A scheduled GitHub Actions trigger runs, on the admin instance, a dump of the production database, its anonymisation, then its restore into the staging database. The two databases are only ever joined by a tunnel: nothing transits outside the instance.
Generic diagram: instances, repositories, channels and modules are named by function. The architecture is shown for illustration, independently of any organisation.
The point that matters: cleartext data only exists in the top half of the diagram, inside the instance. What crosses over to staging is already anonymised.