diff --git a/README.md b/README.md
index 79992b5..f900d16 100644
--- a/README.md
+++ b/README.md
@@ -589,6 +589,28 @@ helm upgrade \
 zfs-nfs democratic-csi/democratic-csi
 ```
 
+### Injecting environment variables
+
+It is possible to use environment variables to configure the `democratic-csi`
+driver, by setting a given field to `{env:<environment variable name>}`.
+For example:
+
+```yaml
+driver:
+  config:
+    driver: freenas-api-nfs
+    instance_id:
+    httpConnection:
+      protocol: http
+      host: 10.0.0.1
+      port: 80
+      apiKey: '{env:TRUENAS_API_KEY}'
+      allowInsecure: false
+```
+
+This will set the value of the `apiKey` field to the `TRUENAS_API_KEY` environment
+variable.
+
 ### A note on non standard kubelet paths
 
 Some distrobutions, such as `minikube` and `microk8s` use a non-standard
diff --git a/bin/democratic-csi b/bin/democratic-csi
index 3d6b39e..268c070 100755
--- a/bin/democratic-csi
+++ b/bin/democratic-csi
@@ -9,6 +9,7 @@
 require("../src/utils/polyfills");
 const yaml = require("js-yaml");
 const fs = require("fs");
+const { substituteEnvVars } = require("../src/utils/config_env");
 const { grpc } = require("../src/utils/grpc");
 const { stringify, stripWindowsDriveLetter } = require("../src/utils/general");
 
@@ -32,7 +33,7 @@ const args = require("yargs")
       }
 
       try {
-        options = yaml.load(fs.readFileSync(path, "utf8"));
+        options = yaml.load(substituteEnvVars(fs.readFileSync(path, "utf8")));
         try {
           driverConfigFile = fs.realpathSync(path);
         } catch (e) {
diff --git a/src/utils/config_env.js b/src/utils/config_env.js
new file mode 100644
index 0000000..b1406e1
--- /dev/null
+++ b/src/utils/config_env.js
@@ -0,0 +1,11 @@
+function substituteEnvVars(config) {
+  return config.replace(/{env:(.*)}/gm, (match, varName) => {
+    if (!(varName in process.env)) {
+      return match;
+    }
+
+    return process.env[varName];
+  });
+}
+
+module.exports.substituteEnvVars = substituteEnvVars;