diff --git a/build.sh b/build.sh
index ad3f983b..ad7d6d42 100755
--- a/build.sh
+++ b/build.sh
@@ -27,11 +27,11 @@ popd > /dev/null
 # Parse project config
 PROJECTCONF=$ROOT/conf/project.yml
 eval $(parse_yaml $PROJECTCONF)
-ALIASFILE=${project_name}.aliases.drushrc.php
-ALIASTARGET=$HOME/.drush/$ALIASFILE
+ALIASFILE=self.site.yml
+ALIASTARGET=$HOME/.drush/sites/$ALIASFILE
 
 if [ -z "$drush_alias_path" ]; then
-  ALIASPATH=$ROOT/drupal/conf/$ALIASFILE
+  ALIASPATH=$ROOT/drupal/drush/sites/$ALIASFILE
 else
   ALIASPATH=$ROOT/${drush_alias_path}/$ALIASFILE
 fi
diff --git a/docs/Setup.md b/docs/Setup.md
index 86af9369..6c291777 100644
--- a/docs/Setup.md
+++ b/docs/Setup.md
@@ -38,9 +38,7 @@ git init
 ## Configure Drupal build
 
 * Edit `drupal/conf/site.yml`, remove things you don't need and add stuff you want in your project.
-* Rename `drupal/drush/wundertools.aliases.drushrc.php` to `drupal/drush/[PROJECT_NAME].aliases.drushrc.php` and 
-configure it to fit your setup. 
-  - this file will be automatically symlinked from `~/.drush` when running vagrant up
+* Configure `drupal/drush/sites/self.site.yml` to fit your setup. This file will be automatically symlinked from `~/.drush` when running vagrant up.
 
 ## Create new drupal installation
 
diff --git a/drupal/.lando.yml b/drupal/.lando.yml
index cb64ff8f..30860d86 100644
--- a/drupal/.lando.yml
+++ b/drupal/.lando.yml
@@ -30,6 +30,9 @@ services:
     build:
       # Perform composer install.
       - composer install
+      # Enable Drush aliases.
+      - chmod +x /app/scripts/drush/aliases.sh
+      - /app/scripts/drush/aliases.sh
       # build_as_root:
       # - "apt-get update -y"
       # - "apt-get install python-yaml -y"
@@ -74,7 +77,3 @@ events:
   # Clear caches after a database import
   post-db-import:
     - appserver: cd $LANDO_WEBROOT && drush cr -y
-  # Enable Drush aliases.
-  post-start:
-    - appserver: mkdir -p $LANDO_MOUNT/.drush/site-aliases
-    - appserver: ln -sf /app/drush/wundertools.aliases.drushrc.php $LANDO_MOUNT/.drush/site-aliases/wundertools.aliases.drushrc.php
diff --git a/drupal/drush/Commands/PolicyCommands.php b/drupal/drush/Commands/PolicyCommands.php
new file mode 100644
index 00000000..290b4e03
--- /dev/null
+++ b/drupal/drush/Commands/PolicyCommands.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace Drush\Commands;
+
+use Consolidation\AnnotatedCommand\CommandData;
+
+/**
+ * Edit this file to reflect your organization's needs.
+ */
+class PolicyCommands extends DrushCommands {
+
+  /**
+   * Prevent catastrophic braino. Note that this file has to be local to the
+   * machine that initiates the sql:sync command.
+   *
+   * @hook validate sql:sync
+   *
+   * @throws \Exception
+   */
+  public function sqlSyncValidate(CommandData $commandData) {
+    if ($commandData->input()->getArgument('target') == '@prod') {
+      throw new \Exception(dt('Per !file, you may never overwrite the production database.', ['!file' => __FILE__]));
+    }
+  }
+
+  /**
+   * Limit rsync operations to production site.
+   *
+   * @hook validate core:rsync
+   *
+   * @throws \Exception
+   */
+  public function rsyncValidate(CommandData $commandData) {
+    if (preg_match("/^@prod/", $commandData->input()->getArgument('target'))) {
+      throw new \Exception(dt('Per !file, you may never rsync to the production site.', ['!file' => __FILE__]));
+    }
+  }
+}
diff --git a/drupal/drush/README.md b/drupal/drush/README.md
new file mode 100644
index 00000000..9d7bd397
--- /dev/null
+++ b/drupal/drush/README.md
@@ -0,0 +1 @@
+This directory contains commands, configuration and site aliases for Drush. See https://packagist.org/search/?type=drupal-drush for a directory of Drush commands installable via Composer.
diff --git a/drupal/drush/drush.yml b/drupal/drush/drush.yml
new file mode 100644
index 00000000..a8cbd007
--- /dev/null
+++ b/drupal/drush/drush.yml
@@ -0,0 +1,6 @@
+#
+# A Drush configuration file
+#
+# Docs at https://github.com/drush-ops/drush/blob/master/examples/example.drush.yml
+#
+# Edit or remove this file as needed.
diff --git a/drupal/drush/drushrc.php b/drupal/drush/drushrc.php
deleted file mode 100644
index 918054d9..00000000
--- a/drupal/drush/drushrc.php
+++ /dev/null
@@ -1,5 +0,0 @@
-<?php
-if (file_exists('/etc/drush/drushrc.php')) {
-  require '/etc/drush/drushrc.php';
-}
-
diff --git a/drupal/drush/sites/self.site.yml b/drupal/drush/sites/self.site.yml
new file mode 100644
index 00000000..24e010b7
--- /dev/null
+++ b/drupal/drush/sites/self.site.yml
@@ -0,0 +1,51 @@
+# Docs at https://github.com/drush-ops/drush/blob/master/examples/example.site.yml
+
+dev:
+  host: dev.wundertools.com
+  options:
+    command-specific:
+      sql-sync:
+        no-cache: true
+  paths:
+    dump-dir: /home/www-admin
+  root: /var/www/dev.wundertools.com/web
+  uri: 'https://dev.wundertools.com'
+  user: www-admin
+
+local:
+  host: local.wundertools.com
+  options:
+    env: vagrant
+    parent: '@parent'
+    site: wundertools
+  paths:
+    files: /vagrant/drupal/files
+    dump-dir: /home/vagrant
+  root: /vagrant/drupal/web
+  user: vagrant
+  ssh:
+    options: '-i '
+
+prod:
+  host: wundertools.com
+  options:
+    command-specific:
+      sql-sync:
+        no-cache: true
+  paths:
+    dump-dir: /home/www-admin
+  root: /var/www/wundertools.com/web
+  uri: 'https://wundertools.com'
+  user: www-admin
+
+stage:
+  host: stage.wundertools.com
+  options:
+    command-specific:
+      sql-sync:
+        no-cache: true
+  paths:
+    dump-dir: /home/www-admin
+  root: /var/www/stage.wundertools.com/web
+  uri: 'https://stage.wundertools.com'
+  user: www-admin
diff --git a/drupal/scripts/drush/aliases.sh b/drupal/scripts/drush/aliases.sh
new file mode 100755
index 00000000..dd6b5d5b
--- /dev/null
+++ b/drupal/scripts/drush/aliases.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin
+set -ex
+
+rm -Rf ~/.drush
+mkdir -p ~/.drush/sites
+
+ln -s /app/drush/sites/self.site.yml ~/.drush/sites/self.site.yml
+drush cc drush