stage-worker still has the wrong cert bucket set up. If you checked this into secrets this can be removed. But we're unlikely to run this playbook before I get cert deployment working better anyway.