diff --git a/src/cli.rs b/src/cli.rs
index 8809a20b..2017c65d 100644
--- a/src/cli.rs
+++ b/src/cli.rs
@@ -71,17 +71,17 @@ pub struct PolicyOptions {
     /// Beamline Policy Endpoint
     ///
     /// eg, https://authz.diamond.ac.uk
-    #[clap(long = "policy", required = false)]
+    #[clap(long = "policy", required = false, env = "NUMTRACKER_AUTH_HOST")]
     pub policy_host: String,
     /// The Rego rule used to generate visit access data
     ///
     /// eg. v1/data/diamond/policy/session/write_to_beamline_visit
-    #[clap(long, required = false)]
+    #[clap(long, required = false, env = "NUMTRACKER_AUTH_ACCESS")]
     pub access_query: String,
     /// The Rego rule used to generate admin access data
     ///
     /// eg. v1/data/diamond/policy/admin/configure_beamline
-    #[clap(long, required = false)]
+    #[clap(long, required = false, env = "NUMTRACKER_AUTH_ADMIN")]
     pub admin_query: String,
 }