diff --git a/boot.tests/SecurityHardeningTests.cs b/boot.tests/SecurityHardeningTests.cs
index 167671e..dff7947 100644
--- a/boot.tests/SecurityHardeningTests.cs
+++ b/boot.tests/SecurityHardeningTests.cs
@@ -7,6 +7,7 @@
 namespace boot.tests;
 
 [TestClass]
+[DoNotParallelize]
 public sealed class SecurityHardeningTests
 {
     private const string MainnetPayoutAddress = "bc1qd9m04z95mglaxd9e9accmhyjdlmkfmzjprkq4p";
@@ -48,6 +49,26 @@ public void PrivateDashboardDiagnosticsRequireExplicitApplianceOptInOrAdminAuth(
         Assert.IsTrue(DashboardController.CanViewOperatorDiagnostics(config, adminAuthorized: false));
     }
 
+    [TestMethod]
+    public void PrivateDashboardEnvironmentOverrideSupportsPackageUpgrades()
+    {
+        const string variable = "GRIDPOOL_TRUSTED_PRIVATE_DASHBOARD_ENABLED";
+        string? previous = Environment.GetEnvironmentVariable(variable);
+        try
+        {
+            var config = ValidConfig();
+            Environment.SetEnvironmentVariable(variable, "true");
+
+            Program.ApplyPoolConfigEnvironmentOverrides(config);
+
+            Assert.IsTrue(config.TrustedPrivateDashboardEnabled);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable(variable, previous);
+        }
+    }
+
     [TestMethod]
     public void StoredMinerLabelIsBoundedAndMarkupFree()
     {
diff --git a/boot_portal/Program.cs b/boot_portal/Program.cs
index 591c2ed..4f1b809 100644
--- a/boot_portal/Program.cs
+++ b/boot_portal/Program.cs
@@ -658,6 +658,7 @@ private static PoolConfig LoadPoolConfig(string configPath, string? localConfigP
                 if (config != null)
                 {
                     ApplyPoolConfigDefaults(config);
+                    ApplyPoolConfigEnvironmentOverrides(config);
                     PoolConfigValidator.ValidateOrThrow(config);
                     Console.WriteLine(
                         string.IsNullOrWhiteSpace(localConfigPath) || !File.Exists(localConfigPath)
@@ -674,6 +675,7 @@ private static PoolConfig LoadPoolConfig(string configPath, string? localConfigP
         Console.WriteLine($"🔧 Using default pool config");
         var fallbackConfig = new PoolConfig();
         ApplyPoolConfigDefaults(fallbackConfig);
+        ApplyPoolConfigEnvironmentOverrides(fallbackConfig);
         PoolConfigValidator.ValidateOrThrow(fallbackConfig);
         return fallbackConfig;
     }
@@ -785,6 +787,16 @@ private static void ApplyPoolConfigDefaults(PoolConfig config)
         }
     }
 
+    internal static void ApplyPoolConfigEnvironmentOverrides(PoolConfig config)
+    {
+        string? trustedPrivateDashboard =
+            Environment.GetEnvironmentVariable("GRIDPOOL_TRUSTED_PRIVATE_DASHBOARD_ENABLED");
+        if (bool.TryParse(trustedPrivateDashboard, out bool enabled))
+        {
+            config.TrustedPrivateDashboardEnabled = enabled;
+        }
+    }
+
     private static RateLimitPartition<string> CreateRateLimitPartition(HttpContext context, PoolConfig poolConfig, string policyName, int permitLimit)
     {
         return RateLimitPartition.GetFixedWindowLimiter(