..4be2d815a0
--- /dev/null
+++ b/infrastructure/environments/sandbox/outputs.tf
@@ -0,0 +1,64 @@
+# Sandbox Environment Outputs
+# These are consumed by the CI/CD pipeline after terraform apply.
+
+#####################
+# Network Outputs
+#####################
+
+output "vpc_id" {
+  description = "VPC ID"
+  value       = module.network.vpc_id
+}
+
+#####################
+# RDS Outputs
+#####################
+
+output "rds_endpoint" {
+  description = "RDS endpoint (host:port)"
+  value       = module.rds.db_instance_endpoint
+}
+
+output "rds_address" {
+  description = "RDS hostname"
+  value       = module.rds.db_instance_address
+}
+
+output "database_url" {
+  description = "Full database connection URL (used by CI/CD to write the sandbox DATABASE_URL secret)"
+  value       = module.rds.database_url
+  sensitive   = true
+}
+
+#####################
+# Elastic Beanstalk Outputs
+#####################
+
+output "eb_environment_url" {
+  description = "URL of the sandbox EB environment (used by Amplify to point the frontend at the sandbox backend)"
+  value       = module.elasticbeanstalk.environment_endpoint_url
+}
+
+output "backend_url" {
+  description = "HTTPS custom-domain URL for the sandbox backend (what the frontend should call; the EB environment's cert only matches this domain, not the raw EB CNAME)"
+  value       = module.dns.backend_url
+}
+
+output "eb_cname" {
+  description = "Raw CNAME of the sandbox EB environment"
+  value       = module.elasticbeanstalk.environment_cname
+}
+
+#####################
+# Frontend Outputs
+#####################
+
+output "frontend_url" {
+  description = "URL of the sandbox Amplify frontend"
+  value       = module.frontend.frontend_url
+}
+
+output "amplify_app_id" {
+  description = "Amplify app ID (used to trigger manual builds)"
+  value       = module.frontend.amplify_app_id
+}
diff --git a/infrastructure/environments/sandbox/variables.tf b/infrastructure/environments/sandbox/variables.tf
new file mode 100644
index 0000000000..e94825e996
--- /dev/null
+++ b/infrastructure/environments/sandbox/variables.tf
@@ -0,0 +1,114 @@
+# Sandbox Environment Variables
+# Most sandbox config is hardcoded (us-east-2, single instance, etc.)
+# Only values that the CI/CD pipeline injects at runtime are variables.
+
+#####################
+# RDS Variables
+#####################
+
+variable "db_master_password" {
+  description = "Master password for the sandbox database"
+  type        = string
+  sensitive   = true
+  # Set via: export TF_VAR_db_master_password="..."
+  # In CI/CD: generated once and stored in GitHub Actions secrets
+}
+
+variable "snapshot_identifier" {
+  description = "RDS snapshot ID to restore from (taken from prod by the CI/CD pipeline before spin-up)"
+  type        = string
+  default     = null
+  # When null, a fresh empty database is created instead
+}
+
+#####################
+# Secrets (injected by CI/CD from prod Secrets Manager at pipeline run time)
+#####################
+
+variable "session_secret" {
+  description = "Secret key for application session management"
+  type        = string
+  sensitive   = true
+}
+
+variable "encryption_key" {
+  description = "Application encryption key"
+  type        = string
+  sensitive   = true
+}
+
+variable "google_client_secret" {
+  description = "Google OAuth client secret"
+  type        = string
+  sensitive   = true
+}
+
+variable "drive_refresh_token" {
+  description = "Google Drive refresh token"
+  type        = string
+  sensitive   = true
+}
+
+variable "calendar_refresh_token" {
+  description = "Google Calendar refresh token"
+  type        = string
+  sensitive   = true
+}
+
+variable "slack_bot_token" {
+  description = "Slack bot token"
+  type        = string
+  sensitive   = true
+}
+
+variable "slack_token_secret" {
+  description = "Slack OAuth token secret"
+  type        = string
+  sensitive   = true
+}
+
+variable "slack_signing_secret" {
+  description = "Slack signing secret for request verification"
+  type        = string
+  sensitive   = true
+}
+
+variable "notification_endpoint_secret" {
+  description = "Secret for notification endpoint authentication"
+  type        = string
+  sensitive   = true
+}
+
+#####################
+# Non-secret application config
+#####################
+
+variable "google_client_id" {
+  description = "Google OAuth client ID (public)"
+  type        = string
+  default     = ""
+}
+
+variable "google_drive_folder_id" {
+  description = "Google Drive folder ID"
+  type        = string
+  default     = ""
+}
+
+variable "slack_id" {
+  description = "Slack app ID"
+  type        = string
+  default     = ""
+}
+
+variable "user_email" {
+  description = "Primary email address"
+  type        = string
+  default     = ""
+}
+
+variable "admin_user_id" {
+  description = "Admin user ID"
+  type        = string
+  default     = ""
+}
diff --git a/infrastructure/modules/amplify-frontend/main.tf b/infrastructure/modules/amplify-frontend/main.tf
index 446aa8608d..18ac62f6ba 100644
--- a/infrastructure/modules/amplify-frontend/main.tf
+++ b/infrastructure/modules/amplify-frontend/main.tf
@@ -4,11 +4,7 @@
 # Amplify App
 #############
 resource "aws_amplify_app" "frontend" {
-  name       = "${var.project_name}-${var.environment}-frontend"
-  repository = var.github_repository
-
-  # GitHub access token for repository access
-  access_token = var.github_access_token
+  name = "${var.project_name}-${var.environment}-frontend"
 
   # Build specification
   build_spec = <<-EOT
@@ -122,7 +118,7 @@ resource "aws_amplify_domain_association" "main" {
   domain_name = var.domain_name
 
   # Wait for DNS propagation
-  wait_for_verification = true
+  wait_for_verification = var.wait_for_domain_verification
 
   # Main branch subdomain configuration
   sub_domain {
diff --git a/infrastructure/modules/amplify-frontend/outputs.tf b/infrastructure/modules/amplify-frontend/outputs.tf
index 4d89b6c8b9..4b7dab8fc5 100644
--- a/infrastructure/modules/amplify-frontend/outputs.tf
+++ b/infrastructure/modules/amplify-frontend/outputs.tf
@@ -36,5 +36,15 @@ output "webhook_url" {
   sensitive   = true
 }
 
+output "certificate_verification_dns_record" {
+  description = "DNS record string Amplify needs added to Route53 for certificate verification"
+  value       = var.domain_name != "" ? aws_amplify_domain_association.main[0].certificate_verification_dns_record : null
+}
+
+output "subdomain_dns_record" {
+  description = "DNS record string Amplify needs added to Route53 to route the custom domain"
+  value       = var.domain_name != "" ? tolist(aws_amplify_domain_association.main[0].sub_domain)[0].dns_record : null
+}
+
 # Data source to get current region
 data "aws_region" "current" {}
diff --git a/infrastructure/modules/amplify-frontend/variables.tf b/infrastructure/modules/amplify-frontend/variables.tf
index f4abff0d35..b1112a9c5b 100644
--- a/infrastructure/modules/amplify-frontend/variables.tf
+++ b/infrastructure/modules/amplify-frontend/variables.tf
@@ -10,16 +10,6 @@ variable "environment" {
   type        = string
 }
 
-variable "github_repository" {
-  description = "GitHub repository URL (e.g., https://github.com/username/repo)"
-  type        = string
-}
-
-variable "github_access_token" {
-  description = "GitHub personal access token for repository access"
-  type        = string
-  sensitive   = true
-}
 
 variable "main_branch_name" {
   description = "Name of the main branch to deploy"
@@ -79,3 +69,9 @@ variable "create_webhook" {
   type        = bool
   default     = false
 }
+
+variable "wait_for_domain_verification" {
+  description = "Whether Terraform should block until Amplify domain verification completes. Set false for sandbox where the workflow handles the wait."
+  type        = bool
+  default     = true
+}
diff --git a/infrastructure/modules/elasticbeanstalk/main.tf b/infrastructure/modules/elasticbeanstalk/main.tf
index de90607115..8c24e9255e 100644
--- a/infrastructure/modules/elasticbeanstalk/main.tf
+++ b/infrastructure/modules/elasticbeanstalk/main.tf
@@ -1,5 +1,10 @@
 # Elastic Beanstalk Module
 
+data "aws_elastic_beanstalk_solution_stack" "docker" {
+  most_recent = true
+  name_regex  = "^64bit Amazon Linux 2023 .* running Docker$"
+}
+
 #############
 # Elastic Beanstalk Application
 #############
@@ -26,8 +31,9 @@ resource "aws_elastic_beanstalk_application" "main" {
 resource "aws_elastic_beanstalk_environment" "main" {
   name                = "${var.project_name}-${var.environment}-env"
   application         = aws_elastic_beanstalk_application.main.name
-  solution_stack_name = var.solution_stack_name
+  solution_stack_name = var.solution_stack_name != "" ? var.solution_stack_name : data.aws_elastic_beanstalk_solution_stack.docker.name
   tier                = "WebServer"
+  cname_prefix        = var.cname_prefix != "" ? var.cname_prefix : null
 
   #####################
   # VPC Configuration
@@ -77,6 +83,15 @@ resource "aws_elastic_beanstalk_environment" "main" {
     value     = var.instance_security_group_id
   }
 
+  dynamic "setting" {
+    for_each = var.ec2_key_name != "" ? [1] : []
+    content {
+      namespace = "aws:autoscaling:launchconfiguration"
+      name      = "EC2KeyName"
+      value     = var.ec2_key_name
+    }
+  }
+
   #####################
   # Auto Scaling Configuration
   #####################
diff --git a/infrastructure/modules/elasticbeanstalk/variables.tf b/infrastructure/modules/elasticbeanstalk/variables.tf
index 926cca7e9d..60559c410d 100644
--- a/infrastructure/modules/elasticbeanstalk/variables.tf
+++ b/infrastructure/modules/elasticbeanstalk/variables.tf
@@ -14,7 +14,7 @@ variable "solution_stack_name" {
   description = "Elastic Beanstalk solution stack name"
   type        = string
   # Find the latest: aws elasticbeanstalk list-available-solution-stacks
-  default     = "64bit Amazon Linux 2023 v4.11.0 running Docker"
+  default     = ""
 }
 
 variable "vpc_id" {
@@ -110,3 +110,15 @@ variable "ssl_certificate_arn" {
   type        = string
   default     = ""
 }
+
+variable "cname_prefix" {
+  description = "Fixed CNAME prefix for the environment (e.g. 'finishline-sandbox'). Leave empty to let AWS assign a random one. Set this when a backend ACM cert needs a CNAME known before the environment exists, to avoid a dependency cycle."
+  type        = string
+  default     = ""
+}
+
+variable "ec2_key_name" {
+  description = "Name of the EC2 key pair for SSH access (leave empty to disable SSH)"
+  type        = string
+  default     = ""
+}
diff --git a/infrastructure/modules/rds/main.tf b/infrastructure/modules/rds/main.tf
index 7cb733aadd..1999666c93 100644
--- a/infrastructure/modules/rds/main.tf
+++ b/infrastructure/modules/rds/main.tf
@@ -29,8 +29,9 @@ resource "aws_db_instance" "main" {
   backup_retention_period = var.backup_retention_period
   backup_window          = var.backup_window
   maintenance_window     = var.maintenance_window
-  skip_final_snapshot    = false
-  final_snapshot_identifier = "${var.project_name}-${var.environment}-final-snapshot"
+  skip_final_snapshot       = var.skip_final_snapshot
+  final_snapshot_identifier = var.skip_final_snapshot ? null : "${var.project_name}-${var.environment}-final-snapshot"
+  snapshot_identifier       = var.snapshot_identifier
 
   # Multi-AZ configuration
   multi_az = var.multi_az
diff --git a/infrastructure/modules/rds/variables.tf b/infrastructure/modules/rds/variables.tf
index 8b0f3470d5..d2f770ccd9 100644
--- a/infrastructure/modules/rds/variables.tf
+++ b/infrastructure/modules/rds/variables.tf
@@ -108,3 +108,15 @@ variable "alarm_actions" {
   type        = list(string)
   default     = []
 }
+
+variable "skip_final_snapshot" {
+  description = "Skip final snapshot on destroy (set true for ephemeral environments)"
+  type        = bool
+  default     = false
+}
+
+variable "snapshot_identifier" {
+  description = "Snapshot ID to restore from on creation (leave null for a fresh database)"
+  type        = string
+  default     = null
+}
diff --git a/infrastructure/scripts/cleanup-sandbox.sh b/infrastructure/scripts/cleanup-sandbox.sh
new file mode 100755
index 0000000000..40cefd2d6d
--- /dev/null
+++ b/infrastructure/scripts/cleanup-sandbox.sh
@@ -0,0 +1,218 @@
+#!/usr/bin/env bash
+# Tag-based cleanup safety net for the sandbox environment.
+# Runs after `terraform destroy` to catch any resources Terraform missed.
+# Deletes everything tagged Environment=sandbox in us-east-2.
+#
+# Deletion order matters for VPC teardown:
+#   EB environment → RDS → IGW detach → subnets → route table rules →
+#   route tables → security group rules → security groups → VPC
+
+set -euo pipefail
+
+REGION="us-east-2"
+TAG_KEY="Environment"
+TAG_VALUE="sandbox"
+
+log() { echo "[cleanup] $*"; }
+
+ids_for() {
+  # $1 = resource-type  $2+ = filters
+  aws ec2 describe-"$1" \
+    --region "$REGION" \
+    --filters "Name=tag:$TAG_KEY,Values=$TAG_VALUE" "$@" \
+    --query '*[].["'$( [[ "$1" == *s ]] && echo "${1%s}Id" || echo "${1}Id" )'"]' \
+    --output text 2>/dev/null | tr '\t' '\n' | grep -v '^$' || true
+}
+
+#####################
+# Elastic Beanstalk
+#####################
+log "Terminating sandbox EB environments..."
+for env in $(aws elasticbeanstalk describe-environments \
+    --region "$REGION" \
+    --query "Environments[?Tags[?Key=='$TAG_KEY' && Value=='$TAG_VALUE']].EnvironmentName" \
+    --output text 2>/dev/null || true); do
+  log "  Terminating EB environment: $env"
+  aws elasticbeanstalk terminate-environment \
+    --environment-name "$env" \
+    --region "$REGION" || true
+done
+
+# Wait for EB environments to finish terminating before touching VPC resources
+for env in $(aws elasticbeanstalk describe-environments \
+    --region "$REGION" \
+    --query "Environments[?Tags[?Key=='$TAG_KEY' && Value=='$TAG_VALUE'] && Status!='Terminated'].EnvironmentName" \
+    --output text 2>/dev/null || true); do
+  log "  Waiting for EB environment to terminate: $env"
+  aws elasticbeanstalk wait environment-terminated \
+    --environment-name "$env" \
+    --region "$REGION" || true
+done
+
+#####################
+# RDS Instances
+#####################
+log "Deleting sandbox RDS instances..."
+for db in $(aws rds describe-db-instances \
+    --region "$REGION" \
+    --query "DBInstances[?TagList[?Key=='$TAG_KEY' && Value=='$TAG_VALUE']].DBInstanceIdentifier" \
+    --output text 2>/dev/null || true); do
+  log "  Deleting RDS instance: $db"
+  aws rds delete-db-instance \
+    --db-instance-identifier "$db" \
+    --skip-final-snapshot \
+    --region "$REGION" || true
+  aws rds wait db-instance-deleted \
+    --db-instance-identifier "$db" \
+    --region "$REGION" || true
+done
+
+log "Deleting sandbox DB subnet groups..."
+for sg in $(aws rds describe-db-subnet-groups \
+    --region "$REGION" \
+    --query "DBSubnetGroups[?Tags[?Key=='$TAG_KEY' && Value=='$TAG_VALUE']].DBSubnetGroupName" \
+    --output text 2>/dev/null || true); do
+  log "  Deleting DB subnet group: $sg"
+  aws rds delete-db-subnet-group \
+    --db-subnet-group-name "$sg" \
+    --region "$REGION" || true
+done
+
+#####################
+# CloudWatch Log Groups
+#####################
+log "Deleting sandbox CloudWatch log groups..."
+for lg in $(aws logs describe-log-groups \
+    --region "$REGION" \
+    --log-group-name-prefix "/aws/elasticbeanstalk/finishline-sandbox" \
+    --query "logGroups[].logGroupName" \
+    --output text 2>/dev/null || true); do
+  log "  Deleting log group: $lg"
+  aws logs delete-log-group --log-group-name "$lg" --region "$REGION" || true
+done
+
+#####################
+# VPC Resources
+# Must delete in dependency order: IGW → subnets → route table associations
+# → non-main route tables → security group rules → security groups → VPC
+#####################
+for vpc in $(aws ec2 describe-vpcs \
+    --region "$REGION" \
+    --filters "Name=tag:$TAG_KEY,Values=$TAG_VALUE" \
+    --query "Vpcs[].VpcId" \
+    --output text 2>/dev/null || true); do
+
+  log "Cleaning up VPC: $vpc"
+
+  # Detach and delete internet gateways
+  for igw in $(aws ec2 describe-internet-gateways \
+      --region "$REGION" \
+      --filters "Name=attachment.vpc-id,Values=$vpc" \
+      --query "InternetGateways[].InternetGatewayId" \
+      --output text 2>/dev/null || true); do
+    log "  Detaching IGW: $igw"
+    aws ec2 detach-internet-gateway --internet-gateway-id "$igw" --vpc-id "$vpc" --region "$REGION" || true
+    log "  Deleting IGW: $igw"
+    aws ec2 delete-internet-gateway --internet-gateway-id "$igw" --region "$REGION" || true
+  done
+
+  # Delete subnets
+  for subnet in $(aws ec2 describe-subnets \
+      --region "$REGION" \
+      --filters "Name=vpc-id,Values=$vpc" \
+      --query "Subnets[].SubnetId" \
+      --output text 2>/dev/null || true); do
+    log "  Deleting subnet: $subnet"
+    aws ec2 delete-subnet --subnet-id "$subnet" --region "$REGION" || true
+  done
+
+  # Delete non-main route tables
+  for rt in $(aws ec2 describe-route-tables \
+      --region "$REGION" \
+      --filters "Name=vpc-id,Values=$vpc" \
+      --query "RouteTables[?Associations[?Main==\`false\`] || !Associations].RouteTableId" \
+      --output text 2>/dev/null || true); do
+    log "  Deleting route table: $rt"
+    aws ec2 delete-route-table --route-table-id "$rt" --region "$REGION" || true
+  done
+
+  # Revoke all security group rules, then delete non-default security groups
+  for sg in $(aws ec2 describe-security-groups \
+      --region "$REGION" \
+      --filters "Name=vpc-id,Values=$vpc" \
+      --query "SecurityGroups[?GroupName!='default'].GroupId" \
+      --output text 2>/dev/null || true); do
+
+    # Revoke ingress rules
+    INGRESS=$(aws ec2 describe-security-group-rules \
+      --region "$REGION" \
+      --filters "Name=group-id,Values=$sg" \
+      --query "SecurityGroupRules[?!IsEgress].SecurityGroupRuleId" \
+      --output text 2>/dev/null || true)
+    if [ -n "$INGRESS" ]; then
+      aws ec2 revoke-security-group-ingress \
+        --group-id "$sg" \
+        --security-group-rule-ids $INGRESS \
+        --region "$REGION" || true
+    fi
+
+    # Revoke egress rules
+    EGRESS=$(aws ec2 describe-security-group-rules \
+      --region "$REGION" \
+      --filters "Name=group-id,Values=$sg" \
+      --query "SecurityGroupRules[?IsEgress].SecurityGroupRuleId" \
+      --output text 2>/dev/null || true)
+    if [ -n "$EGRESS" ]; then
+      aws ec2 revoke-security-group-egress \
+        --group-id "$sg" \
+        --security-group-rule-ids $EGRESS \
+        --region "$REGION" || true
+    fi
+  done
+
+  # Now delete the security groups (after rules are gone)
+  for sg in $(aws ec2 describe-security-groups \
+      --region "$REGION" \
+      --filters "Name=vpc-id,Values=$vpc" \
+      --query "SecurityGroups[?GroupName!='default'].GroupId" \
+      --output text 2>/dev/null || true); do
+    log "  Deleting security group: $sg"
+    aws ec2 delete-security-group --group-id "$sg" --region "$REGION" || true
+  done
+
+  log "  Deleting VPC: $vpc"
+  aws ec2 delete-vpc --vpc-id "$vpc" --region "$REGION" || true
+done
+
+#####################
+# IAM (sandbox roles and instance profiles)
+#####################
+log "Deleting sandbox IAM resources..."
+for profile in $(aws iam list-instance-profiles \
+    --query "InstanceProfiles[?starts_with(InstanceProfileName,'finishline-sandbox-')].InstanceProfileName" \
+    --output text 2>/dev/null || true); do
+  for role in $(aws iam get-instance-profile \
+      --instance-profile-name "$profile" \
+      --query "InstanceProfile.Roles[].RoleName" \
+      --output text 2>/dev/null || true); do
+    aws iam remove-role-from-instance-profile \
+      --instance-profile-name "$profile" --role-name "$role" || true
+  done
+  log "  Deleting instance profile: $profile"
+  aws iam delete-instance-profile --instance-profile-name "$profile" || true
+done
+
+for role in $(aws iam list-roles \
+    --query "Roles[?starts_with(RoleName,'finishline-sandbox-')].RoleName" \
+    --output text 2>/dev/null || true); do
+  for policy in $(aws iam list-role-policies --role-name "$role" --query PolicyNames[] --output text 2>/dev/null || true); do
+    aws iam delete-role-policy --role-name "$role" --policy-name "$policy" || true
+  done
+  for arn in $(aws iam list-attached-role-policies --role-name "$role" --query "AttachedPolicies[].PolicyArn" --output text 2>/dev/null || true); do
+    aws iam detach-role-policy --role-name "$role" --policy-arn "$arn" || true
+  done
+  log "  Deleting IAM role: $role"
+  aws iam delete-role --role-name "$role" || true
+done
+
+log "Cleanup complete."
diff --git a/src/backend/index.ts b/src/backend/index.ts
index 0df1277a2d..ef668c80cc 100644
--- a/src/backend/index.ts
+++ b/src/backend/index.ts
@@ -33,9 +33,12 @@ const app = express();
 
 const port = process.env.PORT || 3001;
 const isProd = process.env.NODE_ENV === 'production';
+// Sandbox's frontend is a real production build, so it always uses the real Google
+// login flow (never the dev login) and needs the same auth/CORS handling as prod.
+const usesRealGoogleAuth = isProd || (process.env.NODE_ENV as string) === 'sandbox';
 
 // cors options
-const allowedHeaders = isProd ? prodHeaders : '*';
+const allowedHeaders = usesRealGoogleAuth ? prodHeaders : '*';
 
 // Build list of allowed origins
 const allowedOrigins = [
@@ -85,7 +88,7 @@ app.use(express.json());
 app.use(cors(options));
 
 // ensure each request is authorized using JWT
-app.use(isProd ? requireJwtProd : requireJwtDev);
+app.use(usesRealGoogleAuth ? requireJwtProd : requireJwtDev);
 
 // get user and organization
 app.use(getUserAndOrganization);