diff --git a/api/ipfsproxy/config.go b/api/ipfsproxy/config.go
index 0d1618cf..ce9a87bd 100644
--- a/api/ipfsproxy/config.go
+++ b/api/ipfsproxy/config.go
@@ -154,6 +154,13 @@ func (cfg *Config) Default() error {
 	return nil
 }
 
+// ApplyEnvVars fills in any Config fields found
+// as environment variables.
+func (cfg *Config) ApplyEnvVars() error {
+	// doesn't read any config from env
+	return nil
+}
+
 // Validate checks that the fields of this Config have sensible values,
 // at least in appearance.
 func (cfg *Config) Validate() error {
diff --git a/api/rest/config.go b/api/rest/config.go
index 5069ee29..109aee91 100644
--- a/api/rest/config.go
+++ b/api/rest/config.go
@@ -181,6 +181,19 @@ func (cfg *Config) Default() error {
 	return nil
 }
 
+// ApplyEnvVars fills in any Config fields found
+// as environment variables.
+func (cfg *Config) ApplyEnvVars() error {
+	jcfg := &jsonConfig{}
+
+	err := envconfig.Process(envConfigKey, jcfg)
+	if err != nil {
+		return err
+	}
+
+	return cfg.applyJSONConfig(jcfg)
+}
+
 // Validate makes sure that all fields in this Config have
 // working values, at least in appearance.
 func (cfg *Config) Validate() error {
@@ -236,7 +249,11 @@ func (cfg *Config) LoadJSON(raw []byte) error {
 		return err
 	}
 
-	err = cfg.loadHTTPOptions(jcfg)
+	return cfg.applyJSONConfig(jcfg)
+}
+
+func (cfg *Config) applyJSONConfig(jcfg *jsonConfig) error {
+	err := cfg.loadHTTPOptions(jcfg)
 	if err != nil {
 		return err
 	}
diff --git a/cluster_config.go b/cluster_config.go
index 49eeb339..5b6be929 100644
--- a/cluster_config.go
+++ b/cluster_config.go
@@ -186,6 +186,19 @@ func (cfg *Config) Default() error {
 	return nil
 }
 
+// ApplyEnvVars fills in any Config fields found
+// as environment variables.
+func (cfg *Config) ApplyEnvVars() error {
+	jcfg := &configJSON{}
+
+	err := envconfig.Process(cfg.ConfigKey(), jcfg)
+	if err != nil {
+		return err
+	}
+
+	return cfg.applyConfigJSON(jcfg)
+}
+
 // Validate will check that the values of this config
 // seem to be working ones.
 func (cfg *Config) Validate() error {
@@ -311,6 +324,10 @@ for more information.`)
 		return err
 	}
 
+	return cfg.applyConfigJSON(jcfg)
+}
+
+func (cfg *Config) applyConfigJSON(jcfg *configJSON) error {
 	parseDuration := func(txt string) time.Duration {
 		d, _ := time.ParseDuration(txt)
 		if txt != "" && d == 0 {
diff --git a/cmd/ipfs-cluster-service/main.go b/cmd/ipfs-cluster-service/main.go
index 4b2d8762..5c95fb53 100644
--- a/cmd/ipfs-cluster-service/main.go
+++ b/cmd/ipfs-cluster-service/main.go
@@ -240,6 +240,9 @@ configuration.
 				err := cfgMgr.Default()
 				checkErr("generating default configuration", err)
 
+				err = cfgMgr.ApplyEnvVars()
+				checkErr("applying environment variables to configuration", err)
+
 				// Set user secret
 				if userSecretDefined {
 					cfgs.clusterCfg.Secret = userSecret
@@ -501,18 +504,14 @@ func setupDebug() {
 }
 
 func userProvidedSecret(enterSecret bool) ([]byte, bool) {
-	var secret string
 	if enterSecret {
-		secret = promptUser("Enter cluster secret (32-byte hex string): ")
-	} else if envSecret, envSecretDefined := os.LookupEnv("CLUSTER_SECRET"); envSecretDefined {
-		secret = envSecret
-	} else {
-		return nil, false
+		secret := promptUser("Enter cluster secret (32-byte hex string): ")
+		decodedSecret, err := ipfscluster.DecodeClusterSecret(secret)
+		checkErr("parsing user-provided secret", err)
+		return decodedSecret, true
 	}
 
-	decodedSecret, err := ipfscluster.DecodeClusterSecret(secret)
-	checkErr("parsing user-provided secret", err)
-	return decodedSecret, true
+	return nil, false
 }
 
 func promptUser(msg string) string {
diff --git a/config/config.go b/config/config.go
index 95550fc1..aa479bdf 100644
--- a/config/config.go
+++ b/config/config.go
@@ -34,6 +34,8 @@ type ComponentConfig interface {
 	ToJSON() ([]byte, error)
 	// Sets default working values
 	Default() error
+	// Sets values from environment variables
+	ApplyEnvVars() error
 	// Allows this component to work under a subfolder
 	SetBaseDir(string)
 	// Checks that the configuration is valid
@@ -225,6 +227,30 @@ func (cfg *Manager) Default() error {
 	return nil
 }
 
+// ApplyEnvVars overrides configuration fields with any values found
+// in environment variables.
+func (cfg *Manager) ApplyEnvVars() error {
+	for _, section := range cfg.sections {
+		for k, compcfg := range section {
+			logger.Debugf("applying environment variables conf for %s", k)
+			err := compcfg.ApplyEnvVars()
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	if cfg.clusterConfig != nil {
+		logger.Debugf("applying environment variables conf for cluster")
+		err := cfg.clusterConfig.ApplyEnvVars()
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
 // RegisterComponent lets the Manager load and save component configurations
 func (cfg *Manager) RegisterComponent(t SectionType, ccfg ComponentConfig) {
 	cfg.wg.Add(1)
diff --git a/consensus/raft/config.go b/consensus/raft/config.go
index f3aca9d9..68deb225 100644
--- a/consensus/raft/config.go
+++ b/consensus/raft/config.go
@@ -272,6 +272,13 @@ func (cfg *Config) Default() error {
 	return nil
 }
 
+// ApplyEnvVars fills in any Config fields found
+// as environment variables.
+func (cfg *Config) ApplyEnvVars() error {
+	// doesn't read any config from env
+	return nil
+}
+
 // GetDataFolder returns the Raft data folder that we are using.
 func (cfg *Config) GetDataFolder() string {
 	if cfg.DataFolder == "" {
diff --git a/informer/disk/config.go b/informer/disk/config.go
index 3c72b0d9..a37be1fd 100644
--- a/informer/disk/config.go
+++ b/informer/disk/config.go
@@ -53,6 +53,13 @@ func (cfg *Config) Default() error {
 	return nil
 }
 
+// ApplyEnvVars fills in any Config fields found
+// as environment variables.
+func (cfg *Config) ApplyEnvVars() error {
+	// doesn't read any config from env
+	return nil
+}
+
 // Validate checks that the fields of this Config have working values,
 // at least in appearance.
 func (cfg *Config) Validate() error {
diff --git a/informer/numpin/config.go b/informer/numpin/config.go
index 033ee2df..0a526037 100644
--- a/informer/numpin/config.go
+++ b/informer/numpin/config.go
@@ -38,6 +38,13 @@ func (cfg *Config) Default() error {
 	return nil
 }
 
+// ApplyEnvVars fills in any Config fields found
+// as environment variables.
+func (cfg *Config) ApplyEnvVars() error {
+	// doesn't read any config from env
+	return nil
+}
+
 // Validate checks that the fields of this configuration have
 // sensible values.
 func (cfg *Config) Validate() error {
diff --git a/ipfsconn/ipfshttp/config.go b/ipfsconn/ipfshttp/config.go
index abc0d416..2f129e90 100644
--- a/ipfsconn/ipfshttp/config.go
+++ b/ipfsconn/ipfshttp/config.go
@@ -89,6 +89,13 @@ func (cfg *Config) Default() error {
 	return nil
 }
 
+// ApplyEnvVars fills in any Config fields found
+// as environment variables.
+func (cfg *Config) ApplyEnvVars() error {
+	// doesn't read any config from env
+	return nil
+}
+
 // Validate checks that the fields of this Config have sensible values,
 // at least in appearance.
 func (cfg *Config) Validate() error {
diff --git a/monitor/basic/config.go b/monitor/basic/config.go
index 9bf0fec6..b791140b 100644
--- a/monitor/basic/config.go
+++ b/monitor/basic/config.go
@@ -37,6 +37,13 @@ func (cfg *Config) Default() error {
 	return nil
 }
 
+// ApplyEnvVars fills in any Config fields found
+// as environment variables.
+func (cfg *Config) ApplyEnvVars() error {
+	// doesn't read any config from env
+	return nil
+}
+
 // Validate checks that the fields of this Config have working values,
 // at least in appearance.
 func (cfg *Config) Validate() error {
diff --git a/monitor/pubsubmon/config.go b/monitor/pubsubmon/config.go
index 1a21e633..bc831c6f 100644
--- a/monitor/pubsubmon/config.go
+++ b/monitor/pubsubmon/config.go
@@ -37,6 +37,13 @@ func (cfg *Config) Default() error {
 	return nil
 }
 
+// ApplyEnvVars fills in any Config fields found
+// as environment variables.
+func (cfg *Config) ApplyEnvVars() error {
+	// doesn't read any config from env
+	return nil
+}
+
 // Validate checks that the fields of this Config have working values,
 // at least in appearance.
 func (cfg *Config) Validate() error {
diff --git a/observations/config.go b/observations/config.go
index 2f7aa8f4..59353565 100644
--- a/observations/config.go
+++ b/observations/config.go
@@ -58,6 +58,13 @@ func (cfg *MetricsConfig) Default() error {
 	return nil
 }
 
+// ApplyEnvVars fills in any Config fields found
+// as environment variables.
+func (cfg *MetricsConfig) ApplyEnvVars() error {
+	// doesn't read any config from env
+	return nil
+}
+
 // Validate checks that the fields of this Config have working values,
 // at least in appearance.
 func (cfg *MetricsConfig) Validate() error {
@@ -159,6 +166,13 @@ func (cfg *TracingConfig) Default() error {
 	return nil
 }
 
+// ApplyEnvVars fills in any Config fields found
+// as environment variables.
+func (cfg *TracingConfig) ApplyEnvVars() error {
+	// doesn't read any config from env
+	return nil
+}
+
 // Validate checks that the fields of this Config have working values,
 // at least in appearance.
 func (cfg *TracingConfig) Validate() error {
diff --git a/pintracker/maptracker/config.go b/pintracker/maptracker/config.go
index 2b793126..659bb92a 100644
--- a/pintracker/maptracker/config.go
+++ b/pintracker/maptracker/config.go
@@ -44,6 +44,13 @@ func (cfg *Config) Default() error {
 	return nil
 }
 
+// ApplyEnvVars fills in any Config fields found
+// as environment variables.
+func (cfg *Config) ApplyEnvVars() error {
+	// doesn't read any config from env
+	return nil
+}
+
 // Validate checks that the fields of this Config have working values,
 // at least in appearance.
 func (cfg *Config) Validate() error {
diff --git a/pintracker/stateless/config.go b/pintracker/stateless/config.go
index b0dc5a29..456629b6 100644
--- a/pintracker/stateless/config.go
+++ b/pintracker/stateless/config.go
@@ -44,6 +44,13 @@ func (cfg *Config) Default() error {
 	return nil
 }
 
+// ApplyEnvVars fills in any Config fields found
+// as environment variables.
+func (cfg *Config) ApplyEnvVars() error {
+	// doesn't read any config from env
+	return nil
+}
+
 // Validate checks that the fields of this Config have working values,
 // at least in appearance.
 func (cfg *Config) Validate() error {