diff --git a/.github/workflows/migrate.yaml b/.github/workflows/migrate.yaml
index 820c219fd..800bfb809 100644
--- a/.github/workflows/migrate.yaml
+++ b/.github/workflows/migrate.yaml
@@ -14,6 +14,7 @@ on:
         description: Which environment should we run migrations for?
         options:
           - stable
+          - ko
           - ab
           - bl
           - rjm
diff --git a/.github/workflows/reset-db.yaml b/.github/workflows/reset-db.yaml
index 5d863e6d6..57602659c 100644
--- a/.github/workflows/reset-db.yaml
+++ b/.github/workflows/reset-db.yaml
@@ -15,6 +15,7 @@ on:
         description: Which environment should we flush and re-load data for?
         options:
           - stable
+          - ko
           - ab
           - bl
           - rjm
diff --git a/ops/manifests/manifest-ko.yaml b/ops/manifests/manifest-ko.yaml
new file mode 100644
index 000000000..09e199ca0
--- /dev/null
+++ b/ops/manifests/manifest-ko.yaml
@@ -0,0 +1,29 @@
+---
+applications:
+- name: getgov-ko
+  buildpacks:
+    - python_buildpack
+  path: ../../src
+  instances: 1
+  memory: 512M
+  stack: cflinuxfs4
+  timeout: 180
+  command: ./run.sh
+  health-check-type: http
+  health-check-http-endpoint: /health
+  env:
+    # Send stdout and stderr straight to the terminal without buffering
+    PYTHONUNBUFFERED: yup
+    # Tell Django where to find its configuration
+    DJANGO_SETTINGS_MODULE: registrar.config.settings
+    # Tell Django where it is being hosted
+    DJANGO_BASE_URL: https://getgov-ko.app.cloud.gov
+    # Tell Django how much stuff to log
+    DJANGO_LOG_LEVEL: INFO
+    # default public site location
+    GETGOV_PUBLIC_SITE_URL: https://beta.get.gov
+  routes:
+    - route: getgov-ko.app.cloud.gov
+  services:
+  - getgov-credentials
+  - getgov-ko-database
diff --git a/src/registrar/config/settings.py b/src/registrar/config/settings.py
index b8b32df41..43f373ca1 100644
--- a/src/registrar/config/settings.py
+++ b/src/registrar/config/settings.py
@@ -48,7 +48,6 @@ env_db_url = env.dj_db_url("DATABASE_URL")
 env_debug = env.bool("DJANGO_DEBUG", default=False)
 env_log_level = env.str("DJANGO_LOG_LEVEL", "DEBUG")
 env_base_url = env.str("DJANGO_BASE_URL")
-env_getgov_public_site_url = env.str("GETGOV_PUBLIC_SITE_URL", "")
 
 secret_login_key = b64decode(secret("DJANGO_SECRET_LOGIN_KEY", ""))
 secret_key = secret("DJANGO_SECRET_KEY")
@@ -63,6 +62,8 @@ secret_registry_key = b64decode(secret("REGISTRY_KEY", ""))
 secret_registry_key_passphrase = secret("REGISTRY_KEY_PASSPHRASE", "")
 secret_registry_hostname = secret("REGISTRY_HOSTNAME")
 
+secret_getgov_public_site_url = secret("GETGOV_PUBLIC_SITE_URL", "")
+
 # region: Basic Django Config-----------------------------------------------###
 
 # Build paths inside the project like this: BASE_DIR / "subdir".
@@ -133,8 +134,6 @@ MIDDLEWARE = [
     "django.middleware.csrf.CsrfViewMiddleware",
     # add `user` (the currently-logged-in user) to incoming HttpRequest objects
     "django.contrib.auth.middleware.AuthenticationMiddleware",
-    # Require login for every single request by default
-    "login_required.middleware.LoginRequiredMiddleware",
     # provide framework for displaying messages to the user, see documentation
     "django.contrib.messages.middleware.MessageMiddleware",
     # provide clickjacking protection via the X-Frame-Options header
@@ -462,12 +461,6 @@ AUTHENTICATION_BACKENDS = [
 # the login_required() decorator, LoginRequiredMixin, or AccessMixin
 LOGIN_URL = "/openid/login"
 
-# We don't want the OIDC app to be login-required because then it can't handle
-# the initial login requests without erroring.
-LOGIN_REQUIRED_IGNORE_PATHS = [
-    r"/openid/(.+)$",
-]
-
 # where to go after logging out
 LOGOUT_REDIRECT_URL = "home"
 
@@ -516,7 +509,7 @@ STATIC_URL = "public/"
 
 # Base URL of our separate static public website. Used by the
 # {% public_site_url subdir/path %} template tag
-GETGOV_PUBLIC_SITE_URL = env_getgov_public_site_url
+GETGOV_PUBLIC_SITE_URL = secret_getgov_public_site_url
 
 # endregion
 # region: Registry----------------------------------------------------------###
@@ -564,6 +557,7 @@ SECURE_SSL_REDIRECT = True
 # web server configurations.
 ALLOWED_HOSTS = [
     "getgov-stable.app.cloud.gov",
+    "getgov-ko.app.cloud.gov",
     "getgov-ab.app.cloud.gov",
     "getgov-bl.app.cloud.gov",
     "getgov-rjm.app.cloud.gov",