diff --git a/chart/infra-server/static/workflow-demo.yaml b/chart/infra-server/static/workflow-demo.yaml
index 476f81c65..9699afea8 100644
--- a/chart/infra-server/static/workflow-demo.yaml
+++ b/chart/infra-server/static/workflow-demo.yaml
@@ -78,10 +78,10 @@ spec:
             path: /certs/cert.pem
             gcs:
               bucket: sr-demo-files
-              key: certs/demo.stackrox.com/privkey-plus-fullchain.pem
+              key: certs/demos.rox.systems/privkey-plus-fullchain.pem
               serviceAccountKeySecret:
                 name: google-credentials-demo
-                key: google-credentials.json
+                key: read-certs-google-credentials.json
       outputs:
         artifacts:
           - name: kubeconfig
@@ -170,9 +170,9 @@ spec:
                 name: demo-secrets
                 key: SLACK_WEBHOOK
           - name: GCP_CLOUD_DNS_ZONE_NAME
-            value: "demo-stackrox-com"
+            value: "demos-rox-systems"
           - name: DOMAIN_NAME
-            value: "demo.stackrox.com"
+            value: "demos.rox.systems"
 
     - name: wait
       suspend: {}
diff --git a/chart/infra-server/static/workflow-qa-demo.yaml b/chart/infra-server/static/workflow-qa-demo.yaml
index d31b870db..11e4f6726 100644
--- a/chart/infra-server/static/workflow-qa-demo.yaml
+++ b/chart/infra-server/static/workflow-qa-demo.yaml
@@ -29,7 +29,7 @@ spec:
   volumes:
     - name: credentials
       secret:
-        secretName: google-credentials-qa-demo
+        secretName: google-credentials-demo
 
   templates:
     - name: start
@@ -85,10 +85,10 @@ spec:
             path: /certs/cert.pem
             gcs:
               bucket: sr-demo-files
-              key: certs/demo.stackrox.com/privkey-plus-fullchain.pem
+              key: certs/demos.rox.systems/privkey-plus-fullchain.pem
               serviceAccountKeySecret:
                 name: google-credentials-demo
-                key: google-credentials.json
+                key: read-certs-google-credentials.json
 
       outputs:
         artifacts:
@@ -176,9 +176,9 @@ spec:
                 name: demo-secrets
                 key: SLACK_WEBHOOK
           - name: GCP_CLOUD_DNS_ZONE_NAME
-            value: "demo-stackrox-com"
+            value: "demos-rox-systems"
           - name: DOMAIN_NAME
-            value: "demo.stackrox.com"
+            value: "demos.rox.systems"
 
     - name: wait
       suspend: {}
diff --git a/chart/infra-server/templates/demo/secrets.yaml b/chart/infra-server/templates/demo/secrets.yaml
index 9c0e30042..c52429806 100644
--- a/chart/infra-server/templates/demo/secrets.yaml
+++ b/chart/infra-server/templates/demo/secrets.yaml
@@ -11,12 +11,16 @@ metadata:
 data:
   # Service account used for provisioning demo infrastructure.
   google-credentials.json: |-
-    {{ required ".Values.demo__demo_provisioner_json is undefined" .Values.demo__demo_provisioner_json }}
+    {{ required ".Values.demo__gke_demo_provisioner_json is undefined" .Values.demo__gke_demo_provisioner_json }}
 
   # Service account used for demo GCR integration.
   google-scanner-credentials.json: |-
     {{ required ".Values.demo__google_scanner_credentials_json is undefined" .Values.demo__google_scanner_credentials_json }}
 
+  # Service account used for providing certs from the certifier sr-demo-files bucket.
+  read-certs-google-credentials.json: |-
+    {{ required ".Values.demo__demo_provisioner_json is undefined" .Values.demo__demo_provisioner_json }}
+
 ---
 
 apiVersion: v1
diff --git a/chart/infra-server/templates/qa-demo/secrets.yaml b/chart/infra-server/templates/qa-demo/secrets.yaml
deleted file mode 100644
index f70d5edef..000000000
--- a/chart/infra-server/templates/qa-demo/secrets.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-
-apiVersion: v1
-kind: Secret
-type: Opaque
-
-metadata:
-  name: google-credentials-qa-demo
-  namespace: default
-
-data:
-  # Service account used for provisioning demo infrastructure.
-  google-credentials.json: |-
-    {{ required ".Values.qa_demo__qa_demo_provisioner_json is undefined" .Values.qa_demo__qa_demo_provisioner_json }}
-
-  # Service account used for demo GCR integration.
-  google-scanner-credentials.json: |-
-    {{ required ".Values.demo__google_scanner_credentials_json is undefined" .Values.demo__google_scanner_credentials_json }}