diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
index 0c74fc45c..d327c2b66 100644
--- a/.github/workflows/pipeline.yml
+++ b/.github/workflows/pipeline.yml
@@ -122,6 +122,7 @@ jobs:
         CORE_EMAIL_USERNAME: ${{ secrets.CORE_EMAIL_USERNAME }}
         CORE_EMAIL_PASSWORD: ${{ secrets.CORE_EMAIL_PASSWORD }}
         APP_HOST: ${{ secrets.APP_HOST }}
+        RAILS_MASTER_KEY: ${{ secret.RAILS_MASTER_KEY }}
       run: |
         cf7 api $CF_API_ENDPOINT
         cf7 auth
@@ -131,4 +132,5 @@ jobs:
         cf7 set-env $APP_NAME CORE_EMAIL_USERNAME $CORE_EMAIL_USERNAME
         cf7 set-env $APP_NAME CORE_EMAIL_PASSWORD $CORE_EMAIL_PASSWORD
         cf7 set-env $APP_NAME APP_HOST $APP_HOST
+        cf7 set-env $APP_NAME RAILS_MASTER_KEY $RAILS_MASTER_KEY
         cf7 push --strategy rolling
diff --git a/config/database.yml b/config/database.yml
index 4e8a0d4d2..d7a80c837 100644
--- a/config/database.yml
+++ b/config/database.yml
@@ -31,6 +31,9 @@ development:
   database: data_collector_development
   host: localhost
 
+sandbox:
+  <<: *default
+
   # The specified database role being used to connect to postgres.
   # To create additional roles in postgres see `$ createuser --help`.
   # When left blank, postgres will use the default role. This is
diff --git a/config/webpacker.yml b/config/webpacker.yml
index c56b8e232..11e9c283c 100644
--- a/config/webpacker.yml
+++ b/config/webpacker.yml
@@ -12,11 +12,14 @@ default: &default
   # ['app/assets', 'engine/foo/app/assets']
   additional_paths: ['node_modules/govuk-frontend/govuk']
 
-  # Reload manifest.json on all requests so we reload latest compiled packs
-  cache_manifest: false
+  # Cache manifest.json for performance
+  cache_manifest: true
 
   # Extract and emit a css file
-  extract_css: false
+  extract_css: true
+
+  # Production depends on precompilation of packs prior to booting for performance.
+  compile: false
 
   static_assets_extensions:
     - .jpg
@@ -51,6 +54,12 @@ development:
   <<: *default
   compile: true
 
+  # Reload manifest.json on all requests so we reload latest compiled packs
+  cache_manifest: false
+
+  # Extract and emit a css file
+  extract_css: false
+
   # Reference: https://webpack.js.org/configuration/dev-server/
   dev_server:
     https: false
@@ -76,17 +85,18 @@ test:
   <<: *default
   compile: true
 
+  # Reload manifest.json on all requests so we reload latest compiled packs
+  cache_manifest: false
+
+  # Extract and emit a css file
+  extract_css: false
+
   # Compile test packs to a separate directory
   public_output_path: packs-test
 
-production:
-  <<: *default
-
-  # Production depends on precompilation of packs prior to booting for performance.
-  compile: false
 
-  # Cache manifest.json for performance
-  cache_manifest: true
+sandbox:
+  <<: *default
 
-  # Extract and emit a css file
-  extract_css: true
+production:
+  <<: *default