diff --git a/src/config.go b/src/config.go
index bc186c6..af5d7c1 100644
--- a/src/config.go
+++ b/src/config.go
@@ -42,7 +42,9 @@ type Config struct {
 	} `toml:"backend"`
 }
 
-func ReadConfig(path string, config *Config) error {
+var config Config
+
+func ReadConfig(path string) error {
 	file, err := os.Open(path)
 	if err != nil {
 		return err
@@ -51,5 +53,21 @@ func ReadConfig(path string, config *Config) error {
 
 	decoder := toml.NewDecoder(file)
 	decoder.DisallowUnknownFields()
-	return decoder.Decode(config)
+	return decoder.Decode(&config)
+}
+
+func updateFromEnv(dest *string, key string) {
+	if value, found := os.LookupEnv(key); found {
+		*dest = value
+	}
+}
+
+func UpdateConfigEnv() {
+	updateFromEnv(&config.Backend.Type, "BACKEND")
+	updateFromEnv(&config.Backend.FS.Root, "FS_ROOT")
+	updateFromEnv(&config.Backend.S3.Endpoint, "S3_ENDPOINT_URL")
+	updateFromEnv(&config.Backend.S3.AccessKeyID, "S3_ACCESS_KEY_ID")
+	updateFromEnv(&config.Backend.S3.SecretAccessKey, "S3_SECRET_ACCESS_KEY")
+	updateFromEnv(&config.Backend.S3.Region, "S3_REGION")
+	updateFromEnv(&config.Backend.S3.Bucket, "S3_BUCKET")
 }
diff --git a/src/main.go b/src/main.go
index dbdfe55..36eedb5 100644
--- a/src/main.go
+++ b/src/main.go
@@ -7,7 +7,6 @@ import (
 	"net/http"
 )
 
-var config Config
 var backend Backend
 
 func serveHandler(name string, listen ListenConfig, serve func(http.ResponseWriter, *http.Request)) {
@@ -29,9 +28,10 @@ func main() {
 	configPath := flag.String("config", "config.toml", "path to configuration file")
 	flag.Parse()
 
-	if err = ReadConfig(*configPath, &config); err != nil {
-		log.Fatalln("configuration:", err)
+	if err := ReadConfig(*configPath); err != nil {
+		log.Fatalln("config:", err)
 	}
+	UpdateConfigEnv() // environment takes priority
 
 	switch config.Backend.Type {
 	case "fs":