diff --git a/backend/cmd/api/env.go b/backend/cmd/api/env.go
index 7f63a2784..02055c6dc 100644
--- a/backend/cmd/api/env.go
+++ b/backend/cmd/api/env.go
@@ -26,7 +26,6 @@ import (
 	"github.com/bcc-code/bcc-media-platform/backend/search"
 
 	"github.com/bcc-code/bcc-media-platform/backend/auth0"
-	"github.com/bcc-code/bcc-media-platform/backend/streamtoken"
 	"github.com/joho/godotenv"
 	"github.com/samber/lo"
 )
@@ -95,7 +94,6 @@ type envConfig struct {
 	Port          string
 	Auth0         auth0.Config
 	CDNConfig     cdnConfig
-	Livestream    livestreamConfig
 	StreamProxy   streamProxyConfig
 	Secrets       serviceSecrets
 	Redis         utils.RedisConfig
@@ -130,54 +128,22 @@ type adminConfig struct {
 type cdnConfig struct {
 	ImageCDNDomain    string
 	Vod2Domain        string
-	LegacyVODDomain   string
 	FilesDomain       string
 	AWSSigningKeyPath string
 	AWSSigningKeyID   string
 }
 
-// livestreamConfig holds the CloudFront key pair used to sign the livestream
-// manifest URL. This is a separate key pair from the VOD/file signing key in
-// cdnConfig. It satisfies signing.CloudFrontConfig.
-type livestreamConfig struct {
-	SigningKeyPath string
-	SigningKeyID   string
-}
-
-func (c livestreamConfig) GetAwsSigningKeyPath() string { return c.SigningKeyPath }
-func (c livestreamConfig) GetAwsSigningKeyID() string   { return c.SigningKeyID }
-
+// streamProxyConfig is what the API needs to mint stream-proxy URLs (HS256 JWT
+// on the proxy's public host). It satisfies streamtoken.Config.
 type streamProxyConfig struct {
-	JWTSecret       string
-	JWTIssuer       string
-	Domain          string
-	PrimaryProvider streamtoken.Provider
+	JWTSecret string
+	JWTIssuer string
+	Domain    string
 }
 
-func (c streamProxyConfig) GetStreamJWTSecret() string                     { return c.JWTSecret }
-func (c streamProxyConfig) GetStreamJWTIssuer() string                     { return c.JWTIssuer }
-func (c streamProxyConfig) GetStreamProxyDomain() string                   { return c.Domain }
-func (c streamProxyConfig) GetStreamPrimaryProvider() streamtoken.Provider { return c.PrimaryProvider }
-
-// parsePrimaryProvider maps the user-facing STREAM_PRIMARY_PROVIDER values
-// ("cloudfront", "streamproxy") to the streamtoken.Provider used as the JWT
-// `provider` claim. The claim values are different ("cloudfront", "ioriver")
-// because they are the stream-proxy's internal vocabulary; the API exposes
-// the same routing decision under a name that abstracts away the
-// underlying signer technology. Empty raw → ProviderUnspecified (signer
-// substitutes its own default). Unknown raw passes through so the signer's
-// validity check rejects it with a clear error.
-func parsePrimaryProvider(raw string) streamtoken.Provider {
-	switch raw {
-	case "":
-		return streamtoken.ProviderUnspecified
-	case "cloudfront":
-		return streamtoken.ProviderCloudFront
-	case "streamproxy":
-		return streamtoken.ProviderIoriver
-	}
-	return streamtoken.Provider(raw)
-}
+func (c streamProxyConfig) GetStreamJWTSecret() string   { return c.JWTSecret }
+func (c streamProxyConfig) GetStreamJWTIssuer() string   { return c.JWTIssuer }
+func (c streamProxyConfig) GetStreamProxyDomain() string { return c.Domain }
 
 type awsConfig struct {
 	TempBucket string // Things put here are automatically removed
@@ -235,11 +201,6 @@ func (c cdnConfig) GetVOD2Domain() string {
 	return c.Vod2Domain
 }
 
-// GetLegacyVODDomain returns the legacy VOD domain
-func (c cdnConfig) GetLegacyVODDomain() string {
-	return c.LegacyVODDomain
-}
-
 // GetFilesCDNDomain returns the configured FilesCDNDomain
 func (c cdnConfig) GetFilesCDNDomain() string {
 	return c.FilesDomain
@@ -316,17 +277,11 @@ func getEnvConfig() envConfig {
 			FilesDomain:       os.Getenv("FILES_CDN_DOMAIN"),
 			AWSSigningKeyID:   os.Getenv("CF_SIGNING_KEY_ID"),
 			AWSSigningKeyPath: os.Getenv("CF_SIGNING_KEY_PATH"),
-			LegacyVODDomain:   os.Getenv("LEGACY_CDN_DOMAIN"),
-		},
-		Livestream: livestreamConfig{
-			SigningKeyID:   os.Getenv("LIVESTREAM_SIGNING_KEY_ID"),
-			SigningKeyPath: os.Getenv("LIVESTREAM_SIGNING_KEY_PATH"),
 		},
 		StreamProxy: streamProxyConfig{
-			JWTSecret:       os.Getenv("STREAM_JWT_SECRET"),
-			JWTIssuer:       os.Getenv("STREAM_JWT_ISSUER"),
-			Domain:          os.Getenv("STREAM_PROXY_DOMAIN"),
-			PrimaryProvider: parsePrimaryProvider(os.Getenv("STREAM_PRIMARY_PROVIDER")),
+			JWTSecret: os.Getenv("STREAM_JWT_SECRET"),
+			JWTIssuer: os.Getenv("STREAM_JWT_ISSUER"),
+			Domain:    os.Getenv("STREAM_PROXY_DOMAIN"),
 		},
 		Secrets: serviceSecrets{
 			Directus: os.Getenv("SERVICE_SECRET_DIRECTUS"),
diff --git a/backend/cmd/api/env.sample b/backend/cmd/api/env.sample
index aa3cb99f7..c465f18d5 100644
--- a/backend/cmd/api/env.sample
+++ b/backend/cmd/api/env.sample
@@ -21,8 +21,6 @@ IMAGE_CDN_DOMAIN=brunstadtv.imgix.net
 VOD2_CDN_DOMAIN=vod2.brunstad.tv
 FILES_CDN_DOMAIN=files.brunstad.tv
 CF_SIGNING_KEY_ID=<SIGNING_KEY_ID>
-LIVESTREAM_SIGNING_KEY_ID=<LIVESTREAM_SIGNING_KEY_ID>
-LIVESTREAM_SIGNING_KEY_PATH=<PATH TO LIVESTREAM PEM KEY>
 AZ_SIGNING_KEY=<BASE 64 ENCODED SIMMETRYC KEY>
 
 # Stream proxy: HMAC secret + issuer the API uses to mint stream JWTs.
@@ -32,14 +30,11 @@ STREAM_JWT_ISSUER=
 # Public hostname clients use to reach the stream proxy.
 # For local dev, point at the locally-running cmd/stream-proxy (default port 8081).
 STREAM_PROXY_DOMAIN=localhost:8081
-# Optional. Selects how the API delivers stream URLs to clients:
-#   "cloudfront" (or empty) → API signs CloudFront URLs directly; the
-#                             stream-proxy is NOT in the request path.
-#   "streamproxy"           → API returns a stream-proxy URL with an HS256
-#                             JWT; the proxy signs upstream to ioriver.
-# The Unleash `stream-proxy:legacy` flag, when set on a request, overrides
-# this and forces the CloudFront-direct signer for that request only.
-STREAM_PRIMARY_PROVIDER=
+# All stream URLs (VOD and live) are stream-proxy URLs. Which upstream CDN
+# identity the proxy signs for is the JWT `provider` claim: ioriver by default;
+# the Unleash `cdn-provider` (VOD) / `live-cdn-provider` (live) variants
+# `ioriver` / `cloudfront`, forwarded by clients in x-feature-flags, override it
+# per request.
 
 # Unleash usage reporting. The clients evaluate flags and forward them to us as
 # the x-feature-flags header, so the API runs no SDK — it only posts metrics
diff --git a/backend/cmd/api/handlers.go b/backend/cmd/api/handlers.go
index 265bc2dc0..c660d37d6 100644
--- a/backend/cmd/api/handlers.go
+++ b/backend/cmd/api/handlers.go
@@ -49,8 +49,6 @@ func graphqlHandler(
 	emailService *email.Service,
 	fileSigner *signing.CloudFrontSigner,
 	streamSigner *streamtoken.Signer,
-	legacyStreamSigner *signing.CloudFrontStreamSigner,
-	livestreamSigner *signing.CloudFrontSigner,
 	config envConfig,
 	s3client *s3.Client,
 	analyticsSalt string,
@@ -71,9 +69,6 @@ func graphqlHandler(
 		EmailService:          emailService,
 		FileSigner:            fileSigner,
 		StreamURLSigner:       streamSigner,
-		LegacyStreamSigner:    legacyStreamSigner,
-		LivestreamSigner:      livestreamSigner,
-		PrimaryStreamProvider: config.StreamProxy.PrimaryProvider,
 		S3Client:              s3client,
 		APIConfig:             config.CDNConfig,
 		AWSConfig:             config.AWS,
diff --git a/backend/cmd/api/main.go b/backend/cmd/api/main.go
index df1b082a6..7b932d2d3 100644
--- a/backend/cmd/api/main.go
+++ b/backend/cmd/api/main.go
@@ -195,23 +195,10 @@ func main() {
 	if err != nil {
 		log.L.Panic().Err(err).Msg("failed to init cloudfront file signer")
 	}
-	legacyStreamSigner := signing.NewCloudFrontStreamSigner(fileSigner, config.CDNConfig.GetVOD2Domain())
 	streamSigner, err := streamtoken.NewSigner(config.StreamProxy)
 	if err != nil {
 		log.L.Panic().Err(err).Msg("failed to init stream-proxy signer")
 	}
-	// The livestream uses its own CloudFront key pair. Optional: when it isn't
-	// configured the API still boots and live.isOnline works, but live.url is
-	// omitted (rather than panicking environments without the key deployed).
-	var livestreamSigner *signing.CloudFrontSigner
-	if config.Livestream.GetAwsSigningKeyPath() != "" {
-		livestreamSigner, err = signing.NewCloudFrontSigner(config.Livestream)
-		if err != nil {
-			log.L.Panic().Err(err).Msg("failed to init livestream signer")
-		}
-	} else {
-		log.L.Warn().Msg("livestream signing key not configured (LIVESTREAM_SIGNING_KEY_PATH); live.url will be unavailable")
-	}
 	queries := sqlc.New(db)
 	queries.SetImageCDNDomain(config.CDNConfig.ImageCDNDomain)
 	authClient := auth0.New(config.Auth0)
@@ -343,8 +330,6 @@ func main() {
 		emailService,
 		fileSigner,
 		streamSigner,
-		legacyStreamSigner,
-		livestreamSigner,
 		config,
 		s3Client,
 		config.AnalyticsSalt,
diff --git a/backend/cmd/jobs/env.go b/backend/cmd/jobs/env.go
index 16ea658a6..2e32b3e04 100644
--- a/backend/cmd/jobs/env.go
+++ b/backend/cmd/jobs/env.go
@@ -57,6 +57,18 @@ func (c cdnConfig) GetAwsSigningKeyID() string {
 	return c.AWSSigningKeyID
 }
 
+// streamProxyConfig is what the export needs to mint stream-proxy URLs. The
+// values MUST match cmd/api and cmd/stream-proxy. It satisfies streamtoken.Config.
+type streamProxyConfig struct {
+	JWTSecret string
+	JWTIssuer string
+	Domain    string
+}
+
+func (c streamProxyConfig) GetStreamJWTSecret() string   { return c.JWTSecret }
+func (c streamProxyConfig) GetStreamJWTIssuer() string   { return c.JWTIssuer }
+func (c streamProxyConfig) GetStreamProxyDomain() string { return c.Domain }
+
 type envConfig struct {
 	AWS               awsConfig
 	AzureStorage      files.AzureConfig
@@ -76,6 +88,7 @@ type envConfig struct {
 	VideoManipulator  videomanipulatorConfig
 	Phrase            phrase.Config
 	CDNConfig         cdnConfig
+	StreamProxy       streamProxyConfig
 }
 
 func getEnvConfig() envConfig {
@@ -173,5 +186,10 @@ func getEnvConfig() envConfig {
 			AWSSigningKeyID:   os.Getenv("CF_SIGNING_KEY_ID"),
 			AWSSigningKeyPath: os.Getenv("CF_SIGNING_KEY_PATH"),
 		},
+		StreamProxy: streamProxyConfig{
+			JWTSecret: os.Getenv("STREAM_JWT_SECRET"),
+			JWTIssuer: os.Getenv("STREAM_JWT_ISSUER"),
+			Domain:    os.Getenv("STREAM_PROXY_DOMAIN"),
+		},
 	}
 }
diff --git a/backend/cmd/jobs/env.sample b/backend/cmd/jobs/env.sample
index 7751b9870..0cb801dc2 100644
--- a/backend/cmd/jobs/env.sample
+++ b/backend/cmd/jobs/env.sample
@@ -45,8 +45,13 @@ AZURE_STORAGE_CONTAINER=images
 VIDEOMANIPULATOR_BASE_URL=http://localhost:8005/
 VIDEOMANIPULATOR_API_KEY=
 
-# CDN signing (CloudFront, used for downloadable file URLs and the legacy
-# stream-URL form embedded in offline-export bundles).
+# CDN signing (CloudFront, used for downloadable file URLs).
 VOD2_CDN_DOMAIN=
 CF_SIGNING_KEY_ID=
 CF_SIGNING_KEY_PATH=
+
+# Stream proxy: HMAC secret + issuer + public host used to mint the stream URLs
+# embedded in offline-export bundles. These MUST match cmd/api and cmd/stream-proxy.
+STREAM_JWT_SECRET=
+STREAM_JWT_ISSUER=
+STREAM_PROXY_DOMAIN=
diff --git a/backend/cmd/jobs/main.go b/backend/cmd/jobs/main.go
index 992d0b003..de96c05f8 100644
--- a/backend/cmd/jobs/main.go
+++ b/backend/cmd/jobs/main.go
@@ -23,6 +23,7 @@ import (
 	"github.com/bcc-code/bcc-media-platform/backend/signing"
 	"github.com/bcc-code/bcc-media-platform/backend/sqlc"
 	"github.com/bcc-code/bcc-media-platform/backend/statistics"
+	"github.com/bcc-code/bcc-media-platform/backend/streamtoken"
 	"github.com/bcc-code/bcc-media-platform/backend/translations"
 	"github.com/bcc-code/bcc-media-platform/backend/translations/phrase"
 	"github.com/bcc-code/bcc-media-platform/backend/utils"
@@ -150,7 +151,10 @@ func main() {
 	if err != nil {
 		log.L.Fatal().Err(err).Msg("failed to init cloudfront file signer")
 	}
-	legacyStreamSigner := signing.NewCloudFrontStreamSigner(fileSigner, config.CDNConfig.GetVOD2Domain())
+	streamSigner, err := streamtoken.NewSigner(config.StreamProxy)
+	if err != nil {
+		log.L.Fatal().Err(err).Msg("failed to init stream-proxy signer")
+	}
 
 	services := server.ExternalServices{
 		Database:                db,
@@ -168,7 +172,7 @@ func main() {
 		CDNConfigProvider:       config.CDNConfig,
 		BatchLoaders:            loaders.InitBatchLoaders(queries, nil),
 		FileSigner:              fileSigner,
-		LegacyStreamSigner:      legacyStreamSigner,
+		StreamSigner:            streamSigner,
 	}
 
 	handlers := server.NewServer(services, serverConfig)
diff --git a/backend/cmd/jobs/server/services.go b/backend/cmd/jobs/server/services.go
index b41e9e470..b0e19db10 100644
--- a/backend/cmd/jobs/server/services.go
+++ b/backend/cmd/jobs/server/services.go
@@ -2,10 +2,12 @@ package server
 
 import (
 	"database/sql"
+
 	"github.com/bcc-code/bcc-media-platform/backend/common"
 	"github.com/bcc-code/bcc-media-platform/backend/export"
 	"github.com/bcc-code/bcc-media-platform/backend/loaders"
 	"github.com/bcc-code/bcc-media-platform/backend/signing"
+	"github.com/bcc-code/bcc-media-platform/backend/streamtoken"
 	"github.com/bcc-code/bcc-media-platform/backend/translations"
 
 	"github.com/aws/aws-sdk-go-v2/service/mediapackagevod"
@@ -38,7 +40,7 @@ type ExternalServices struct {
 	CDNConfigProvider       export.CDNConfig
 	BatchLoaders            *loaders.BatchLoaders
 	FileSigner              *signing.CloudFrontSigner
-	LegacyStreamSigner      *signing.CloudFrontStreamSigner
+	StreamSigner            *streamtoken.Signer
 }
 
 // GetDatabase as stored in the struct
@@ -112,6 +114,7 @@ func (e ExternalServices) GetFileSigner() *signing.CloudFrontSigner {
 	return e.FileSigner
 }
 
-func (e ExternalServices) GetLegacyStreamSigner() *signing.CloudFrontStreamSigner {
-	return e.LegacyStreamSigner
+// GetStreamSigner returns the stream-proxy URL signer used by the export.
+func (e ExternalServices) GetStreamSigner() *streamtoken.Signer {
+	return e.StreamSigner
 }
diff --git a/backend/export/export.go b/backend/export/export.go
index 044384c2e..8657cfe83 100644
--- a/backend/export/export.go
+++ b/backend/export/export.go
@@ -18,7 +18,6 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/bcc-code/bcc-media-platform/backend/graph/api/model"
-	"github.com/bcc-code/bcc-media-platform/backend/signing"
 	"github.com/bcc-code/bcc-media-platform/backend/utils"
 	"github.com/cloudevents/sdk-go/v2/event"
 	"github.com/google/uuid"
@@ -68,7 +67,7 @@ type serviceProvider interface {
 	GetLoadersForRoles(roles []string) *loaders.LoadersWithPermissions
 	GetPersonalizedLoaders(roles []string, langPreferences common.LanguagePreferences) *loaders.PersonalizedLoaders
 	GetS3Client() *s3.Client
-	GetLegacyStreamSigner() *signing.CloudFrontStreamSigner
+	GetStreamSigner() *streamtoken.Signer
 	GetCDNConfig() CDNConfig
 }
 
@@ -79,7 +78,7 @@ type serviceProviderAPI interface {
 	GetFilteredLoaders(ctx context.Context) *loaders.LoadersWithPermissions
 	GetPersonalizedLoaders(ctx context.Context) *loaders.PersonalizedLoaders
 	GetQueries() *sqlc.Queries
-	GetLegacyStreamSigner() *signing.CloudFrontStreamSigner
+	GetStreamSigner() *streamtoken.Signer
 	GetS3Client() *s3.Client
 }
 
@@ -239,10 +238,10 @@ func exportEpisodes(ctx context.Context, batchLoaders *loaders.BatchLoaders, fil
 }
 
 // exportStreams writes per-episode stream URLs into the offline-export
-// SQLite db. Exports always use the legacy CloudFront-signed URL form because
-// jobs run without a request context to evaluate the per-user feature flag
-// that switches between the proxy and legacy paths.
-func exportStreams(ctx context.Context, ls *loaders.BatchLoaders, streamSigner *signing.CloudFrontStreamSigner, liteQueries *sqlexport.Queries, episodeIDs []int) error {
+// SQLite db as stream-proxy URLs. Exports run without a request context to
+// evaluate the per-user `cdn-provider` flag, so they always use the signer's
+// default upstream identity (streamtoken.DefaultPrimaryProvider).
+func exportStreams(ctx context.Context, ls *loaders.BatchLoaders, streamSigner *streamtoken.Signer, liteQueries *sqlexport.Queries, episodeIDs []int) error {
 
 	episodes, err := ls.EpisodeLoader.GetMany(ctx, episodeIDs)
 	if err != nil {
@@ -512,7 +511,7 @@ func HandleExportMessage(ctx context.Context, s serviceProvider, tempBucketNeme
 		s.GetLoaders(),
 		s.GetLoadersForRoles(fetchedEntry.UserGroups),
 		s.GetPersonalizedLoaders(fetchedEntry.UserGroups, langPreferences),
-		s.GetLegacyStreamSigner(),
+		s.GetStreamSigner(),
 		s.GetS3Client(),
 		s.GetDatabase(),
 	)
@@ -578,7 +577,7 @@ func DoExport(ctx context.Context, q serviceProviderAPI, bucketName string, user
 		q.GetLoaders(),
 		q.GetFilteredLoaders(ctx),
 		q.GetPersonalizedLoaders(ctx),
-		q.GetLegacyStreamSigner(),
+		q.GetStreamSigner(),
 		q.GetS3Client(),
 		q.GetDatabase(),
 	)
@@ -593,7 +592,7 @@ func doExport(
 	batchLoaders *loaders.BatchLoaders,
 	roleLoaders *loaders.LoadersWithPermissions,
 	personalizedLoaders *loaders.PersonalizedLoaders,
-	streamSigner *signing.CloudFrontStreamSigner,
+	streamSigner *streamtoken.Signer,
 	s3Client *s3.Client,
 	pgSql *sql.DB,
 ) (string, error) {
diff --git a/backend/graph/api/calendar-resolver.go b/backend/graph/api/calendar-resolver.go
index 5ab2f94c7..18977f000 100644
--- a/backend/graph/api/calendar-resolver.go
+++ b/backend/graph/api/calendar-resolver.go
@@ -11,6 +11,7 @@ import (
 	"github.com/bcc-code/bcc-media-platform/backend/graph/api/model"
 	"github.com/bcc-code/bcc-media-platform/backend/loaders"
 	"github.com/bcc-code/bcc-media-platform/backend/memorycache"
+	"github.com/bcc-code/bcc-media-platform/backend/streamtoken"
 	"github.com/bcc-code/bcc-media-platform/backend/user"
 	"github.com/bcc-code/bcc-media-platform/backend/utils"
 	"github.com/samber/lo"
@@ -45,14 +46,14 @@ type bufferWindow struct {
 	entry         *common.CalendarEntry
 	livestreamURL string
 	until         time.Time
-	signing       liveSigning
+	provider      streamtoken.Provider
 }
 
 // bufferWindowForEntry resolves the buffer playback window for the calendar entry
 // with the given id, or nil when no buffer should be offered to the caller. It is
 // the single gate shared by the bufferUrl and bufferAvailableUntil fields, so the
-// two are always consistent. A buffer is offered only when: a livestream signing
-// key and URL are configured; the caller passes the permission-group gate
+// two are always consistent. A buffer is offered only when: a livestream URL is
+// configured; the caller passes the permission-group gate
 // (BufferAllowed — empty groups → all BCC members, else intersected with the
 // caller's roles in SQL); the linked episode is not yet watchable for the caller —
 // i.e. either not published, or published but still "locked" (publish date in the
@@ -60,11 +61,6 @@ type bufferWindow struct {
 // then the canonical way to watch; buffer_available_hours > 0; and now is within
 // [entry.start, entry.end + hours] (hours capped at maxBufferAvailableHours).
 func (r *Resolver) bufferWindowForEntry(ctx context.Context, id string) (*bufferWindow, error) {
-	ls := r.resolveLiveSigning(ctx)
-	if !r.canSignLive(ls) {
-		return nil, nil
-	}
-
 	conf, err := withCacheAndTimestamp(ctx, "global_config", r.Queries.GetGlobalConfig, time.Second*30, nil)
 	if err != nil {
 		return nil, err
@@ -107,7 +103,7 @@ func (r *Resolver) bufferWindowForEntry(ctx context.Context, id string) (*buffer
 		return nil, nil
 	}
 
-	return &bufferWindow{entry: entry, livestreamURL: conf.LivestreamURL, until: until, signing: ls}, nil
+	return &bufferWindow{entry: entry, livestreamURL: conf.LivestreamURL, until: until, provider: r.pickLiveProvider(ctx)}, nil
 }
 
 // bufferPlaybackWindow returns the [start, end] window the buffer (start-over)
@@ -186,7 +182,7 @@ func (r *Resolver) bufferForEntry(ctx context.Context, id string) (*model.Calend
 		return nil, err
 	}
 	start, end := bufferPlaybackWindow(w.entry)
-	url, err := r.signedBufferURL(w.signing, w.livestreamURL, start, end, w.until)
+	url, err := r.signedBufferURL(w.livestreamURL, start, end, w.until, w.provider)
 	if err != nil {
 		return nil, err
 	}
diff --git a/backend/graph/api/episodes.resolvers.go b/backend/graph/api/episodes.resolvers.go
index b2003d77d..a6485493d 100644
--- a/backend/graph/api/episodes.resolvers.go
+++ b/backend/graph/api/episodes.resolvers.go
@@ -133,7 +133,7 @@ func (r *episodeResolver) Streams(ctx context.Context, obj *model.Episode) ([]*m
 
 	r.GetLoaders().AssetStreamsLoader.LoadMany(ctx, lo.Values(e.Assets))
 
-	streamSigner, selectedCdn := r.pickStreamSigner(ctx)
+	selectedCdn := r.pickStreamProvider(ctx)
 
 	if e.AssetID.Valid {
 		r.GetLoaders().AssetStreamsLoader.Load(ctx, int(e.AssetID.Int64))
@@ -144,7 +144,7 @@ func (r *episodeResolver) Streams(ctx context.Context, obj *model.Episode) ([]*m
 		}
 
 		for _, s := range streams {
-			stream, err := model.StreamFrom(ctx, streamSigner, s, selectedCdn)
+			stream, err := model.StreamFrom(ctx, r.StreamURLSigner, s, selectedCdn)
 			if err != nil {
 				return nil, err
 			}
@@ -161,7 +161,7 @@ func (r *episodeResolver) Streams(ctx context.Context, obj *model.Episode) ([]*m
 		}
 
 		for _, s := range streams {
-			stream, err := model.StreamFrom(ctx, streamSigner, s, selectedCdn)
+			stream, err := model.StreamFrom(ctx, r.StreamURLSigner, s, selectedCdn)
 			if err != nil {
 				return nil, err
 			}
diff --git a/backend/graph/api/live.go b/backend/graph/api/live.go
index b70987fec..ebd706378 100644
--- a/backend/graph/api/live.go
+++ b/backend/graph/api/live.go
@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"github.com/bcc-code/bcc-media-platform/backend/log"
+	"github.com/bcc-code/bcc-media-platform/backend/streamtoken"
 )
 
 // livestreamURLExpiry is how long a signed livestream manifest URL stays valid.
@@ -22,13 +23,6 @@ const livestreamURLExpiry = 6 * time.Hour
 // (requesting a `start` older than the retained window returns an error).
 const maxLivestreamStartAge = 90 * time.Minute
 
-// maxLivestreamURLAgeFromStart caps how long after the (clamped) start time a
-// signed URL stays valid. It bounds the URL's lifetime to the relevant program
-// window rather than the full livestreamURLExpiry.
-//
-// This is because manifests > 2h grow over the lambda limit.
-const maxLivestreamURLAgeFromStart = 2 * time.Hour
-
 // liveURL is the cached, signed livestream URL plus its expiry. It is not
 // user-specific: the stream and signing key are global, so a single cache entry
 // serves every permitted caller.
@@ -42,20 +36,10 @@ type liveURL struct {
 // ago, matching the replay buffer's padded view of the program window —
 // inserts the AWS Elemental MediaPackage start-over `start` path element so
 // playback joins from the program's start (clamped to at most
-// maxLivestreamStartAge in the past). On the
-// legacy path the URL's validity is capped at maxLivestreamURLAgeFromStart past
-// that start; on the proxy path it keeps the full livestreamURLExpiry, and the
-// returned ExpiresAt is earlier than the token's real expiry (see
-// signLiveManifestWith).
-//
-// It returns nil (with a nil error) when no signer is configured for the
-// selected path, so the caller serves the online flag only.
+// maxLivestreamStartAge in the past). The URL is valid for livestreamURLExpiry;
+// the returned ExpiresAt is earlier than the token's real expiry (see
+// signLiveManifest).
 func (r *Resolver) signedLiveURL(ctx context.Context, livestreamURL string) (*liveURL, error) {
-	ls := r.resolveLiveSigning(ctx)
-	if !r.canSignLive(ls) {
-		return nil, nil
-	}
-
 	now := time.Now()
 	entry, err := r.Queries.GetCurrentCalendarEntry(ctx, now.Add(-bufferLeadOut))
 	if err != nil {
@@ -69,8 +53,7 @@ func (r *Resolver) signedLiveURL(ctx context.Context, livestreamURL string) (*li
 		start = &s
 	}
 
-	ttl := livestreamExpiresAt(start, now, ls.useProxy).Sub(now)
-	signedURL, expiresAt, err := r.signLiveManifestWith(ls, livestreamURL, ttl)
+	signedURL, expiresAt, err := r.signLiveManifest(livestreamURL, livestreamURLExpiry, r.pickLiveProvider(ctx))
 	if err != nil {
 		log.L.Error().Err(err).Str("livestreamURL", livestreamURL).Msg("signedLiveURL: failed to sign livestream URL")
 		return nil, err
@@ -92,15 +75,8 @@ func (r *Resolver) signedLiveURL(ctx context.Context, livestreamURL string) (*li
 // that entry's window. Unlike signedLiveURL it does not clamp the start: the
 // buffer is meant to replay the real program window, and the origin's start-over
 // retention is expected to cover it.
-//
-// Note: on the legacy path a window (end-start) longer than ~2h hits the
-// Lambda@Edge manifest-size limit described on maxLivestreamURLAgeFromStart. The
-// stream-proxy has no such limit. Entries are almost always shorter regardless;
-// revisit (e.g. chunked playback) if long buffers are needed rather than
-// truncating the window here.
-func (r *Resolver) signedBufferURL(ls liveSigning, livestreamURL string, start, end, expiresAt time.Time) (string, error) {
-	now := time.Now()
-	signedURL, _, err := r.signLiveManifestWith(ls, livestreamURL, expiresAt.Sub(now))
+func (r *Resolver) signedBufferURL(livestreamURL string, start, end, expiresAt time.Time, provider streamtoken.Provider) (string, error) {
+	signedURL, _, err := r.signLiveManifest(livestreamURL, time.Until(expiresAt), provider)
 	if err != nil {
 		log.L.Error().Err(err).Str("livestreamURL", livestreamURL).Msg("signedBufferURL: failed to sign livestream URL")
 		return "", err
@@ -108,53 +84,21 @@ func (r *Resolver) signedBufferURL(ls liveSigning, livestreamURL string, start,
 	return appendTimeShiftTags(signedURL, start, &end), nil
 }
 
-// signLiveManifestWith signs the livestream manifest URL for ttl using the
-// already-resolved signing decision (see resolveLiveSigning). It routes through
-// the stream-proxy (multi-CDN via ioriver) when the proxy path was selected, and
-// otherwise falls back to the legacy CloudFront canned-policy signer, whose URLs
-// are rewritten per-request by the Lambda@Edge manifest handler. It returns the
-// signed URL and its expiry, before any MediaPackage time-shift tags are
-// appended by the caller. On the proxy path that expiry is the advertised one,
-// which streamtoken.SignLiveURL deliberately reports earlier than the JWT's
-// `exp` claim; the legacy signer's expiry is exactly now+ttl.
+// signLiveManifest signs the livestream manifest URL for ttl as a stream-proxy
+// URL (multi-CDN via the proxy; provider names the upstream identity, see
+// pickLiveProvider). It returns the signed URL and its advertised expiry, before
+// any MediaPackage time-shift tags are appended by the caller. That expiry is
+// deliberately earlier than the JWT's `exp` claim (see streamtoken.SignLiveURL).
 //
-// The CDN/CloudFront signature signs the resource path, not the query, so the
+// The JWT authorizes the manifest's directory, not the exact query, so the
 // caller can safely append `start`/`end` time-shift params to the returned URL
-// without invalidating it (see appendTimeShiftTags). On the proxy path those
-// params travel to the proxy, which forwards them to the upstream manifest.
-func (r *Resolver) signLiveManifestWith(ls liveSigning, livestreamURL string, ttl time.Duration) (string, time.Time, error) {
-	if ls.useProxy {
-		u, err := url.Parse(livestreamURL)
-		if err != nil {
-			return "", time.Time{}, err
-		}
-		return ls.proxy.SignLiveURL(u.Path, ttl, ls.provider)
-	}
-	return r.LivestreamSigner.SignURLCanned(livestreamURL, ttl)
-}
-
-// livestreamExpiresAt returns when the signed URL should expire.
-//
-// On the legacy path it is at most livestreamURLExpiry from now and, when a
-// program is in progress, at most maxLivestreamURLAgeFromStart from its (clamped)
-// start time — the from-start cap exists because manifests larger than that
-// exceed the Lambda@Edge size limit. The stream-proxy has no such limit, so on
-// the proxy path (useProxy) the URL keeps the full livestreamURLExpiry.
-//
-// The result is the window handed to the signer as a ttl. On the proxy path the
-// minted JWT outlives it (streamtoken.SignLiveURL); on the legacy path it is the
-// signature's exact expiry.
-func livestreamExpiresAt(start *time.Time, now time.Time, useProxy bool) time.Time {
-	expiresAt := now.Add(livestreamURLExpiry)
-	if useProxy {
-		return expiresAt
-	}
-	if start != nil {
-		if capped := start.Add(maxLivestreamURLAgeFromStart); capped.Before(expiresAt) {
-			expiresAt = capped
-		}
+// (see appendTimeShiftTags); the proxy forwards them to the upstream manifest.
+func (r *Resolver) signLiveManifest(livestreamURL string, ttl time.Duration, provider streamtoken.Provider) (string, time.Time, error) {
+	u, err := url.Parse(livestreamURL)
+	if err != nil {
+		return "", time.Time{}, err
 	}
-	return expiresAt
+	return r.StreamURLSigner.SignLiveURL(u.Path, ttl, provider)
 }
 
 // clampStart caps start so it points at most maxLivestreamStartAge before now.
@@ -176,11 +120,9 @@ func clampStart(start, now time.Time) time.Time {
 //
 // MediaPackage v2 endpoints accept time-shift only as a query parameter — the
 // path-element form (.../start/<time>/index.m3u8) returns 400 there (verified
-// against the live egress endpoint). The values are concatenated raw rather than
-// via url.Values.Encode(), which would double-encode the already
-// percent-encoded CloudFront `EncodedPolicy`. The CloudFront canned policy signs
-// the resource path, not the query, so the extra params do not invalidate the
-// signature.
+// against the live egress endpoint). The values are concatenated raw so the
+// existing `jwt` query parameter is left untouched; the token authorizes the
+// manifest's directory, not the query, so the extra params do not invalidate it.
 func appendTimeShiftTags(signedURL string, start time.Time, end *time.Time) string {
 	sep := "?"
 	if strings.Contains(signedURL, "?") {
diff --git a/backend/graph/api/live_test.go b/backend/graph/api/live_test.go
index 78829afaf..552b0e88e 100644
--- a/backend/graph/api/live_test.go
+++ b/backend/graph/api/live_test.go
@@ -6,7 +6,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/bcc-code/bcc-media-platform/backend/signing"
 	"github.com/bcc-code/bcc-media-platform/backend/streamtoken"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -15,37 +14,30 @@ import (
 // liveTestStreamCfg is a minimal streamtoken.Config for building a proxy signer
 // in tests.
 type liveTestStreamCfg struct {
-	secret   string
-	issuer   string
-	domain   string
-	provider streamtoken.Provider
+	secret string
+	issuer string
+	domain string
 }
 
-func (c liveTestStreamCfg) GetStreamJWTSecret() string                     { return c.secret }
-func (c liveTestStreamCfg) GetStreamJWTIssuer() string                     { return c.issuer }
-func (c liveTestStreamCfg) GetStreamProxyDomain() string                   { return c.domain }
-func (c liveTestStreamCfg) GetStreamPrimaryProvider() streamtoken.Provider { return c.provider }
+func (c liveTestStreamCfg) GetStreamJWTSecret() string   { return c.secret }
+func (c liveTestStreamCfg) GetStreamJWTIssuer() string   { return c.issuer }
+func (c liveTestStreamCfg) GetStreamProxyDomain() string { return c.domain }
 
 func newLiveProxyResolver(t *testing.T) *Resolver {
 	t.Helper()
 	signer, err := streamtoken.NewSigner(liveTestStreamCfg{secret: "s", domain: "stream.example.com"})
 	require.NoError(t, err)
-	return &Resolver{
-		StreamURLSigner:       signer,
-		PrimaryStreamProvider: streamtoken.ProviderIoriver,
-	}
+	return &Resolver{StreamURLSigner: signer}
 }
 
-// TestSignLiveManifest_ProxyPath verifies that when the primary provider selects
-// the proxy, the livestream manifest is minted as a stream-proxy URL (jwt at the
-// proxy host) with the manifest path preserved, rather than a CloudFront
-// EncodedPolicy URL at the original host.
-func TestSignLiveManifest_ProxyPath(t *testing.T) {
+// TestSignLiveManifest verifies the livestream manifest is minted as a
+// stream-proxy URL (jwt at the proxy host) with the manifest path preserved,
+// rather than a URL at the original CDN host.
+func TestSignLiveManifest(t *testing.T) {
 	r := newLiveProxyResolver(t)
 
 	livestreamURL := "https://vod2.brunstad.tv/out/v1/aaaaaa/bbbbbb/index.m3u8"
-	ls := r.resolveLiveSigning(context.Background())
-	signed, expiresAt, err := r.signLiveManifestWith(ls, livestreamURL, time.Hour)
+	signed, expiresAt, err := r.signLiveManifest(livestreamURL, time.Hour, r.pickLiveProvider(context.Background()))
 	require.NoError(t, err)
 	assert.True(t, expiresAt.After(time.Now()))
 
@@ -54,22 +46,19 @@ func TestSignLiveManifest_ProxyPath(t *testing.T) {
 	assert.Equal(t, "stream.example.com", parsed.Host, "must point at the proxy, not the CDN")
 	assert.Equal(t, "/out/v1/aaaaaa/bbbbbb/index.m3u8", parsed.Path)
 	assert.NotEmpty(t, parsed.Query().Get("jwt"))
-	assert.Empty(t, parsed.Query().Get("EncodedPolicy"), "proxy path must not use CloudFront EncodedPolicy")
 }
 
-// TestSignLiveManifest_ProxyPathAdvertisedExpiry verifies the expiry that ends up
-// on Live.expiresAt: on the proxy path streamtoken mints the JWT for at least 7h
-// and reports an expiry 20m before it, so the advertised value outlives the
-// requested window while still preceding the token's own death.
-func TestSignLiveManifest_ProxyPathAdvertisedExpiry(t *testing.T) {
+// TestSignLiveManifest_AdvertisedExpiry verifies the expiry that ends up on
+// Live.expiresAt: streamtoken mints the JWT for at least 7h and reports an
+// expiry 20m before it, so the advertised value outlives the requested window
+// while still preceding the token's own death.
+func TestSignLiveManifest_AdvertisedExpiry(t *testing.T) {
 	r := newLiveProxyResolver(t)
 
 	livestreamURL := "https://vod2.brunstad.tv/out/v1/aaaaaa/bbbbbb/index.m3u8"
-	ls := r.resolveLiveSigning(context.Background())
-	require.True(t, ls.useProxy)
 
 	now := time.Now()
-	_, expiresAt, err := r.signLiveManifestWith(ls, livestreamURL, livestreamURLExpiry)
+	_, expiresAt, err := r.signLiveManifest(livestreamURL, livestreamURLExpiry, streamtoken.ProviderUnspecified)
 	require.NoError(t, err)
 
 	assert.True(t, expiresAt.After(now.Add(livestreamURLExpiry)),
@@ -78,16 +67,16 @@ func TestSignLiveManifest_ProxyPathAdvertisedExpiry(t *testing.T) {
 		"advertised expiry must land before the token's 7h lifetime")
 }
 
-// TestSignedBufferURL_ProxyPath verifies the buffer URL on the proxy path keeps
-// the time-shift window appended after the proxy jwt.
-func TestSignedBufferURL_ProxyPath(t *testing.T) {
+// TestSignedBufferURL verifies the buffer URL keeps the time-shift window
+// appended after the proxy jwt.
+func TestSignedBufferURL(t *testing.T) {
 	r := newLiveProxyResolver(t)
 
 	start := time.Unix(1513717228, 0)
 	end := time.Unix(1513720828, 0)
 	livestreamURL := "https://vod2.brunstad.tv/out/v1/aaaaaa/bbbbbb/index.m3u8"
 
-	signed, err := r.signedBufferURL(r.resolveLiveSigning(context.Background()), livestreamURL, start, end, time.Now().Add(time.Hour))
+	signed, err := r.signedBufferURL(livestreamURL, start, end, time.Now().Add(time.Hour), streamtoken.ProviderUnspecified)
 	require.NoError(t, err)
 
 	parsed, err := url.Parse(signed)
@@ -103,7 +92,7 @@ func TestAppendTimeShiftTags(t *testing.T) {
 	end := time.Unix(1513720828, 0)
 
 	t.Run("start only, appends with & when the signed query is already present", func(t *testing.T) {
-		in := "https://live.example.com/out/v1/abc/def/index.m3u8?EncodedPolicy=xyz%3D"
+		in := "https://live.example.com/out/v1/abc/def/index.m3u8?jwt=xyz"
 		got := appendTimeShiftTags(in, start, nil)
 		assert.Equal(t, in+"&start=1513717228", got)
 	})
@@ -115,7 +104,7 @@ func TestAppendTimeShiftTags(t *testing.T) {
 	})
 
 	t.Run("start and end, appends with & when the signed query is already present", func(t *testing.T) {
-		in := "https://live.example.com/out/v1/abc/def/index.m3u8?EncodedPolicy=xyz%3D"
+		in := "https://live.example.com/out/v1/abc/def/index.m3u8?jwt=xyz"
 		got := appendTimeShiftTags(in, start, &end)
 		assert.Equal(t, in+"&start=1513717228&end=1513720828", got)
 	})
@@ -150,78 +139,3 @@ func TestClampStart(t *testing.T) {
 		assert.Equal(t, start, clampStart(start, now))
 	})
 }
-
-func TestLivestreamExpiresAt(t *testing.T) {
-	now := time.Unix(1_700_000_000, 0)
-
-	// Legacy path (useProxy=false) keeps the Lambda@Edge from-start cap.
-	t.Run("no program in progress falls back to the default expiry", func(t *testing.T) {
-		assert.Equal(t, now.Add(livestreamURLExpiry), livestreamExpiresAt(nil, now, false))
-	})
-
-	t.Run("expiry is capped at 2h past the start time", func(t *testing.T) {
-		start := now.Add(-30 * time.Minute)
-		assert.Equal(t, start.Add(maxLivestreamURLAgeFromStart), livestreamExpiresAt(&start, now, false))
-	})
-
-	t.Run("a start at the clamp floor still yields a future expiry", func(t *testing.T) {
-		// start clamped to 90m ago -> expiry 90m ago + 2h = 30m from now.
-		start := now.Add(-maxLivestreamStartAge)
-		assert.Equal(t, now.Add(30*time.Minute), livestreamExpiresAt(&start, now, false))
-	})
-
-	// Proxy path (useProxy=true) has no Lambda size limit, so the from-start cap
-	// does not apply — the URL keeps the full livestreamURLExpiry (C).
-	t.Run("proxy path is not capped from start", func(t *testing.T) {
-		start := now.Add(-30 * time.Minute)
-		assert.Equal(t, now.Add(livestreamURLExpiry), livestreamExpiresAt(&start, now, true))
-	})
-
-	t.Run("proxy path ignores an old start entirely", func(t *testing.T) {
-		start := now.Add(-3 * time.Hour)
-		assert.Equal(t, now.Add(livestreamURLExpiry), livestreamExpiresAt(&start, now, true))
-	})
-}
-
-// TestCanSignLive covers the signer-availability gate (D): the proxy path is
-// always serviceable, while the legacy path needs the dedicated CloudFront
-// livestream signer configured.
-func TestCanSignLive(t *testing.T) {
-	t.Run("proxy path is available even without the legacy signer", func(t *testing.T) {
-		r := &Resolver{}
-		assert.True(t, r.canSignLive(liveSigning{useProxy: true}))
-	})
-
-	t.Run("legacy path without a signer is not available", func(t *testing.T) {
-		r := &Resolver{}
-		assert.False(t, r.canSignLive(liveSigning{useProxy: false}))
-	})
-
-	t.Run("legacy path with a signer is available", func(t *testing.T) {
-		r := &Resolver{LivestreamSigner: &signing.CloudFrontSigner{}}
-		assert.True(t, r.canSignLive(liveSigning{useProxy: false}))
-	})
-}
-
-// TestBufferGate_ProxyEnablesBuffersWithoutLegacySigner guards the calendar
-// buffer gate (bufferWindowForEntry) against regressing to a legacy-only check.
-// The gate is `!r.canSignLive(r.resolveLiveSigning(ctx))`, so a proxy-primary
-// resolver with no legacy LivestreamSigner must still be able to sign — i.e.
-// buffers are offered, not silently dropped.
-func TestBufferGate_ProxyEnablesBuffersWithoutLegacySigner(t *testing.T) {
-	r := newLiveProxyResolver(t) // StreamURLSigner set, LivestreamSigner nil, ProviderIoriver
-	require.Nil(t, r.LivestreamSigner)
-
-	assert.True(t, r.canSignLive(r.resolveLiveSigning(context.Background())),
-		"proxy path must permit calendar buffers even without the legacy livestream signer")
-}
-
-// TestSignedLiveURL_NoSigner verifies signedLiveURL reports "no URL" (nil result)
-// without error — and without touching the database — when no signer is
-// configured for the selected path, so the resolver serves the online flag only.
-func TestSignedLiveURL_NoSigner(t *testing.T) {
-	r := &Resolver{} // no StreamURLSigner and no LivestreamSigner
-	signed, err := r.signedLiveURL(context.Background(), "https://vod2.brunstad.tv/out/v1/aaaaaa/bbbbbb/index.m3u8")
-	require.NoError(t, err)
-	assert.Nil(t, signed)
-}
diff --git a/backend/graph/api/resolver.go b/backend/graph/api/resolver.go
index 77ba464a1..49ba2f6c0 100644
--- a/backend/graph/api/resolver.go
+++ b/backend/graph/api/resolver.go
@@ -74,9 +74,6 @@ type Resolver struct {
 	EmailService          *email.Service
 	FileSigner            *signing.CloudFrontSigner
 	StreamURLSigner       *streamtoken.Signer
-	LegacyStreamSigner    *signing.CloudFrontStreamSigner
-	LivestreamSigner      *signing.CloudFrontSigner
-	PrimaryStreamProvider streamtoken.Provider
 	S3Client              *s3.Client
 	APIConfig             apiConfig
 	AWSConfig             awsConfig
@@ -117,128 +114,48 @@ func (r *Resolver) GetFileSigner() *signing.CloudFrontSigner {
 	return r.FileSigner
 }
 
-func (r *Resolver) GetLegacyStreamSigner() *signing.CloudFrontStreamSigner {
-	return r.LegacyStreamSigner
+// GetStreamSigner returns the stream-proxy URL signer (used by the export).
+func (r *Resolver) GetStreamSigner() *streamtoken.Signer {
+	return r.StreamURLSigner
 }
 
-// streamSigner is the per-request signer interface satisfied by both
-// streamtoken.Signer (new stream-proxy + JWT path) and
-// signing.CloudFrontStreamSigner (legacy CloudFront EncodedPolicy path).
-type streamSigner interface {
-	SignURL(streamPath string, ttl time.Duration, provider streamtoken.Provider) (string, time.Time, error)
-}
-
-// pickStreamSigner picks the per-request stream URL signer.
+// pickStreamProvider picks the upstream CDN identity for this request's VOD
+// stream URLs, carried as the JWT `provider` claim to the stream-proxy.
 //
-// Routing rules:
-//   - The Unleash `cdn-provider` flag's `cloudfront-direct` variant, when
-//     present on a request, forces the legacy CloudFront-direct signer
-//     regardless of env. Kept as an emergency rollback during the
-//     stream-proxy rollout.
-//   - Otherwise the configured PrimaryStreamProvider decides: only
-//     STREAM_PRIMARY_PROVIDER=streamproxy (parsed to
-//     streamtoken.ProviderIoriver) routes through the stream-proxy +
-//     HS256 JWT signer. Every other value — `cloudfront`, unset, or
-//     anything unrecognised — falls through to the legacy CloudFront EncodedPolicy signer.
-func (r *Resolver) pickStreamSigner(ctx context.Context) (streamSigner, streamtoken.Provider) {
-	ginCtx, _ := utils.GinCtx(ctx)
-	if ginCtx != nil {
-		flags := utils.GetFeatureFlags(ginCtx)
-		v, ok := flags.GetVariant(unleash.StreamCDNProviderFlag)
-		// Reported either way: the flag being absent here is the control
-		// observation Unleash needs to show anything but 100% adoption.
-		unleash.ReportConsidered(ginCtx, unleash.StreamCDNProviderFlag, v, ok)
-		if ok {
-			switch v {
-			case unleash.StreamCDNProxyIORiver:
-				return r.StreamURLSigner, streamtoken.ProviderIoriver
-			case unleash.StreamCDNProxyCF:
-				return r.StreamURLSigner, streamtoken.ProviderCloudFront
-			default:
-				return r.LegacyStreamSigner, streamtoken.DefaultPrimaryProvider
-			}
-		}
-	}
-
-	if r.PrimaryStreamProvider != streamtoken.ProviderIoriver {
-		return r.LegacyStreamSigner, streamtoken.DefaultPrimaryProvider
-	}
-
-	return r.StreamURLSigner, streamtoken.DefaultPrimaryProvider
+// The Unleash `cdn-provider` flag's variant decides: `ioriver` or `cloudfront`
+// select that proxy identity explicitly; an absent flag or an unknown variant
+// yields ProviderUnspecified, which the signer resolves to
+// streamtoken.DefaultPrimaryProvider (ioriver).
+func (r *Resolver) pickStreamProvider(ctx context.Context) streamtoken.Provider {
+	return pickProviderFromFlag(ctx, unleash.StreamCDNProviderFlag)
 }
 
-// pickLiveProxySigner decides whether livestream manifests should be minted as
-// stream-proxy URLs (multi-CDN via ioriver) or fall back to the legacy
-// CloudFront canned-policy signer + Lambda@Edge manifest rewriter. It mirrors
-// pickStreamSigner's routing but returns the concrete *streamtoken.Signer
-// (SignLiveURL is not on the shared streamSigner interface) and an ok flag:
-//   - ok == false → use the legacy r.LivestreamSigner path.
-//   - ok == true  → mint a proxy URL with the returned signer and provider.
-//
-// The `live-cdn-provider` Unleash flag routes live independently of VOD's
-// `cdn-provider`: its `cloudfront-direct` variant forces the legacy path
-// (live-only emergency rollback); when the flag is absent the configured
-// PrimaryStreamProvider decides. When the proxy signer is not configured we
-// always fall back so live keeps working.
-func (r *Resolver) pickLiveProxySigner(ctx context.Context) (*streamtoken.Signer, streamtoken.Provider, bool) {
-	if r.StreamURLSigner == nil {
-		return nil, streamtoken.ProviderUnspecified, false
-	}
+// pickLiveProvider is the livestream counterpart of pickStreamProvider, driven
+// by the `live-cdn-provider` flag so live can be routed independently of VOD.
+func (r *Resolver) pickLiveProvider(ctx context.Context) streamtoken.Provider {
+	return pickProviderFromFlag(ctx, unleash.LiveCDNProviderFlag)
+}
 
+func pickProviderFromFlag(ctx context.Context, flag string) streamtoken.Provider {
 	ginCtx, _ := utils.GinCtx(ctx)
-	if ginCtx != nil {
-		flags := utils.GetFeatureFlags(ginCtx)
-		v, ok := flags.GetVariant(unleash.LiveCDNProviderFlag)
-		unleash.ReportConsidered(ginCtx, unleash.LiveCDNProviderFlag, v, ok)
-		if ok {
-			switch v {
-			case unleash.StreamCDNProxyIORiver:
-				return r.StreamURLSigner, streamtoken.ProviderIoriver, true
-			case unleash.StreamCDNProxyCF:
-				return r.StreamURLSigner, streamtoken.ProviderCloudFront, true
-			default:
-				return nil, streamtoken.ProviderUnspecified, false
-			}
-		}
+	if ginCtx == nil {
+		return streamtoken.ProviderUnspecified
 	}
-
-	if r.PrimaryStreamProvider != streamtoken.ProviderIoriver {
-		return nil, streamtoken.ProviderUnspecified, false
+	flags := utils.GetFeatureFlags(ginCtx)
+	v, ok := flags.GetVariant(flag)
+	// Reported either way: the flag being absent here is the control
+	// observation Unleash needs to show anything but 100% adoption.
+	unleash.ReportConsidered(ginCtx, flag, v, ok)
+	if !ok {
+		return streamtoken.ProviderUnspecified
 	}
-
-	return r.StreamURLSigner, streamtoken.DefaultPrimaryProvider, true
-}
-
-// liveSigning is the per-request resolution of which signer mints the livestream
-// manifest URL. The decision is resolved once per request (resolveLiveSigning)
-// and shared by URL-expiry selection (livestreamExpiresAt) and signing
-// (signLiveManifestWith), so the two cannot disagree.
-//
-// pickLiveProxySigner also has a telemetry side effect
-// (unleash.ReportConsidered), but that no longer depends on this: it dedups per
-// request internally.
-type liveSigning struct {
-	proxy    *streamtoken.Signer // signer for the proxy path; nil on the legacy path
-	provider streamtoken.Provider
-	useProxy bool
-}
-
-// resolveLiveSigning decides, once, whether this request's livestream manifest
-// is minted through the stream-proxy or the legacy CloudFront signer.
-func (r *Resolver) resolveLiveSigning(ctx context.Context) liveSigning {
-	signer, provider, useProxy := r.pickLiveProxySigner(ctx)
-	return liveSigning{proxy: signer, provider: provider, useProxy: useProxy}
-}
-
-// canSignLive reports whether a signer capable of producing a URL is configured
-// for the resolved path. The proxy path is always ready (pickLiveProxySigner
-// only selects it when StreamURLSigner is set); the legacy path needs the
-// dedicated CloudFront livestream signer.
-func (r *Resolver) canSignLive(ls liveSigning) bool {
-	if ls.useProxy {
-		return true
+	switch v {
+	case unleash.StreamCDNProxyIORiver:
+		return streamtoken.ProviderIoriver
+	case unleash.StreamCDNProxyCF:
+		return streamtoken.ProviderCloudFront
 	}
-	return r.LivestreamSigner != nil
+	return streamtoken.ProviderUnspecified
 }
 
 func (r *Resolver) GetCDNConfig() export.CDNConfig {
@@ -260,7 +177,6 @@ type awsConfig interface {
 type apiConfig interface {
 	GetVOD2Domain() string
 	GetFilesCDNDomain() string
-	GetLegacyVODDomain() string
 }
 
 type redirectConfig interface {
diff --git a/backend/graph/api/resolver_test.go b/backend/graph/api/resolver_test.go
index 69d038c79..d1dadca5f 100644
--- a/backend/graph/api/resolver_test.go
+++ b/backend/graph/api/resolver_test.go
@@ -5,7 +5,6 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"github.com/bcc-code/bcc-media-platform/backend/signing"
 	"github.com/bcc-code/bcc-media-platform/backend/streamtoken"
 	"github.com/bcc-code/bcc-media-platform/backend/unleash"
 	"github.com/bcc-code/bcc-media-platform/backend/utils"
@@ -45,21 +44,17 @@ func ctxWithFeatureFlagReporting(t *testing.T, header string) (context.Context,
 	return ctx, reporter
 }
 
-// TestPickStreamSignerReportsUsage covers the reporting side effect of the
-// stream-signer decision: the flag is counted whether or not it is set, since
-// the flag-was-off case is the control Unleash needs.
-func TestPickStreamSignerReportsUsage(t *testing.T) {
-	r := &Resolver{
-		StreamURLSigner:       &streamtoken.Signer{},
-		LegacyStreamSigner:    &signing.CloudFrontStreamSigner{},
-		PrimaryStreamProvider: streamtoken.ProviderIoriver,
-	}
+// TestPickStreamProviderReportsUsage covers the reporting side effect of the
+// provider decision: the flag is counted whether or not it is set, since the
+// flag-was-off case is the control Unleash needs.
+func TestPickStreamProviderReportsUsage(t *testing.T) {
+	r := &Resolver{StreamURLSigner: &streamtoken.Signer{}}
 
 	t.Run("flag set counts yes with its variant", func(t *testing.T) {
 		header := unleash.StreamCDNProviderFlag + ":" + unleash.StreamCDNProxyIORiver
 		ctx, reporter := ctxWithFeatureFlagReporting(t, header)
 
-		r.pickStreamSigner(ctx)
+		r.pickStreamProvider(ctx)
 
 		assert.Equal(t, map[string]unleash.FlagCounts{
 			unleash.StreamCDNProviderFlag: {
@@ -72,7 +67,7 @@ func TestPickStreamSignerReportsUsage(t *testing.T) {
 	t.Run("flag absent counts no", func(t *testing.T) {
 		ctx, reporter := ctxWithFeatureFlagReporting(t, "")
 
-		r.pickStreamSigner(ctx)
+		r.pickStreamProvider(ctx)
 
 		assert.Equal(t, map[string]unleash.FlagCounts{
 			unleash.StreamCDNProviderFlag: {No: 1, Variants: map[string]int{}},
@@ -85,7 +80,7 @@ func TestPickStreamSignerReportsUsage(t *testing.T) {
 
 		// A single query resolving many streams hits this path per stream.
 		for range 40 {
-			r.pickStreamSigner(ctx)
+			r.pickStreamProvider(ctx)
 		}
 
 		counts := reporter.Snapshot()[unleash.StreamCDNProviderFlag]
@@ -98,52 +93,42 @@ func TestPickStreamSignerReportsUsage(t *testing.T) {
 			URL:   "http://example.invalid",
 			Token: "test",
 		})
-		r.pickStreamSigner(context.Background())
+		r.pickStreamProvider(context.Background())
 		assert.Empty(t, reporter.Snapshot())
 	})
 }
 
-func TestPickStreamSigner(t *testing.T) {
-	streamProxySigner := &streamtoken.Signer{}
-	cfSigner := &signing.CloudFrontStreamSigner{}
+func TestPickStreamProvider(t *testing.T) {
+	r := &Resolver{StreamURLSigner: &streamtoken.Signer{}}
 
-	makeResolver := func(p streamtoken.Provider) *Resolver {
-		return &Resolver{
-			StreamURLSigner:       streamProxySigner,
-			LegacyStreamSigner:    cfSigner,
-			PrimaryStreamProvider: p,
-		}
-	}
+	t.Run("flag variant ioriver", func(t *testing.T) {
+		header := unleash.StreamCDNProviderFlag + ":" + unleash.StreamCDNProxyIORiver
+		assert.Equal(t, streamtoken.ProviderIoriver, r.pickStreamProvider(ctxWithFeatureFlagsHeader(t, header)))
+	})
 
-	t.Run("env=streamproxy routes through stream-proxy", func(t *testing.T) {
-		r := makeResolver(streamtoken.ProviderIoriver)
-		got, _ := r.pickStreamSigner(ctxWithFeatureFlagsHeader(t, ""))
-		assert.Same(t, streamSigner(streamProxySigner), got)
+	t.Run("flag variant cloudfront selects the proxy's direct-CloudFront identity", func(t *testing.T) {
+		header := unleash.StreamCDNProviderFlag + ":" + unleash.StreamCDNProxyCF
+		assert.Equal(t, streamtoken.ProviderCloudFront, r.pickStreamProvider(ctxWithFeatureFlagsHeader(t, header)))
 	})
 
-	t.Run("env=cloudfront returns CloudFront-direct signer", func(t *testing.T) {
-		r := makeResolver(streamtoken.ProviderCloudFront)
-		got, _ := r.pickStreamSigner(ctxWithFeatureFlagsHeader(t, ""))
-		assert.Same(t, streamSigner(cfSigner), got)
+	t.Run("unknown variant falls back to the signer default", func(t *testing.T) {
+		header := unleash.StreamCDNProviderFlag + ":cloudfront-direct"
+		assert.Equal(t, streamtoken.ProviderUnspecified, r.pickStreamProvider(ctxWithFeatureFlagsHeader(t, header)))
 	})
 
-	t.Run("env empty (unspecified) returns CloudFront-direct signer", func(t *testing.T) {
-		r := makeResolver(streamtoken.ProviderUnspecified)
-		got, _ := r.pickStreamSigner(ctxWithFeatureFlagsHeader(t, ""))
-		assert.Same(t, streamSigner(cfSigner), got)
+	t.Run("flag absent falls back to the signer default", func(t *testing.T) {
+		assert.Equal(t, streamtoken.ProviderUnspecified, r.pickStreamProvider(ctxWithFeatureFlagsHeader(t, "")))
 	})
 
-	t.Run("legacy unleash flag forces CloudFront-direct even when env=streamproxy", func(t *testing.T) {
-		r := makeResolver(streamtoken.ProviderIoriver)
-		header := unleash.StreamCDNProviderFlag + ":" + unleash.StreamCDNCloudfrontDirect
-		got, _ := r.pickStreamSigner(ctxWithFeatureFlagsHeader(t, header))
-		assert.Same(t, streamSigner(cfSigner), got)
+	t.Run("nil gin context falls back to the signer default", func(t *testing.T) {
+		assert.Equal(t, streamtoken.ProviderUnspecified, r.pickStreamProvider(context.Background()))
 	})
 
-	t.Run("nil gin context falls back to env routing", func(t *testing.T) {
-		r := makeResolver(streamtoken.ProviderIoriver)
-		got, _ := r.pickStreamSigner(context.Background())
-		assert.Same(t, streamSigner(streamProxySigner), got)
+	t.Run("live flag is read independently of the VOD flag", func(t *testing.T) {
+		header := unleash.LiveCDNProviderFlag + ":" + unleash.StreamCDNProxyCF
+		ctx := ctxWithFeatureFlagsHeader(t, header)
+		assert.Equal(t, streamtoken.ProviderCloudFront, r.pickLiveProvider(ctx))
+		assert.Equal(t, streamtoken.ProviderUnspecified, r.pickStreamProvider(ctx))
 	})
 
 	// Sanity: keep test in sync with feature-flags helper.
diff --git a/backend/graph/api/shorts.resolvers.go b/backend/graph/api/shorts.resolvers.go
index aa1307365..6b97bd6c4 100644
--- a/backend/graph/api/shorts.resolvers.go
+++ b/backend/graph/api/shorts.resolvers.go
@@ -68,7 +68,7 @@ func (r *shortResolver) Streams(ctx context.Context, obj *model.Short) ([]*model
 		return nil, err
 	}
 
-	streamSigner, selectedCDN := r.pickStreamSigner(ctx)
+	selectedCDN := r.pickStreamProvider(ctx)
 
 	var out []*model.Stream
 	for _, s := range streams {
@@ -77,7 +77,7 @@ func (r *shortResolver) Streams(ctx context.Context, obj *model.Short) ([]*model
 		}
 		// For now we are testing out different stream configs manually by overriding the path
 		s.Path = strings.Replace(s.Path, "ab9e7540a3e34bee86ec6af8c7cdc342/1467e3c2761c4947ae7dc7a6c162747f", "942b3eed46ad4ec48e539fa12f81b50e/7cae744530a849bf8b2f61295c802b48", 1)
-		stream, err := model.StreamFrom(ctx, streamSigner, s, selectedCDN)
+		stream, err := model.StreamFrom(ctx, r.StreamURLSigner, s, selectedCDN)
 		if err != nil {
 			return nil, err
 		}
diff --git a/backend/signing/cloudfront.go b/backend/signing/cloudfront.go
index 74d165fdd..e4d58e666 100644
--- a/backend/signing/cloudfront.go
+++ b/backend/signing/cloudfront.go
@@ -1,14 +1,8 @@
 package signing
 
 import (
-	"net/url"
-	"regexp"
-	"strings"
-	"time"
-
 	"github.com/ansel1/merry/v2"
 	"github.com/aws/aws-sdk-go/service/cloudfront/sign"
-	"github.com/bcc-code/bcc-media-platform/backend/streamtoken"
 )
 
 // CloudFrontConfig supplies the CloudFront signing key path and key ID.
@@ -43,101 +37,3 @@ func NewCloudFrontSigner(cfg CloudFrontConfig) (*CloudFrontSigner, error) {
 func (s *CloudFrontSigner) SignWithPolicy(url string, policy *sign.Policy) (string, error) {
 	return s.inner.SignWithPolicy(url, policy)
 }
-
-// SignURLCanned signs an absolute URL with a canned policy authorizing the
-// resource's parent directory (`<dir>/*`) for ttl, returning the original URL
-// with the CloudFront signature embedded in a single `EncodedPolicy` query
-// parameter plus the expiry time.
-//
-// Unlike CloudFrontStreamSigner.SignURL it makes no assumptions about the path
-// layout, so it works for arbitrary configured URLs (e.g. a livestream
-// manifest). Mirrors the bcc-connect-live livestream signer.
-func (s *CloudFrontSigner) SignURLCanned(rawURL string, ttl time.Duration) (string, time.Time, error) {
-	urlToSign, err := url.Parse(rawURL)
-	if err != nil {
-		return "", time.Time{}, merry.Wrap(err)
-	}
-
-	// Authorize everything in the same directory as the resource.
-	parts := strings.Split(rawURL, "/")
-	dir := strings.Join(parts[:len(parts)-1], "/")
-
-	expiresAt := time.Now().Add(ttl)
-	policy := sign.NewCannedPolicy(dir+"/*", expiresAt)
-	signed, err := s.inner.SignWithPolicy(urlToSign.String(), policy)
-	if err != nil {
-		return "", time.Time{}, merry.Wrap(err)
-	}
-
-	signedURL, err := url.Parse(signed)
-	if err != nil {
-		return "", time.Time{}, merry.Wrap(err)
-	}
-
-	urlToSign.RawQuery = "EncodedPolicy=" + url.QueryEscape(signedURL.RawQuery)
-	return urlToSign.String(), expiresAt, nil
-}
-
-// streamBasePathRegex matches the `/out/v1/<group1>/<group2>` prefix of a
-// MediaPackage manifest path — the directory level the legacy CloudFront
-// stream signer authorizes with a `<dir>/*` canned policy.
-var streamBasePathRegex = regexp.MustCompile(`(/out/v1/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+)`)
-
-// CloudFrontStreamSigner mints stream URLs in the legacy CloudFront form:
-// the original path is preserved and a single `EncodedPolicy=<urlencoded>`
-// query parameter carries the CloudFront `Policy`/`Signature`/`Key-Pair-Id`
-// triple that authorizes the manifest's parent directory.
-//
-// Used as the default (feature-flag-off) path; the new stream-proxy + JWT
-// flow lives in backend/streamtoken.
-type CloudFrontStreamSigner struct {
-	cf        *CloudFrontSigner
-	cdnDomain string
-}
-
-// NewCloudFrontStreamSigner pairs a CloudFrontSigner with the VOD2 CDN host
-// the resulting URLs should point at.
-func NewCloudFrontStreamSigner(cf *CloudFrontSigner, cdnDomain string) *CloudFrontStreamSigner {
-	return &CloudFrontStreamSigner{cf: cf, cdnDomain: cdnDomain}
-}
-
-// SignURL signs the directory containing the manifest with a `<dir>/*` canned
-// policy and returns the original URL with the signature embedded in
-// `EncodedPolicy`. Matches the streamURLSigner interface used by
-// model.StreamFrom and streamtoken.Signer. The provider argument is unused
-// here — the legacy CloudFront signer has a single CDN identity.
-func (s *CloudFrontStreamSigner) SignURL(streamPath string, ttl time.Duration, _ streamtoken.Provider) (string, time.Time, error) {
-	pathToSign := streamBasePathRegex.FindString(streamPath)
-	if pathToSign == "" {
-		return "", time.Time{}, merry.New("path does not match expected stream layout: " + streamPath)
-	}
-
-	urlToSign := url.URL{
-		Path:   pathToSign,
-		Host:   s.cdnDomain,
-		Scheme: "https",
-	}
-
-	expiresAt := time.Now().Add(ttl)
-
-	// The `*` is added via the policy resource (not the URL path) so the AWS
-	// SDK doesn't URL-encode it.
-	policy := sign.NewCannedPolicy(urlToSign.String()+"/*", expiresAt)
-	signed, err := s.cf.SignWithPolicy(urlToSign.String(), policy)
-	if err != nil {
-		return "", time.Time{}, err
-	}
-
-	signedURL, err := url.Parse(signed)
-	if err != nil {
-		return "", time.Time{}, err
-	}
-
-	out := url.URL{
-		RawQuery: "EncodedPolicy=" + url.QueryEscape(signedURL.RawQuery),
-		Path:     streamPath,
-		Host:     s.cdnDomain,
-		Scheme:   "https",
-	}
-	return out.String(), expiresAt, nil
-}
diff --git a/backend/signing/cloudfront_test.go b/backend/signing/cloudfront_test.go
index 3e9ed3d1a..d133d7251 100644
--- a/backend/signing/cloudfront_test.go
+++ b/backend/signing/cloudfront_test.go
@@ -2,7 +2,6 @@ package signing
 
 import (
 	"net/url"
-	"strings"
 	"testing"
 	"time"
 
@@ -35,108 +34,3 @@ func TestCloudFrontSignerSignWithPolicy(t *testing.T) {
 	assert.NotEmpty(t, parsed.Query().Get("Signature"))
 	assert.NotEmpty(t, parsed.Query().Get("Policy"))
 }
-
-func TestCloudFrontStreamSignerSignURL(t *testing.T) {
-	keyPath := writeTempPEM(t)
-
-	cfg := &mocks.CloudFrontConfig{}
-	cfg.On("GetAwsSigningKeyPath").Return(keyPath)
-	cfg.On("GetAwsSigningKeyID").Return("CF-ID")
-
-	cf, err := NewCloudFrontSigner(cfg)
-	require.NoError(t, err)
-
-	signer := NewCloudFrontStreamSigner(cf, "vod2.example.com")
-
-	streamPath := "/out/v1/aaaaaaaaaaaaaaaaaaaa/bbbbbbbbbbbbbbbbbbbb/ccccccccccccccccccc/ddddd/index.m3u8"
-	signedURL, expiresAt, err := signer.SignURL(streamPath, time.Hour, "" /* provider unused */)
-	require.NoError(t, err)
-
-	assert.WithinDuration(t, time.Now().Add(time.Hour), expiresAt, 5*time.Second)
-
-	parsed, err := url.Parse(signedURL)
-	require.NoError(t, err)
-	assert.Equal(t, "https", parsed.Scheme)
-	assert.Equal(t, "vod2.example.com", parsed.Host)
-	assert.Equal(t, streamPath, parsed.Path, "original path must be preserved")
-
-	encoded := parsed.Query().Get("EncodedPolicy")
-	require.NotEmpty(t, encoded, "EncodedPolicy parameter must be present")
-
-	innerQuery, err := url.ParseQuery(encoded)
-	require.NoError(t, err)
-	assert.Equal(t, "CF-ID", innerQuery.Get("Key-Pair-Id"))
-	assert.NotEmpty(t, innerQuery.Get("Policy"))
-	assert.NotEmpty(t, innerQuery.Get("Signature"))
-}
-
-func TestCloudFrontStreamSignerSignURLHyphenatedChannelPath(t *testing.T) {
-	keyPath := writeTempPEM(t)
-
-	cfg := &mocks.CloudFrontConfig{}
-	cfg.On("GetAwsSigningKeyPath").Return(keyPath)
-	cfg.On("GetAwsSigningKeyID").Return("CF-ID")
-
-	cf, err := NewCloudFrontSigner(cfg)
-	require.NoError(t, err)
-
-	signer := NewCloudFrontStreamSigner(cf, "vod2.example.com")
-
-	streamPath := "/out/v1/some-channel/live/cloudfront/index.m3u8"
-	signedURL, _, err := signer.SignURL(streamPath, time.Hour, "" /* provider unused */)
-	require.NoError(t, err)
-
-	parsed, err := url.Parse(signedURL)
-	require.NoError(t, err)
-	assert.Equal(t, streamPath, parsed.Path, "original path must be preserved")
-	require.NotEmpty(t, parsed.Query().Get("EncodedPolicy"), "EncodedPolicy parameter must be present")
-}
-
-func TestCloudFrontSignerSignURLCanned(t *testing.T) {
-	keyPath := writeTempPEM(t)
-
-	cfg := &mocks.CloudFrontConfig{}
-	cfg.On("GetAwsSigningKeyPath").Return(keyPath)
-	cfg.On("GetAwsSigningKeyID").Return("CF-ID")
-
-	signer, err := NewCloudFrontSigner(cfg)
-	require.NoError(t, err)
-
-	rawURL := "https://live.example.com/out/v1/abc/def/index.m3u8"
-	signedURL, expiresAt, err := signer.SignURLCanned(rawURL, time.Hour)
-	require.NoError(t, err)
-
-	assert.WithinDuration(t, time.Now().Add(time.Hour), expiresAt, 5*time.Second)
-
-	parsed, err := url.Parse(signedURL)
-	require.NoError(t, err)
-	assert.Equal(t, "https", parsed.Scheme)
-	assert.Equal(t, "live.example.com", parsed.Host)
-	assert.Equal(t, "/out/v1/abc/def/index.m3u8", parsed.Path, "original path must be preserved")
-
-	encoded := parsed.Query().Get("EncodedPolicy")
-	require.NotEmpty(t, encoded, "EncodedPolicy parameter must be present")
-
-	innerQuery, err := url.ParseQuery(encoded)
-	require.NoError(t, err)
-	assert.Equal(t, "CF-ID", innerQuery.Get("Key-Pair-Id"))
-	assert.NotEmpty(t, innerQuery.Get("Policy"))
-	assert.NotEmpty(t, innerQuery.Get("Signature"))
-}
-
-func TestCloudFrontStreamSignerRejectsBadPath(t *testing.T) {
-	keyPath := writeTempPEM(t)
-
-	cfg := &mocks.CloudFrontConfig{}
-	cfg.On("GetAwsSigningKeyPath").Return(keyPath)
-	cfg.On("GetAwsSigningKeyID").Return("CF-ID")
-
-	cf, err := NewCloudFrontSigner(cfg)
-	require.NoError(t, err)
-
-	signer := NewCloudFrontStreamSigner(cf, "vod2.example.com")
-
-	_, _, err = signer.SignURL("/some/non-stream/path.m3u8", time.Hour, "" /* provider unused */)
-	require.Error(t, err)
-	assert.True(t, strings.Contains(err.Error(), "expected stream layout"))
-}
diff --git a/backend/streamtoken/signer.go b/backend/streamtoken/signer.go
index c6c6f9673..18d03c191 100644
--- a/backend/streamtoken/signer.go
+++ b/backend/streamtoken/signer.go
@@ -20,11 +20,6 @@ type Config interface {
 	GetStreamJWTSecret() string
 	GetStreamJWTIssuer() string
 	GetStreamProxyDomain() string
-	// GetStreamPrimaryProvider is the upstream CDN baked into JWTs when the
-	// caller of SignURL passes ProviderUnspecified. Returning
-	// ProviderUnspecified here means "use the package default"
-	// (DefaultPrimaryProvider).
-	GetStreamPrimaryProvider() Provider
 }
 
 // Provider names the upstream CDN identity the stream-proxy should use to
@@ -33,18 +28,16 @@ type Config interface {
 type Provider string
 
 const (
-	// ProviderUnspecified means the JWT carries no provider claim; the proxy
-	// falls back to its configured default.
+	// ProviderUnspecified means the caller has no preference; the Signer
+	// substitutes DefaultPrimaryProvider.
 	ProviderUnspecified Provider = ""
-	// ProviderCloudFront routes upstream traffic directly to CloudFront,
-	// signed with the CloudFront-direct key pair.
+	// ProviderCloudFront routes upstream traffic through the stream-proxy's
+	// direct-CloudFront identity (its own key pair, no ioriver).
 	ProviderCloudFront Provider = "cloudfront"
 	// ProviderIoriver routes upstream traffic via the ioriver-issued key
 	// pair, producing signatures valid for any of ioriver's sub-providers
 	// (CloudFront, Fastly, Akamai). The string value matches the JWT
-	// `provider` claim the stream-proxy switches on; the API exposes the
-	// same routing decision under the user-facing name "streamproxy" and
-	// translates to this constant at config-read time.
+	// `provider` claim the stream-proxy switches on.
 	ProviderIoriver Provider = "ioriver"
 )
 
@@ -59,18 +52,18 @@ func (p Provider) Valid() bool {
 	return false
 }
 
-// DefaultPrimaryProvider is the provider claim baked into JWTs when neither
-// the SignURL caller nor Config specifies one. CloudFront-direct is the
-// safer default since its key pair is always populated in production.
-const DefaultPrimaryProvider = ProviderCloudFront
+// DefaultPrimaryProvider is the provider claim baked into JWTs when the
+// SignURL caller passes ProviderUnspecified. ioriver is the multi-CDN identity
+// and the production default; the `cdn-provider` / `live-cdn-provider` Unleash
+// variants can override it per request (see graph/api Resolver.pickStreamProvider).
+const DefaultPrimaryProvider = ProviderIoriver
 
 // Signer mints stream-proxy URLs with embedded HS256 JWTs.
 type Signer struct {
-	secret          []byte
-	issuer          string
-	proxyScheme     string
-	proxyDomain     string
-	primaryProvider Provider
+	secret      []byte
+	issuer      string
+	proxyScheme string
+	proxyDomain string
 }
 
 // NewSigner returns a Signer or an error if required config is missing.
@@ -84,18 +77,11 @@ func NewSigner(cfg Config) (*Signer, error) {
 		return nil, fmt.Errorf("STREAM_PROXY_DOMAIN is empty")
 	}
 	scheme, host := splitProxyScheme(domain)
-	primary := cfg.GetStreamPrimaryProvider()
-	if primary == ProviderUnspecified {
-		primary = DefaultPrimaryProvider
-	} else if !primary.Valid() {
-		return nil, fmt.Errorf("STREAM_PRIMARY_PROVIDER is invalid: %q", primary)
-	}
 	return &Signer{
-		secret:          []byte(secret),
-		issuer:          cfg.GetStreamJWTIssuer(),
-		proxyScheme:     scheme,
-		proxyDomain:     host,
-		primaryProvider: primary,
+		secret:      []byte(secret),
+		issuer:      cfg.GetStreamJWTIssuer(),
+		proxyScheme: scheme,
+		proxyDomain: host,
 	}, nil
 }
 
@@ -122,8 +108,8 @@ var streamBasePathRegex = regexp.MustCompile(`(/out/v1/[a-zA-Z0-9_-]+/[a-zA-Z0-9
 // with an HS256 JWT in the `jwt` query parameter. The token's `base` claim
 // authorizes any path under the manifest's directory so variant playlists and
 // segments resolve under the same token. The `provider` claim names the
-// upstream CDN; when the caller passes ProviderUnspecified the Signer's
-// configured primary provider is used.
+// upstream CDN; when the caller passes ProviderUnspecified,
+// DefaultPrimaryProvider is used.
 func (s *Signer) SignURL(streamPath string, ttl time.Duration, provider Provider) (string, time.Time, error) {
 	return s.sign(streamPath, ttl, provider, false)
 }
@@ -161,7 +147,7 @@ func (s *Signer) SignLiveURL(streamPath string, ttl time.Duration, provider Prov
 
 func (s *Signer) sign(streamPath string, ttl time.Duration, provider Provider, live bool) (string, time.Time, error) {
 	if provider == ProviderUnspecified {
-		provider = s.primaryProvider
+		provider = DefaultPrimaryProvider
 	}
 	matched := streamBasePathRegex.FindString(streamPath)
 	if matched == "" {
@@ -183,10 +169,8 @@ func (s *Signer) sign(streamPath string, ttl time.Duration, provider Provider, l
 			return "", time.Time{}, fmt.Errorf("set iss claim: %w", err)
 		}
 	}
-	if provider != ProviderUnspecified {
-		if err := tok.Set("provider", string(provider)); err != nil {
-			return "", time.Time{}, fmt.Errorf("set provider claim: %w", err)
-		}
+	if err := tok.Set("provider", string(provider)); err != nil {
+		return "", time.Time{}, fmt.Errorf("set provider claim: %w", err)
 	}
 	if live {
 		if err := tok.Set("live", true); err != nil {
diff --git a/backend/streamtoken/signer_test.go b/backend/streamtoken/signer_test.go
index adc4fe575..f0fc3d5d9 100644
--- a/backend/streamtoken/signer_test.go
+++ b/backend/streamtoken/signer_test.go
@@ -12,16 +12,14 @@ import (
 )
 
 type fakeConfig struct {
-	secret          string
-	issuer          string
-	domain          string
-	primaryProvider Provider
+	secret string
+	issuer string
+	domain string
 }
 
-func (c fakeConfig) GetStreamJWTSecret() string         { return c.secret }
-func (c fakeConfig) GetStreamJWTIssuer() string         { return c.issuer }
-func (c fakeConfig) GetStreamProxyDomain() string       { return c.domain }
-func (c fakeConfig) GetStreamPrimaryProvider() Provider { return c.primaryProvider }
+func (c fakeConfig) GetStreamJWTSecret() string   { return c.secret }
+func (c fakeConfig) GetStreamJWTIssuer() string   { return c.issuer }
+func (c fakeConfig) GetStreamProxyDomain() string { return c.domain }
 
 func TestNewSignerRequiresSecretAndDomain(t *testing.T) {
 	_, err := NewSigner(fakeConfig{secret: "", domain: "proxy.example.com"})
@@ -77,7 +75,7 @@ func TestSignURLRoundTrip(t *testing.T) {
 
 	provRaw, ok := tok.Get("provider")
 	require.True(t, ok, "provider claim must be present (default primary provider)")
-	assert.Equal(t, string(DefaultPrimaryProvider), provRaw)
+	assert.Equal(t, "ioriver", provRaw)
 }
 
 func TestSignURLHyphenatedChannelPath(t *testing.T) {
@@ -102,30 +100,6 @@ func TestSignURLHyphenatedChannelPath(t *testing.T) {
 	assert.Equal(t, "/out/v1/some-channel/live/", raw)
 }
 
-func TestSignURLUsesConfiguredPrimaryProvider(t *testing.T) {
-	cfg := fakeConfig{secret: "s", domain: "proxy.example.com", primaryProvider: ProviderIoriver}
-	signer, err := NewSigner(cfg)
-	require.NoError(t, err)
-
-	signedURL, _, err := signer.SignURL("/out/v1/aaaaaa/bbbbbb/index.m3u8", time.Hour, ProviderUnspecified)
-	require.NoError(t, err)
-
-	parsed, err := url.Parse(signedURL)
-	require.NoError(t, err)
-	tokStr := parsed.Query().Get("jwt")
-	tok, err := jwt.Parse([]byte(tokStr), jwt.WithKey(jwa.HS256, []byte(cfg.secret)), jwt.WithValidate(true))
-	require.NoError(t, err)
-
-	raw, ok := tok.Get("provider")
-	require.True(t, ok)
-	assert.Equal(t, "ioriver", raw)
-}
-
-func TestNewSignerRejectsInvalidPrimaryProvider(t *testing.T) {
-	_, err := NewSigner(fakeConfig{secret: "s", domain: "proxy.example.com", primaryProvider: Provider("nope")})
-	require.Error(t, err)
-}
-
 func TestSignURLSetsProviderClaim(t *testing.T) {
 	cfg := fakeConfig{secret: "topsecret", domain: "proxy.example.com"}
 	signer, err := NewSigner(cfg)
diff --git a/backend/unleash/flags.go b/backend/unleash/flags.go
index 657b94fcf..657c6cc65 100644
--- a/backend/unleash/flags.go
+++ b/backend/unleash/flags.go
@@ -15,20 +15,20 @@ const DebugFlag = "debug"
 // the other flags its variant is not an enum but the page code to use.
 const ApplicationPageFlag = "application-page"
 
-// StreamProxyFlag toggles the URL signing path for stream manifests. The
-// default is the stream-proxy + HS256 JWT path; the `legacy` variant opts a
-// request back to the legacy CloudFront EncodedPolicy URLs (kept temporarily
-// as an emergency rollback lever).
+// StreamCDNProviderFlag picks which upstream CDN identity the stream-proxy
+// signs VOD requests for, carried as the JWT `provider` claim. Without the
+// flag (or with an unknown variant) the signer default applies
+// (streamtoken.DefaultPrimaryProvider = ioriver); the `cloudfront` variant
+// routes a request through the proxy's direct-CloudFront identity instead.
 //
 // Added: 05.05.2026
 const StreamCDNProviderFlag = "cdn-provider"
-const StreamCDNCloudfrontDirect = "cloudfront-direct"
 const StreamCDNProxyCF = "cloudfront"
 const StreamCDNProxyIORiver = "ioriver"
 
 // LiveCDNProviderFlag is the livestream counterpart of StreamCDNProviderFlag,
-// using the same variants, so live can be rolled out to (and rolled back from)
-// the stream-proxy independently of VOD.
+// using the same variants, so live's upstream identity can be switched
+// independently of VOD.
 //
 // Added: 27.07.2026
 const LiveCDNProviderFlag = "live-cdn-provider"
diff --git a/deploy-live-proxy-checklist.md b/deploy-live-proxy-checklist.md
deleted file mode 100644
index fbf4fc238..000000000
--- a/deploy-live-proxy-checklist.md
+++ /dev/null
@@ -1,90 +0,0 @@
-# Live-proxy rollout checklist
-
-Rollout runbook for the `live-proxy` PR (livestream manifests through stream-proxy).
-Each phase is independently safe: nothing changes client behavior until the Unleash
-flag flips in phase D, and ongoing transmissions are never touched (already-issued
-legacy URLs stay valid, the Lambda@Edge path stays deployed).
-
-## A. Direct-CloudFront distribution
-
-- [ ] Configure the live **direct-CF** distribution (the `cloudfront` provider
-      claim, not via ioriver): validate manifests **and** segments natively
-      (no Lambda@Edge on this path — the proxy does the manifest rewriting),
-      with a trusted key group containing the **existing legacy livestream
-      public key** (stream-proxy reuses that pair; terraform wires the PEM and
-      key-pair ID).
-- [ ] Add its hostname to `env/prod/config.auto.tfvars` → `stream_proxy_env`
-      as `STREAM_PROXY_LIVE_CDN_DOMAIN_CLOUDFRONT`; commit (git-crypt unlocked).
-
-## B. ioriver URL signing key — **before merging this PR**
-
-Not terraform-manageable (`ioriver_url_signing_key` was removed in provider
-v1.0.0; see the note in `infra/live-cdn.tf`). Applies run via `src/override.tf`
-pointing at the local working tree, as now.
-
-- [ ] `scripts/create-live-ioriver-signing-key.sh ~/prog/bcc.media/infra/projects/brunstadtv/env/prod`
-      — idempotent; prints the per-CDN key IDs.
-- [ ] Paste them into `env/prod/config.auto.tfvars` → `stream_proxy_env` as
-      `LIVE_IORIVER_CLOUDFRONT_KEY_ID` / `LIVE_IORIVER_FASTLY_KEY_ID`.
-- [ ] Set `url_signing = true` in `infra/live-cdn.tf`, then `make infra.prod`
-      (also picks up the key-ID and phase-A env vars).
-- [ ] Verify stream-proxy stayed healthy — the currently-deployed (old) binary
-      ignores the new env vars/mounts:
-
-  ```sh
-  gcloud run revisions list --service stream-proxy-prod --region europe-west4
-  # newest revision Ready=True; then confirm a known VOD manifest still plays through the proxy
-  ```
-
-## C. Merge and deploy
-
-- [ ] Land the current `infra/` changes on master (update `live-proxy-infra` or
-      merge with the PR), then remove `src/override.tf` so terragrunt reads
-      merged master (state already matches, next plan should be a no-op).
-- [ ] PR CI green → merge to `master`. Semaphore auto-deploys all backend services
-      (`--no-traffic` deploy, then traffic route — a crash-looping revision never
-      takes traffic).
-- [ ] Verify behavior-neutrality — live URL minting is unchanged because
-      `STREAM_PRIMARY_PROVIDER=cloudfront` and the `live-cdn-provider` flag doesn't
-      exist yet:
-
-  ```sh
-  curl -s https://api.brunstad.tv/query -H "Authorization: Bearer $TOKEN" \
-    -H 'Content-Type: application/json' \
-    -d '{"query":"{ live { isOnline url expiresAt } }"}'
-  # url must be a legacy CloudFront-signed URL: NOT on the stream-proxy domain, no ?jwt=
-  ```
-
-- [ ] Verify VOD playback through the proxy is unaffected.
-
-## D. Activate via the new flag, gradually
-
-- [ ] Create Unleash flag `live-cdn-provider` with variants `cloudfront-direct`,
-      `cloudfront`, `ioriver`. Initially target only internal test users with
-      variant `ioriver`.
-- [ ] As a flagged test user, ideally during a live transmission:
-  - [ ] `Query.live` returns a stream-proxy URL; master playlist variant URIs carry `?jwt=`.
-  - [ ] Variant playlists have segment URIs absolutized to the **live** CDN host and
-        signed; the manifest response has `Cache-Control: no-store`.
-  - [ ] Playback works, including join-from-program-start (the time-shift `start`
-        param must propagate onto child `.m3u8` URIs).
-  - [ ] `CalendarEntry.buffer` URL plays with the correct `start`/`end` window.
-- [ ] Ramp the flag percentage. Watch:
-  - stream-proxy error rate / latency — note Cloud Run `timeout_seconds = 2` and
-    `maxScale = 50`; live manifest polling at scale is new load for this service
-  - Unleash exposure metrics for `live-cdn-provider`
-- [ ] Steady state (later, optional): 100% on the flag. Moving the env-level default
-      (`STREAM_PRIMARY_PROVIDER=streamproxy`) also flips VOD — only do that when VOD
-      is ready too.
-
-## Rollback (any time, live-only, instant)
-
-- Flip `live-cdn-provider` off or to variant `cloudfront-direct` → new URL mints go
-  legacy immediately. URLs already handed out on either path keep working, since both
-  paths stay deployed.
-- Deploy-level fallback:
-
-  ```sh
-  gcloud run services update-traffic stream-proxy-prod --region europe-west4 \
-    --to-revisions=<previous-revision>=100
-  ```
diff --git a/infra/background-jobs.tf b/infra/background-jobs.tf
index bd643d95b..90a51734c 100644
--- a/infra/background-jobs.tf
+++ b/infra/background-jobs.tf
@@ -131,6 +131,22 @@ resource "google_cloud_run_service" "background_worker" {
           }
         }
 
+        # Offline exports embed stream-proxy URLs, signed with the same HS256
+        # secret the API and stream-proxy share (gcp-secrets.tf).
+        dynamic "env" {
+          for_each = [for v in module.stream_proxy_secrets.data : v if v.name == "STREAM_JWT_SECRET"]
+          iterator = v
+          content {
+            name = v.value.name
+            value_from {
+              secret_key_ref {
+                key  = v.value.secret_version
+                name = v.value.secret_name
+              }
+            }
+          }
+        }
+
         dynamic "env" {
           for_each = module.background_worker_secret_files.data
           iterator = v
diff --git a/infra/gcp-secrets.tf b/infra/gcp-secrets.tf
index c3c3c037e..5deeba523 100644
--- a/infra/gcp-secrets.tf
+++ b/infra/gcp-secrets.tf
@@ -144,6 +144,7 @@ module "stream_proxy_secrets" {
   secret_accessors = [
     "serviceAccount:${google_service_account.stream_proxy.email}",
     "serviceAccount:${google_service_account.api.email}",
+    "serviceAccount:${google_service_account.background_worker.email}",
   ]
 }