diff --git a/pkg/tools/shell/env.go b/pkg/tools/shell/env.go
index 7602c0549..4887a791a 100644
--- a/pkg/tools/shell/env.go
+++ b/pkg/tools/shell/env.go
@@ -34,12 +34,6 @@ var DefaultEnvAllowlist = map[string]bool{
 	"HTTP_PROXY":   true,
 	"HTTPS_PROXY":  true,
 	"NO_PROXY":     true,
-	// PICOCLAW_* vars - inherited from parent process if set
-	"PICOCLAW_HOME":        true,
-	"PICOCLAW_CONFIG":      true,
-	"PICOCLAW_SERVICE_NAME": true,
-	"PICOCLAW_EXE":        true,
-	"PICOCLAW_WORKSPACE":   true,
 }
 
 // defaultEnvAllowPrefixes are env var prefixes that are always allowed.