diff --git a/pkg/tools/shell/env.go b/pkg/tools/shell/env.go
index 1b4409b6e..40b1f61a5 100644
--- a/pkg/tools/shell/env.go
+++ b/pkg/tools/shell/env.go
@@ -34,7 +34,10 @@ var DefaultEnvAllowlist = map[string]bool{
 	"HTTP_PROXY":   true,
 	"HTTPS_PROXY":  true,
 	"NO_PROXY":     true,
+	"PICOCLAW_HOME":      true,
+	"PICOCLAW_CONFIG":   true,
 	"PICOCLAW_SERVICE_NAME": true,
+	"PICOCLAW_EXE":      true,
 }
 
 // defaultEnvAllowPrefixes are env var prefixes that are always allowed.