diff --git a/arpspoof/config.yaml b/arpspoof/config.yaml
index 470574b55..ac4798262 100644
--- a/arpspoof/config.yaml
+++ b/arpspoof/config.yaml
@@ -71,6 +71,7 @@ image: ghcr.io/alexbelgium/arpspoof-{arch}
 map: []
 name: Arpspoof
 options:
+  env_vars: []
   ROUTER_IP: yourip
 ports:
   7022/tcp: 7022
@@ -80,6 +81,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   INTERFACE_NAME: str?
   ROUTER_IP: str
 slug: arpspoof
diff --git a/autobrr/config.yaml b/autobrr/config.yaml
index 7849a725a..1327754e4 100644
--- a/autobrr/config.yaml
+++ b/autobrr/config.yaml
@@ -83,6 +83,7 @@ map:
   - ssl
 name: Autobrr
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
 panel_admin: false
@@ -95,6 +96,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/battybirdnet-pi/config.yaml b/battybirdnet-pi/config.yaml
index 3d90df89d..da6fd224f 100644
--- a/battybirdnet-pi/config.yaml
+++ b/battybirdnet-pi/config.yaml
@@ -71,6 +71,7 @@ map:
   - ssl
 name: BattyBirdNET-Pi
 options:
+  env_vars: []
   BIRDSONGS_FOLDER: /config/BirdSongs
   LIVESTREAM_BOOT_ENABLED: false
   TZ: Europe/Paris
@@ -89,6 +90,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   BIRDSONGS_FOLDER: str?
   LIVESTREAM_BOOT_ENABLED: bool
   MQTT_DISABLED: bool?
diff --git a/bazarr/config.yaml b/bazarr/config.yaml
index c3afc726c..e970fd710 100644
--- a/bazarr/config.yaml
+++ b/bazarr/config.yaml
@@ -82,6 +82,7 @@ map:
   - ssl
 name: Bazarr NAS
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
 ports:
@@ -92,6 +93,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/binance-trading-bot/config.yaml b/binance-trading-bot/config.yaml
index 157d09c9a..bd6f13d8a 100644
--- a/binance-trading-bot/config.yaml
+++ b/binance-trading-bot/config.yaml
@@ -80,6 +80,7 @@ map:
   - config:rw
 name: Binance Trading Bot
 options:
+  env_vars: []
   BINANCE_AUTHENTICATION_ENABLED: true
   BINANCE_AUTHENTICATION_PASSWORD: null
   BINANCE_MODE: test
@@ -96,6 +97,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   BINANCE_AUTHENTICATION_ENABLED: bool
   BINANCE_AUTHENTICATION_PASSWORD: str
   BINANCE_LIVE_API_KEY: str?
diff --git a/birdnet-go/config.yaml b/birdnet-go/config.yaml
index 625768caa..29a322926 100644
--- a/birdnet-go/config.yaml
+++ b/birdnet-go/config.yaml
@@ -84,6 +84,7 @@ map:
   - share:rw
 name: Birdnet-go
 options:
+  env_vars: []
   BIRDSONGS_FOLDER: /config/clips
   homeassistant_microphone: false
 panel_admin: false
@@ -99,6 +100,9 @@ privileged:
   - DAC_READ_SEARCH
   - SYS_RESOURCE
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   BIRDSONGS_FOLDER: str?
   TZ: str?
   cifsdomain: str?
diff --git a/birdnet-pi/config.yaml b/birdnet-pi/config.yaml
index be1350114..871f3a1c6 100644
--- a/birdnet-pi/config.yaml
+++ b/birdnet-pi/config.yaml
@@ -68,6 +68,7 @@ map:
   - ssl
 name: BirdNET-pi
 options:
+  env_vars: []
   BIRDSONGS_FOLDER: /config/BirdSongs
   LIVESTREAM_BOOT_ENABLED: false
   MQTT_DISABLED: true
@@ -88,6 +89,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   BIRDSONGS_FOLDER: str?
   LIVESTREAM_BOOT_ENABLED: bool
   MQTT_DISABLED: bool?
diff --git a/booksonic_air/config.yaml b/booksonic_air/config.yaml
index 03245496e..a88fe103d 100644
--- a/booksonic_air/config.yaml
+++ b/booksonic_air/config.yaml
@@ -75,6 +75,7 @@ map:
   - media:rw
 name: Booksonic air
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
 ports:
@@ -85,6 +86,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/browserless_chrome/config.yaml b/browserless_chrome/config.yaml
index 0f8c2da5e..98abc0725 100644
--- a/browserless_chrome/config.yaml
+++ b/browserless_chrome/config.yaml
@@ -73,12 +73,16 @@ map:
   - addon_config:rw
 name: Browserless Chromium
 options:
+  env_vars: []
   TIMEOUT: "60000"
 ports:
   3000/tcp: 3000
 ports_description:
   3000/tcp: Webui
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   TIMEOUT: int
 slug: browserless_chrome
 udev: true
diff --git a/calibre/config.yaml b/calibre/config.yaml
index 309b12a0b..9a5ab5a66 100644
--- a/calibre/config.yaml
+++ b/calibre/config.yaml
@@ -83,6 +83,7 @@ map:
   - ssl
 name: Calibre
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
 panel_admin: false
@@ -100,6 +101,9 @@ privileged:
   - DAC_READ_SEARCH
   - NET_ADMIN
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CLI_ARGS: str?
   PASSWORD: str?
   PGID: int
diff --git a/calibre_web/config.yaml b/calibre_web/config.yaml
index 75c8ace33..94e1cca77 100644
--- a/calibre_web/config.yaml
+++ b/calibre_web/config.yaml
@@ -86,6 +86,7 @@ map:
   - ssl
 name: Calibre-web
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
 panel_admin: false
@@ -99,6 +100,9 @@ privileged:
   - DAC_READ_SEARCH
   - NET_ADMIN
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   DOCKER_MODS: str?
   OAUTHLIB_RELAX_TOKEN_SCOPE: str?
   PGID: int
diff --git a/changedetection.io/config.yaml b/changedetection.io/config.yaml
index 8867fd90c..448af4339 100644
--- a/changedetection.io/config.yaml
+++ b/changedetection.io/config.yaml
@@ -12,6 +12,7 @@ map:
   - config:rw
 name: Changedetection.io
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
   TIMEOUT: "60000"
@@ -20,6 +21,9 @@ ports:
 ports_description:
   5000/tcp: Webui
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   BASE_URL: str?
   PGID: int
   PUID: int
diff --git a/cloudcommander/config.yaml b/cloudcommander/config.yaml
index 1fe353345..260ee753d 100644
--- a/cloudcommander/config.yaml
+++ b/cloudcommander/config.yaml
@@ -89,6 +89,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CUSTOM_OPTIONS: str?
   DROPBOX_TOKEN: str?
   cifsdomain: str?
diff --git a/codex/config.yaml b/codex/config.yaml
index 02cb82fb1..adc1ffea5 100644
--- a/codex/config.yaml
+++ b/codex/config.yaml
@@ -71,6 +71,7 @@ map:
   - share:rw
 name: Codex
 options:
+  env_vars: []
   PGID: "0"
   PUID: "0"
   csrf_allowed: http://homeassistant.local:8123,https://homeassistant.local:8123
@@ -84,6 +85,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CODEX_RESET_ADMIN: int?
   CODEX_SKIP_INTEGRITY_CHECK: int?
   PGID: int?
diff --git a/collabora/config.yaml b/collabora/config.yaml
index b93f0d2a3..48e794090 100644
--- a/collabora/config.yaml
+++ b/collabora/config.yaml
@@ -13,6 +13,7 @@ map:
   - ssl:ro
 name: Collabora
 options:
+  env_vars: []
   aliasgroup1: ""
   certfile: fullchain.pem
   domain1: ""
@@ -28,6 +29,9 @@ ports:
 ports_description:
   9980/tcp: Web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   TZ: str?
   aliasgroup1: str
   cert_domain: bool?
diff --git a/comixed/config.yaml b/comixed/config.yaml
index edc551eb1..9303f2cc1 100644
--- a/comixed/config.yaml
+++ b/comixed/config.yaml
@@ -74,6 +74,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   TZ: str?
   cifsdomain: str?
   cifspassword: str?
diff --git a/emby/config.yaml b/emby/config.yaml
index a23c22e0a..cb5272486 100644
--- a/emby/config.yaml
+++ b/emby/config.yaml
@@ -86,6 +86,7 @@ map:
   - ssl:rw
 name: Emby
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
   silent: true
@@ -105,6 +106,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/emby_beta/config.yaml b/emby_beta/config.yaml
index f1db8d944..b02474b71 100644
--- a/emby_beta/config.yaml
+++ b/emby_beta/config.yaml
@@ -87,6 +87,7 @@ map:
   - ssl:rw
 name: Emby Beta
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
   silent: true
@@ -106,6 +107,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/enedisgateway2mqtt/config.yaml b/enedisgateway2mqtt/config.yaml
index c9522a35a..57f2b9ce8 100644
--- a/enedisgateway2mqtt/config.yaml
+++ b/enedisgateway2mqtt/config.yaml
@@ -72,6 +72,7 @@ map:
   - config:rw
 name: MyElectricalData
 options:
+  env_vars: []
   CONFIG_LOCATION: /config/myelectricaldata/config.yaml
   TZ: Europe/Paris
   mqtt_autodiscover: true
@@ -83,6 +84,9 @@ ports:
 ports_description:
   5000/tcp: Portail
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CONFIG_LOCATION: str
   TZ: str?
   mqtt_autodiscover: bool
diff --git a/enedisgateway2mqtt_dev/config.yaml b/enedisgateway2mqtt_dev/config.yaml
index a60890886..7ab60ff6e 100644
--- a/enedisgateway2mqtt_dev/config.yaml
+++ b/enedisgateway2mqtt_dev/config.yaml
@@ -72,6 +72,7 @@ map:
   - config:rw
 name: MyElectricalData Dev
 options:
+  env_vars: []
   CONFIG_LOCATION: /config/myelectricaldata_dev/config.yaml
   TZ: Europe/Paris
   mqtt_autodiscover: true
@@ -83,6 +84,9 @@ ports:
 ports_description:
   5000/tcp: Portail
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CONFIG_LOCATION: str
   TZ: str?
   mqtt_autodiscover: bool
diff --git a/ente/config.yaml b/ente/config.yaml
index bc10662e5..738e16393 100644
--- a/ente/config.yaml
+++ b/ente/config.yaml
@@ -76,6 +76,7 @@ map:
   - addon_config:rw
 name: Ente
 options:
+  env_vars: []
   DB_PASSWORD: ente
   DISABLE_WEB_UI: true
   ENTE_ENDPOINT_URL: http://homeassistant.local:8280
@@ -96,6 +97,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   DB_DATABASE_NAME: str?
   DB_HOSTNAME: str?
   DB_PASSWORD: str
diff --git a/filebrowser/config.yaml b/filebrowser/config.yaml
index b0f5b8905..8a8faccee 100644
--- a/filebrowser/config.yaml
+++ b/filebrowser/config.yaml
@@ -92,6 +92,7 @@ map:
   - ssl:rw
 name: Filebrowser
 options:
+  env_vars: []
   NoAuth: true
   certfile: fullchain.pem
   disable_thumbnails: true
@@ -107,6 +108,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   NoAuth: bool
   base_folder: str?
   certfile: str
diff --git a/fireflyiii/config.yaml b/fireflyiii/config.yaml
index c6f8db27a..ba0f92a31 100644
--- a/fireflyiii/config.yaml
+++ b/fireflyiii/config.yaml
@@ -74,6 +74,7 @@ map:
   - share:rw
 name: Firefly iii
 options:
+  env_vars: []
   APP_KEY: CHANGEME_32_CHARS_EuC5dfn3LAPzeO
   CONFIG_LOCATION: /config/addons_config/fireflyiii/config.yaml
   DB_CONNECTION: sqlite_internal
@@ -85,6 +86,9 @@ ports_description:
   8080/tcp: web interface
   8443/tcp: ssl web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   APP_KEY: str
   CONFIG_LOCATION: str
   DB_CONNECTION: list(sqlite_internal|mariadb_addon|mysql|pgsql)
diff --git a/fireflyiii_data_importer/config.yaml b/fireflyiii_data_importer/config.yaml
index e7db37b75..4544700c1 100644
--- a/fireflyiii_data_importer/config.yaml
+++ b/fireflyiii_data_importer/config.yaml
@@ -76,12 +76,16 @@ map:
   - ssl
 name: Firefly iii Data Importer
 options:
+  env_vars: []
   CONFIG_LOCATION: /config
 ports:
   8080/tcp: 3474
 ports_description:
   8080/tcp: web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   AUTO_IMPORT_SECRET: str?
   CAN_POST_AUTOIMPORT: bool?
   CAN_POST_FILES: bool?
diff --git a/fireflyiii_fints_importer/config.yaml b/fireflyiii_fints_importer/config.yaml
index 941d97535..fcde8e4c4 100644
--- a/fireflyiii_fints_importer/config.yaml
+++ b/fireflyiii_fints_importer/config.yaml
@@ -80,6 +80,9 @@ ports:
 ports_description:
   8080/tcp: web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   Updates: list(|hourly|daily2|daily4|daily6|daily8|daily10|daily12|weekly)?
   silent: bool?
 slug: fireflyiii_fints_importer
diff --git a/flexget/config.yaml b/flexget/config.yaml
index ea7fb22f7..98ab67120 100644
--- a/flexget/config.yaml
+++ b/flexget/config.yaml
@@ -76,6 +76,7 @@ map:
   - media
 name: Flexget
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
   WebuiPass: homeassistant123
@@ -84,6 +85,9 @@ ports:
 ports_description:
   5050/tcp: Web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   FG_LOG_LEVEL: list(critical|error|warning|info|verbose|debug|trace)?
   FG_PLUGINS: str?
   PGID: int
diff --git a/free_games_claimer/config.yaml b/free_games_claimer/config.yaml
index 7c8608fd3..55d8bfe92 100644
--- a/free_games_claimer/config.yaml
+++ b/free_games_claimer/config.yaml
@@ -76,6 +76,7 @@ map:
   - homeassistant_config:rw
 name: Free Games Claimer (NoVNC not working)
 options:
+  env_vars: []
   CMD_ARGUMENTS: node epic-games ; node prime-gaming ; node gog
   CONFIG_LOCATION: /config/config.env
 ports:
@@ -85,6 +86,9 @@ ports_description:
   5900/tcp: VNC port
   6080/tcp: NOVNC port
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CMD_ARGUMENTS: str
   CONFIG_LOCATION: str
 slug: free_games_claimer
diff --git a/gazpar2mqtt/config.yaml b/gazpar2mqtt/config.yaml
index 4e65f0959..22b53ab96 100644
--- a/gazpar2mqtt/config.yaml
+++ b/gazpar2mqtt/config.yaml
@@ -72,11 +72,15 @@ map:
   - share:rw
 name: Gazpar2mqtt
 options:
+  env_vars: []
   CONFIG_LOCATION: /config/gazpar2mqtt/config.yaml
   TZ: Europe/Paris
   mqtt_autodiscover: true
   verbose: true
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CONFIG_LOCATION: str
   TZ: str?
   mqtt_autodiscover: bool
diff --git a/gitea/config.yaml b/gitea/config.yaml
index 4d2d4b3f7..87c17b055 100644
--- a/gitea/config.yaml
+++ b/gitea/config.yaml
@@ -73,6 +73,7 @@ map:
   - ssl:rw
 name: Gitea
 options:
+  env_vars: []
   APP_NAME: Gitea for Homeassistant
   DOMAIN: homeassistant.local
   certfile: fullchain.pem
@@ -85,6 +86,9 @@ ports_description:
   22/tcp: ssh
   3000/tcp: Web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   APP_NAME: str?
   DOMAIN: str?
   ROOT_URL: str?
diff --git a/grampsweb/config.yaml b/grampsweb/config.yaml
index f8958b055..7cda9335e 100644
--- a/grampsweb/config.yaml
+++ b/grampsweb/config.yaml
@@ -77,6 +77,7 @@ environment:
 image: ghcr.io/alexbelgium/grampsweb-{arch}
 init: false
 options:
+  env_vars: []
   CELERY_NUM_WORKERS: 2
   GUNICORN_NUM_WORKERS: 8
   certfile: fullchain.pem
@@ -93,6 +94,9 @@ ports:
 ports_description:
   5001/tcp: webui
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CELERY_NUM_WORKERS: int
   GUNICORN_NUM_WORKERS: int
   GRAMPSWEB_SECRET_KEY: str?
diff --git a/grav/config.yaml b/grav/config.yaml
index b9ca6e141..2dd7a7597 100644
--- a/grav/config.yaml
+++ b/grav/config.yaml
@@ -73,6 +73,7 @@ map:
   - config:rw
 name: Grav web server
 options:
+  env_vars: []
   PGID: 1000
   PUID: 1000
 ports:
@@ -80,6 +81,9 @@ ports:
 ports_description:
   80/tcp: web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/guacamole/config.yaml b/guacamole/config.yaml
index 6e280d264..f31060a7b 100644
--- a/guacamole/config.yaml
+++ b/guacamole/config.yaml
@@ -83,6 +83,7 @@ map:
   - ssl:ro
 name: Guacamole Client
 options:
+  env_vars: []
   EXTENSIONS: auth-totp
 panel_admin: false
 panel_icon: mdi:lan
@@ -91,6 +92,9 @@ ports:
 ports_description:
   8080/tcp: web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   EXTENSIONS: str?
   TZ: str?
 slug: guacamole
diff --git a/immich/config.yaml b/immich/config.yaml
index 66151f2d9..b142beaa4 100644
--- a/immich/config.yaml
+++ b/immich/config.yaml
@@ -94,6 +94,7 @@ map:
   - ssl:rw
 name: Immich
 options:
+  env_vars: []
   DB_DATABASE_NAME: immich
   DB_HOSTNAME: homeassistant.local
   DB_PASSWORD: homeassistant
@@ -113,6 +114,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   DB_DATABASE_NAME: str
   DB_HOSTNAME: str
   DB_PASSWORD: str
diff --git a/immich_cuda/config.yaml b/immich_cuda/config.yaml
index da1e65d2d..ae5b81dff 100644
--- a/immich_cuda/config.yaml
+++ b/immich_cuda/config.yaml
@@ -93,6 +93,7 @@ map:
   - ssl:rw
 name: Immich Cuda
 options:
+  env_vars: []
   DB_DATABASE_NAME: immich
   DB_HOSTNAME: homeassistant.local
   DB_PASSWORD: homeassistant
@@ -112,6 +113,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   DB_DATABASE_NAME: str
   DB_HOSTNAME: str
   DB_PASSWORD: str
diff --git a/immich_frame/config.yaml b/immich_frame/config.yaml
index 98970591d..d2dc4b868 100644
--- a/immich_frame/config.yaml
+++ b/immich_frame/config.yaml
@@ -14,6 +14,9 @@ ports:
 ports_description:
   8080/tcp: Web UI port
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   ApiKey: str
   ImmichServerUrl: str
   TZ: str?
diff --git a/immich_noml/config.yaml b/immich_noml/config.yaml
index 5811e7350..c55f6cc9e 100644
--- a/immich_noml/config.yaml
+++ b/immich_noml/config.yaml
@@ -94,6 +94,7 @@ map:
   - ssl:rw
 name: Immich without Machine Learning
 options:
+  env_vars: []
   DB_DATABASE_NAME: immich
   DB_HOSTNAME: homeassistant.local
   DB_PASSWORD: homeassistant
@@ -113,6 +114,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   DB_DATABASE_NAME: str
   DB_HOSTNAME: str
   DB_PASSWORD: str
diff --git a/immich_openvino/config.yaml b/immich_openvino/config.yaml
index 732228407..abd4004a9 100644
--- a/immich_openvino/config.yaml
+++ b/immich_openvino/config.yaml
@@ -93,6 +93,7 @@ map:
   - ssl:rw
 name: Immich Openvino
 options:
+  env_vars: []
   DB_DATABASE_NAME: immich
   DB_HOSTNAME: homeassistant.local
   DB_PASSWORD: homeassistant
@@ -112,6 +113,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   DB_DATABASE_NAME: str
   DB_HOSTNAME: str
   DB_PASSWORD: str
diff --git a/immich_power_tools/config.yaml b/immich_power_tools/config.yaml
index 76d97f3ad..fcaae64cf 100644
--- a/immich_power_tools/config.yaml
+++ b/immich_power_tools/config.yaml
@@ -14,6 +14,9 @@ ports:
 ports_description:
   3000/tcp: Web UI port
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   DB_DATABASE_NAME: str
   DB_HOST: str
   DB_PASSWORD: str
diff --git a/inadyn/config.yaml b/inadyn/config.yaml
index 5358e958c..f30340fad 100644
--- a/inadyn/config.yaml
+++ b/inadyn/config.yaml
@@ -76,12 +76,16 @@ map:
   - ssl
 name: Inadyn
 options:
+  env_vars: []
   providers:
     - hostname: dynamic-subdomain.example.com
       password: password
       provider: yourprovider
       username: username
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   allow_ipv6: bool?
   fake_address: bool?
   forced_update: int?
diff --git a/jackett/config.yaml b/jackett/config.yaml
index 3665efc80..e3e7fe60b 100644
--- a/jackett/config.yaml
+++ b/jackett/config.yaml
@@ -81,6 +81,7 @@ map:
   - ssl
 name: Jackett NAS
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
 ports:
@@ -93,6 +94,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/jellyfin/config.yaml b/jellyfin/config.yaml
index ff5ddda70..1f930f301 100644
--- a/jellyfin/config.yaml
+++ b/jellyfin/config.yaml
@@ -89,6 +89,7 @@ map:
   - ssl
 name: Jellyfin NAS
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
   data_location: /share/jellyfin
@@ -109,6 +110,9 @@ privileged:
   - DAC_READ_SEARCH
   - NET_ADMIN
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   DOCKER_MODS: list(linuxserver/mods:jellyfin-opencl-intel|linuxserver/mods:jellyfin-amd|linuxserver/mods:jellyfin-rffmpeg|)?
   PGID: int
   PUID: int
diff --git a/jellyseerr/config.yaml b/jellyseerr/config.yaml
index 7912057c6..0c6237384 100644
--- a/jellyseerr/config.yaml
+++ b/jellyseerr/config.yaml
@@ -73,6 +73,7 @@ map:
   - config:rw
 name: Jellyseerr
 options:
+  env_vars: []
   TYPE: emby
   TZ: Europe/Paris
 ports:
@@ -81,6 +82,9 @@ ports_description:
   5055/tcp: web interface
 privileged: []
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   TYPE: list(emby|jellyfin)
   TZ: str?
 slug: jellyseerr
diff --git a/joal/config.yaml b/joal/config.yaml
index df04df9fe..14f4b8661 100644
--- a/joal/config.yaml
+++ b/joal/config.yaml
@@ -11,6 +11,7 @@ map:
   - config:rw
 name: Joal
 options:
+  env_vars: []
   run_duration: 12h
   secret_token: lrMY24Byhx
   ui_path: joal
@@ -23,6 +24,9 @@ ports_description:
   49152/tcp: torrent port (not required)
   8081/tcp: Web UI port (required)
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   run_duration: str?
   secret_token: str
   ui_path: str
diff --git a/joplin/config.yaml b/joplin/config.yaml
index fec0d530b..749fe578a 100644
--- a/joplin/config.yaml
+++ b/joplin/config.yaml
@@ -73,6 +73,7 @@ map:
   - share:rw
 name: Joplin Server
 options:
+  env_vars: []
   APP_BASE_URL: http://your_domain:port
   data_location: /config/addons_config/joplin
 ports:
@@ -82,6 +83,9 @@ ports_description:
 privileged:
   - SYS_TIME
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   APP_BASE_URL: str
   DB_CLIENT: str?
   MAILER_AUTH_PASSWORD: str?
diff --git a/kometa/config.yaml b/kometa/config.yaml
index 41e34958d..7df589a3e 100644
--- a/kometa/config.yaml
+++ b/kometa/config.yaml
@@ -75,6 +75,7 @@ map:
   - media:rw
 name: Kometa
 options:
+  env_vars: []
   KOMETA_CONFIG: /config/addons_config/kometa/config.yml
   PGID: 0
   PUID: 0
@@ -82,6 +83,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   KOMETA_CONFIG: str
   KOMETA_NO_MISSING: bool?
   KOMETA_RUN: bool?
diff --git a/librespeed/config.yaml b/librespeed/config.yaml
index 41a81358c..6cde3a1b5 100644
--- a/librespeed/config.yaml
+++ b/librespeed/config.yaml
@@ -76,6 +76,7 @@ map:
   - addon_config:rw
 name: LibreSpeed
 options:
+  env_vars: []
   CUSTOM_RESULTS: false
   IPINFO_APIKEY: ""
   PGID: 1000
@@ -87,6 +88,9 @@ ports:
 ports_description:
   80/tcp: web interface (Not required for Ingress)
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CUSTOM_RESULTS: bool?
   IPINFO_APIKEY: str?
   PASSWORD: str?
diff --git a/lidarr/config.yaml b/lidarr/config.yaml
index 012b0d50a..63e68ef48 100644
--- a/lidarr/config.yaml
+++ b/lidarr/config.yaml
@@ -78,6 +78,7 @@ map:
   - media:rw
 name: Lidarr NAS
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
 ports:
@@ -88,6 +89,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/linkwarden/config.yaml b/linkwarden/config.yaml
index 100fe8666..54ce3f000 100644
--- a/linkwarden/config.yaml
+++ b/linkwarden/config.yaml
@@ -26,6 +26,9 @@ ports:
 ports_description:
   3000/tcp: Webui
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   AUTHENTIK_CLIENT_ID: str?
   AUTHENTIK_CLIENT_SECRET: str?
   AUTHENTIK_CUSTOM_NAME: str?
diff --git a/mealie/config.yaml b/mealie/config.yaml
index 469ef30f8..02036ab5f 100644
--- a/mealie/config.yaml
+++ b/mealie/config.yaml
@@ -85,6 +85,7 @@ map:
   - ssl:rw
 name: Mealie
 options:
+  env_vars: []
   ALLOW_SIGNUP: true
   DATA_DIR: /config
   PGID: 1000
@@ -99,6 +100,9 @@ ports:
 ports_description:
   9001/tcp: Web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   ALLOW_SIGNUP: bool
   BASE_URL: str?
   DATA_DIR: str?
diff --git a/monica/config.yaml b/monica/config.yaml
index 6594a81af..4e50ec668 100644
--- a/monica/config.yaml
+++ b/monica/config.yaml
@@ -71,6 +71,7 @@ environment:
 image: ghcr.io/alexbelgium/monica-{arch}
 init: false
 options:
+  env_vars: []
   database: sqlite
 map:
   - type: addon_config
@@ -81,6 +82,9 @@ ports:
 ports_description:
   80/tcp: webui
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   database: list(sqlite|MariaDB_addon|Mysql_external)
   APP_KEY: str?
   DB_DATABASE: str?
diff --git a/mylar3/config.yaml b/mylar3/config.yaml
index 68afa8265..78eb84a3b 100644
--- a/mylar3/config.yaml
+++ b/mylar3/config.yaml
@@ -77,6 +77,7 @@ map:
   - media:rw
 name: Mylar3
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
 ports:
@@ -87,6 +88,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/navidrome/config.yaml b/navidrome/config.yaml
index 8f3304380..d04de13bd 100644
--- a/navidrome/config.yaml
+++ b/navidrome/config.yaml
@@ -14,6 +14,7 @@ map:
   - ssl:rw
 name: Navidrome
 options:
+  env_vars: []
   base_url: /
   certfile: fullchain.pem
   data_folder: /data
@@ -26,6 +27,9 @@ ports:
 ports_description:
   4533/tcp: Web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   base_url: str
   certfile: str?
   cifsdomain: str?
diff --git a/netalertx/config.yaml b/netalertx/config.yaml
index 8bbd1a8be..af6a83d4a 100644
--- a/netalertx/config.yaml
+++ b/netalertx/config.yaml
@@ -35,6 +35,9 @@ privileged:
   - NET_ADMIN
   - NET_RAW
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   APP_CONF_OVERRIDE: str?
   TZ: str?
 services:
diff --git a/netalertx_fa/config.yaml b/netalertx_fa/config.yaml
index 8ce9b17f8..aec32c146 100644
--- a/netalertx_fa/config.yaml
+++ b/netalertx_fa/config.yaml
@@ -36,6 +36,9 @@ privileged:
   - NET_ADMIN
   - NET_RAW
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   APP_CONF_OVERRIDE: str?
   TZ: str?
 services:
diff --git a/nextcloud/config.yaml b/nextcloud/config.yaml
index 3ed705b00..c77128633 100644
--- a/nextcloud/config.yaml
+++ b/nextcloud/config.yaml
@@ -94,6 +94,7 @@ map:
   - ssl:rw
 name: Nextcloud
 options:
+  env_vars: []
   Full_Text_Search: false
   OCR: false
   OCRLANG: fra
@@ -118,6 +119,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   Full_Text_Search: bool?
   OCR: bool?
   OCRLANG: str?
diff --git a/nzbget/config.yaml b/nzbget/config.yaml
index 6ec813162..d90cc583b 100644
--- a/nzbget/config.yaml
+++ b/nzbget/config.yaml
@@ -79,6 +79,7 @@ map:
   - media:rw
 name: Nzbget
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
 panel_admin: false
@@ -91,6 +92,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/ombi/config.yaml b/ombi/config.yaml
index 27d779f6b..d6a77772b 100644
--- a/ombi/config.yaml
+++ b/ombi/config.yaml
@@ -72,6 +72,7 @@ map:
   - config:rw
 name: Ombi
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
 ports:
@@ -79,6 +80,9 @@ ports:
 ports_description:
   3579/tcp: Web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
 slug: ombi
diff --git a/openproject/config.yaml b/openproject/config.yaml
index db78af959..295c8ac5e 100644
--- a/openproject/config.yaml
+++ b/openproject/config.yaml
@@ -16,6 +16,7 @@ map:
   - share:rw
 name: Openproject
 options:
+  env_vars: []
   OPENPROJECT_DEFAULT__LANGUAGE: en
   OPENPROJECT_HOST__NAME: homeassistant:8080
   OPENPROJECT_HTTPS: "false"
@@ -24,6 +25,9 @@ ports:
 ports_description:
   8080/tcp: Web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   OPENPROJECT_DEFAULT__LANGUAGE: str
   OPENPROJECT_HOST__NAME: str
   OPENPROJECT_HTTPS: bool
diff --git a/organizr/config.yaml b/organizr/config.yaml
index e911a560f..fa97d57dc 100644
--- a/organizr/config.yaml
+++ b/organizr/config.yaml
@@ -72,6 +72,7 @@ map:
   - ssl
 name: Organizr
 options:
+  env_vars: []
   PGID: "0"
   PUID: "0"
 ports:
@@ -79,6 +80,9 @@ ports:
 ports_description:
   80/tcp: web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
 slug: organizr
diff --git a/overseerr/config.yaml b/overseerr/config.yaml
index 348b86357..c869a809a 100644
--- a/overseerr/config.yaml
+++ b/overseerr/config.yaml
@@ -74,6 +74,7 @@ map:
   - config:rw
 name: Overseerr
 options:
+  env_vars: []
   CONFIG_LOCATION: /config/addons_config/overseerr
   PGID: "0"
   PUID: "0"
@@ -83,6 +84,9 @@ ports_description:
   5055/tcp: web interface
 privileged: []
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CONFIG_LOCATION: str
   PGID: int
   PUID: int
diff --git a/photoprism/config.yaml b/photoprism/config.yaml
index 7c8614f07..70b3a96a9 100644
--- a/photoprism/config.yaml
+++ b/photoprism/config.yaml
@@ -84,6 +84,7 @@ map:
   - ssl:ro
 name: Photoprism
 options:
+  env_vars: []
   BACKUP_PATH: /share/photoprism/backup
   CONFIG_LOCATION: /config/addons_config/photoprism/config.yaml
   DB_TYPE: sqlite
@@ -105,6 +106,9 @@ privileged:
   - SYS_RAWIO
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   BACKUP_PATH: str
   CONFIG_LOCATION: str
   DB_TYPE: list(sqlite|mariadb_addon|external)
diff --git a/piwigo/config.yaml b/piwigo/config.yaml
index 5cb5eb310..f81fc644f 100644
--- a/piwigo/config.yaml
+++ b/piwigo/config.yaml
@@ -77,6 +77,7 @@ map:
   - ssl
 name: Piwigo
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
 ports:
@@ -87,6 +88,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/plex/config.yaml b/plex/config.yaml
index 8530a31d6..8d9f6831f 100644
--- a/plex/config.yaml
+++ b/plex/config.yaml
@@ -124,6 +124,7 @@ map:
   - ssl
 name: Plex NAS
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
   claim: Get_from_https://www.plex.tv/claim
@@ -155,6 +156,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/portainer/config.yaml b/portainer/config.yaml
index 84a3e6e93..997c41ad4 100644
--- a/portainer/config.yaml
+++ b/portainer/config.yaml
@@ -20,6 +20,7 @@ map:
   - ssl
 name: Portainer
 options:
+  env_vars: []
   certfile: fullchain.pem
   keyfile: privkey.pem
   password: homeassistant
@@ -33,6 +34,9 @@ ports_description:
   8000/tcp: Edge Agent Api (Enable when managing remote edge agents)
   9099/tcp: Web UI port
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   certfile: str
   keyfile: str
   password: str?
diff --git a/portainer_agent/config.yaml b/portainer_agent/config.yaml
index 87d9d387c..7c99b851a 100644
--- a/portainer_agent/config.yaml
+++ b/portainer_agent/config.yaml
@@ -23,6 +23,9 @@ ports_description:
   80/tcp: Portainer edge agent
   9001/tcp: Portainer agent
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   AGENT_CLUSTER_ADDR: str?
   AGENT_CLUSTER_PROBE_INTERVAL: str?
   AGENT_CLUSTER_PROBE_TIMEOUT: str?
diff --git a/postgres_15/config.yaml b/postgres_15/config.yaml
index 01550c467..3ba9b61ca 100644
--- a/postgres_15/config.yaml
+++ b/postgres_15/config.yaml
@@ -18,12 +18,16 @@ map:
   - media:rw
 name: Postgres 15
 options:
+  env_vars: []
   POSTGRES_PASSWORD: homeassistant
 ports:
   5432/tcp: 5432
 ports_description:
   5432/tcp: Postgres
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   POSTGRES_DB: str?
   POSTGRES_HOST_AUTH_METHOD: str?
   POSTGRES_INITDB_ARGS: str?
diff --git a/postgres_17/config.yaml b/postgres_17/config.yaml
index 654126c46..576ababe3 100644
--- a/postgres_17/config.yaml
+++ b/postgres_17/config.yaml
@@ -17,12 +17,16 @@ map:
   - media:rw
 name: Postgres 17
 options:
+  env_vars: []
   POSTGRES_PASSWORD: homeassistant
 ports:
   5432/tcp: 5432
 ports_description:
   5432/tcp: Postgres
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   POSTGRES_DB: str?
   POSTGRES_HOST_AUTH_METHOD: str?
   POSTGRES_INITDB_ARGS: str?
diff --git a/prowlarr/config.yaml b/prowlarr/config.yaml
index 76973db9f..f1a637a96 100644
--- a/prowlarr/config.yaml
+++ b/prowlarr/config.yaml
@@ -79,6 +79,7 @@ map:
   - ssl
 name: Prowlarr NAS
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
 ports:
@@ -89,6 +90,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/qbittorrent/config.yaml b/qbittorrent/config.yaml
index 339130ea4..deb82901d 100644
--- a/qbittorrent/config.yaml
+++ b/qbittorrent/config.yaml
@@ -81,6 +81,7 @@ map:
   - ssl
 name: qBittorrent
 options:
+  env_vars: []
   DNS_server: 8.8.8.8,1.1.1.1
   PGID: "0"
   PUID: "0"
@@ -111,6 +112,9 @@ privileged:
   - DAC_READ_SEARCH
   - NET_ADMIN
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   DNS_server: str?
   PGID: int?
   PUID: int?
diff --git a/radarr/config.yaml b/radarr/config.yaml
index 1cb7c25bb..c4d95ccf7 100644
--- a/radarr/config.yaml
+++ b/radarr/config.yaml
@@ -80,6 +80,7 @@ map:
   - ssl
 name: Radarr
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
   connection_mode: ingress_noauth
@@ -93,6 +94,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/readarr/config.yaml b/readarr/config.yaml
index 5ca8b6be8..64dfe0bbb 100644
--- a/readarr/config.yaml
+++ b/readarr/config.yaml
@@ -78,6 +78,7 @@ map:
   - media:rw
 name: Readarr
 options:
+  env_vars: []
   CONFIG_LOCATION: /config/addons_config/readarr
   PGID: 0
   PUID: 0
@@ -92,6 +93,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CONFIG_LOCATION: str
   PGID: int
   PUID: int
diff --git a/requestrr/config.yaml b/requestrr/config.yaml
index f671af1cb..991052f4a 100644
--- a/requestrr/config.yaml
+++ b/requestrr/config.yaml
@@ -77,6 +77,7 @@ map:
   - addon_config:rw
 name: Requestrr
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
 ports:
@@ -87,6 +88,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/resiliosync/config.yaml b/resiliosync/config.yaml
index 56b856f05..3f6baa7e4 100644
--- a/resiliosync/config.yaml
+++ b/resiliosync/config.yaml
@@ -78,6 +78,7 @@ map:
   - ssl:rw
 name: ResilioSync
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
   config_location: /config/addons_config/resiliosync
@@ -96,6 +97,9 @@ privileged:
   - DAC_READ_SEARCH
   - NET_ADMIN
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/sabnzbd/config.yaml b/sabnzbd/config.yaml
index eca35308e..e6022ed97 100644
--- a/sabnzbd/config.yaml
+++ b/sabnzbd/config.yaml
@@ -80,6 +80,7 @@ map:
   - media:rw
 name: Sabnzbd
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
 panel_admin: false
@@ -92,6 +93,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/scrutiny/config.yaml b/scrutiny/config.yaml
index 373ac9e50..a50202b5f 100644
--- a/scrutiny/config.yaml
+++ b/scrutiny/config.yaml
@@ -84,6 +84,7 @@ map:
   - addon_config:rw
 name: Scrutiny
 options:
+  env_vars: []
   Updates: Hourly
 panel_admin: false
 panel_icon: mdi:glasses
@@ -98,6 +99,9 @@ privileged:
   - SYS_RAWIO
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   COLLECTOR_API_ENDPOINT: str?
   COLLECTOR_HOST_ID: str?
   Mode: list(Collector+WebUI|Collector)?
diff --git a/scrutiny_fa/config.yaml b/scrutiny_fa/config.yaml
index 104c8da45..92b2ba4be 100644
--- a/scrutiny_fa/config.yaml
+++ b/scrutiny_fa/config.yaml
@@ -16,6 +16,7 @@ map:
   - addon_config:rw
 name: Scrutiny (Full Access)
 options:
+  env_vars: []
   Updates: Hourly
 panel_admin: false
 panel_icon: mdi:glasses
@@ -30,6 +31,9 @@ privileged:
   - SYS_RAWIO
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   COLLECTOR_API_ENDPOINT: str?
   COLLECTOR_HOST_ID: str?
   Mode: list(Collector+WebUI|Collector)?
diff --git a/seafile/config.yaml b/seafile/config.yaml
index 730245b70..9cd9d916f 100644
--- a/seafile/config.yaml
+++ b/seafile/config.yaml
@@ -79,6 +79,7 @@ map:
   - ssl
 name: Seafile
 options:
+  env_vars: []
   CONFIG_LOCATION: /config/addons_config/seafile/config.yaml
   FILE_SERVER_ROOT: http://homeassistant.local:8082
   PGID: 1000
@@ -104,6 +105,9 @@ privileged:
   - DAC_READ_SEARCH
   - NET_ADMIN
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CONFIG_LOCATION: str?
   FILE_SERVER_ROOT: str
   PGID: int
diff --git a/sonarr/config.yaml b/sonarr/config.yaml
index e28bc672f..de736670e 100644
--- a/sonarr/config.yaml
+++ b/sonarr/config.yaml
@@ -82,6 +82,7 @@ map:
   - ssl
 name: Sonarr
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
   connection_mode: ingress_noauth
@@ -95,6 +96,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/sponsorblockcast/config.yaml b/sponsorblockcast/config.yaml
index f76e31c8c..b77b530c6 100644
--- a/sponsorblockcast/config.yaml
+++ b/sponsorblockcast/config.yaml
@@ -12,8 +12,12 @@ map:
   - addon_config:rw
 name: Castsponsorskip
 options:
+  env_vars: []
   CSS_CATEGORIES: sponsor, intro, outro, selfpromo
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CSS_CATEGORIES: str
   CSS_DISCOVER_INTERVAL: str?
   CSS_MUTE_ADS: bool?
diff --git a/spotweb/config.yaml b/spotweb/config.yaml
index 6d1ebcae6..f908a500c 100644
--- a/spotweb/config.yaml
+++ b/spotweb/config.yaml
@@ -14,6 +14,7 @@ map:
   - backup:rw
 name: Spotweb
 options:
+  env_vars: []
   certfile: fullchain.pem
   keyfile: privkey.pem
   ssl: false
@@ -25,6 +26,9 @@ ports:
 ports_description:
   80/tcp: Not required for Ingress
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   certfile: str
   keyfile: str
   log_level: list(trace|debug|info|notice|warning|error|fatal)?
diff --git a/tandoor_recipes/config.yaml b/tandoor_recipes/config.yaml
index 5af9aa771..7303338dd 100644
--- a/tandoor_recipes/config.yaml
+++ b/tandoor_recipes/config.yaml
@@ -78,6 +78,7 @@ map:
   - media:rw
 name: Tandoor recipes
 options:
+  env_vars: []
   ALLOWED_HOSTS: "*"
   DB_TYPE: sqlite
   DEBUG: "0"
@@ -91,6 +92,9 @@ ports:
 ports_description:
   80/tcp: Web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   AI_API_KEY: str?
   AI_MODEL_NAME: str?
   AI_RATELIMIT: str?
diff --git a/tdarr/config.yaml b/tdarr/config.yaml
index 037d35269..e5c9a6b4b 100644
--- a/tdarr/config.yaml
+++ b/tdarr/config.yaml
@@ -96,6 +96,7 @@ map:
   - ssl:rw
 name: Tdarr
 options:
+  env_vars: []
   CONFIG_LOCATION: /config/addons_config/tdarr
 panel_admin: false
 panel_icon: mdi:file-search
@@ -109,6 +110,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CONFIG_LOCATION: str
   TZ: str?
   cifsdomain: str?
diff --git a/tor/config.yaml b/tor/config.yaml
index 009d96e06..f07caca75 100644
--- a/tor/config.yaml
+++ b/tor/config.yaml
@@ -10,6 +10,7 @@ map:
   - ssl:rw
 name: Tor with bridges
 options:
+  env_vars: []
   bridges: []
   client_names: []
   hidden_services: true
@@ -26,6 +27,9 @@ ports_description:
   9050/tcp: Tor SOCKS proxy port
   9080/tcp: Tor HTTP tunnel port
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   bridges:
     - str
   client_names:
diff --git a/transmission/config.yaml b/transmission/config.yaml
index f1978f7d7..e3b3a062a 100644
--- a/transmission/config.yaml
+++ b/transmission/config.yaml
@@ -82,6 +82,7 @@ map:
   - ssl
 name: Transmission
 options:
+  env_vars: []
   DNS_server: 8.8.8.8,1.1.1.1
   PGID: 0
   PUID: 0
@@ -102,6 +103,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   DNS_server: str?
   PGID: int
   PUID: int
diff --git a/transmission_openvpn/config.yaml b/transmission_openvpn/config.yaml
index 7cf3f6e92..caed04fe1 100644
--- a/transmission_openvpn/config.yaml
+++ b/transmission_openvpn/config.yaml
@@ -82,6 +82,7 @@ map:
   - ssl
 name: Transmission Openvpn
 options:
+  env_vars: []
   DEBUG: false
   DNS_server: 8.8.8.8,1.1.1.1
   LOCAL_NETWORK: 192.168.178.0/24
@@ -113,6 +114,9 @@ privileged:
   - DAC_READ_SEARCH
   - NET_ADMIN
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   DEBUG: bool
   DNS_server: str?
   LOCAL_NETWORK: str
diff --git a/ubooquity/config.yaml b/ubooquity/config.yaml
index 548999ab2..9aca1f16a 100644
--- a/ubooquity/config.yaml
+++ b/ubooquity/config.yaml
@@ -74,6 +74,7 @@ map:
   - ssl
 name: Ubooquity
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
   certfile: fullchain.pem
@@ -91,6 +92,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/unpackerr/config.yaml b/unpackerr/config.yaml
index a5328615d..845c026ea 100644
--- a/unpackerr/config.yaml
+++ b/unpackerr/config.yaml
@@ -78,6 +78,7 @@ map:
   - ssl
 name: Unpackerr
 options:
+  env_vars: []
   PGID: 1000
   PUID: 1000
   extraction_path: /share/downloads_packed
@@ -86,6 +87,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/webtop/config.yaml b/webtop/config.yaml
index 01eda9ea4..f3eab1289 100644
--- a/webtop/config.yaml
+++ b/webtop/config.yaml
@@ -85,6 +85,7 @@ map:
   - ssl
 name: Webtop xfce
 options:
+  env_vars: []
   DNS_server: 8.8.8.8
   PGID: 0
   PUID: 0
@@ -117,6 +118,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   DNS_server: str?
   DRINODE: list(/dev/dri/card0|/dev/dri/card1|/dev/dri/card2|/dev/dri/renderD128|/dev/dri/renderD129|)?
   KEYBOARD: list(da-dk-qwerty|de-de-qwertz|en-gb-qwerty|en-us-qwerty|es-es-qwerty|fr-ch-qwertz|fr-fr-azerty|it-it-qwerty|ja-jp-qwerty|pt-br-qwerty|sv-se-qwerty|tr-tr-qwerty)?
diff --git a/webtop_kde/config.yaml b/webtop_kde/config.yaml
index 4829d7718..39b219ba4 100644
--- a/webtop_kde/config.yaml
+++ b/webtop_kde/config.yaml
@@ -82,6 +82,7 @@ map:
   - ssl
 name: Webtop KDE
 options:
+  env_vars: []
   DNS_server: 8.8.8.8
   PGID: 0
   PUID: 0
@@ -118,6 +119,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   DNS_server: str?
   DRINODE: list(/dev/dri/card0|/dev/dri/card1|/dev/dri/card2|/dev/dri/renderD128|/dev/dri/renderD129|)?
   KEYBOARD: list(da-dk-qwerty|de-de-qwertz|en-gb-qwerty|en-us-qwerty|es-es-qwerty|fr-ch-qwertz|fr-fr-azerty|it-it-qwerty|ja-jp-qwerty|pt-br-qwerty|sv-se-qwerty|tr-tr-qwerty)?
diff --git a/webtrees/config.yaml b/webtrees/config.yaml
index 2c16cde80..f80badf1d 100644
--- a/webtrees/config.yaml
+++ b/webtrees/config.yaml
@@ -83,6 +83,7 @@ map:
   - ssl
 name: Webtrees
 options:
+  env_vars: []
   BASE_URL: http://192.168.178.23
   DATA_LOCATION: /config/data
   certfile: fullchain.pem
@@ -98,6 +99,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   BASE_URL: url
   DATA_LOCATION: str
   base_url_portless: bool?
diff --git a/wger/config.yaml b/wger/config.yaml
index 665a7e5e5..8e892f454 100644
--- a/wger/config.yaml
+++ b/wger/config.yaml
@@ -10,12 +10,16 @@ map:
   - ssl:ro
 name: Wger
 options:
+  env_vars: []
   CONFIG_LOCATION: /config/addons_config/wger/config.yaml
 ports:
   80/tcp: 9927
 ports_description:
   80/tcp: Web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CONFIG_LOCATION: str
 slug: wger
 udev: true
diff --git a/whoogle/config.yaml b/whoogle/config.yaml
index df11c266b..577d9ffa0 100644
--- a/whoogle/config.yaml
+++ b/whoogle/config.yaml
@@ -74,6 +74,7 @@ map:
   - addon_config:rw
 name: Whoogle Search
 options:
+  env_vars: []
   TZ: Europe/Amsterdam
   WHOOGLE_CONFIG_LANGUAGE: lang_en
   WHOOGLE_CONFIG_URL: https://website.com
@@ -84,6 +85,9 @@ ports:
 ports_description:
   5000/tcp: Web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   HTTPS_ONLY: list(0|1)?
   TZ: str
   WHOOGLE_ALT_IG: str?
diff --git a/zoneminder/config.yaml b/zoneminder/config.yaml
index b351f54ce..0101ad4e2 100644
--- a/zoneminder/config.yaml
+++ b/zoneminder/config.yaml
@@ -81,12 +81,16 @@ map:
   - ssl
 name: Zoneminder
 options:
+  env_vars: []
   Images_location: /config/addons_config/zoneminder/images
 ports:
   80/tcp: 3778
 ports_description:
   80/tcp: web interface
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   Images_location: str
 services:
   - mysql:want
diff --git a/zzz_archived_bitwarden/config.yaml b/zzz_archived_bitwarden/config.yaml
index 3d2bea4c4..0ccda7544 100644
--- a/zzz_archived_bitwarden/config.yaml
+++ b/zzz_archived_bitwarden/config.yaml
@@ -10,6 +10,7 @@ map:
   - ssl
 name: zzz_archived - Vaultwarden
 options:
+  env_vars: []
   certfile: fullchain.pem
   keyfile: privkey.pem
   ssl: true
@@ -18,6 +19,9 @@ ports:
 ports_description:
   7277/tcp: Bitwarden Vault
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   certfile: str
   keyfile: str
   log_level: list(trace|debug|info|notice|warning|error|fatal)?
diff --git a/zzz_archived_code-server/config.yaml b/zzz_archived_code-server/config.yaml
index d8cd0e5e9..e114fbe5f 100644
--- a/zzz_archived_code-server/config.yaml
+++ b/zzz_archived_code-server/config.yaml
@@ -78,6 +78,7 @@ map:
   - ssl
 name: "zzz_archived : Code-server (VScode)"
 options:
+  env_vars: []
   PGID: 0
   PUID: 0
 ports:
@@ -88,6 +89,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PUID: int
   TZ: str?
diff --git a/zzz_archived_paperless_ngx/config.yaml b/zzz_archived_paperless_ngx/config.yaml
index 6661357c5..f320ff75d 100644
--- a/zzz_archived_paperless_ngx/config.yaml
+++ b/zzz_archived_paperless_ngx/config.yaml
@@ -84,6 +84,7 @@ map:
   - ssl
 name: zzz_archived - Paperless NGX
 options:
+  env_vars: []
   CONFIG_LOCATION: /config/config.yaml
   OCRLANG: ENG FRA DEU
   PAPERLESS_OCR_MODE: skip
@@ -102,6 +103,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CONFIG_LOCATION: str
   OCRLANG: str?
   PAPERLESS_CONSUMPTION_DIR: str?
diff --git a/zzz_archived_papermerge/config.yaml b/zzz_archived_papermerge/config.yaml
index 250f87f78..6c8fdbf15 100644
--- a/zzz_archived_papermerge/config.yaml
+++ b/zzz_archived_papermerge/config.yaml
@@ -75,6 +75,7 @@ map:
   - config:rw
 name: zzz_archived - Papermerge
 options:
+  env_vars: []
   CONFIG_LOCATION: /config/addons_config/papermerge
   PGID: 0
   PUID: 0
@@ -89,6 +90,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   CONFIG_LOCATION: str
   PGID: int
   PUID: int
diff --git a/zzz_archived_plex_meta_manager/config.yaml b/zzz_archived_plex_meta_manager/config.yaml
index 7d300c250..0f429a5ec 100644
--- a/zzz_archived_plex_meta_manager/config.yaml
+++ b/zzz_archived_plex_meta_manager/config.yaml
@@ -76,6 +76,7 @@ map:
   - media:rw
 name: zzz_archived - Plex meta manager
 options:
+  env_vars: []
   PGID: 0
   PMM_CONFIG: /config/addons_config/plex-data-manager/config.yml
   PUID: 0
@@ -83,6 +84,9 @@ privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
 schema:
+  env_vars:
+    - name: match(^[A-Z0-9_]+$)
+      value: str?
   PGID: int
   PMM_CONFIG: str
   PMM_NO_MISSING: bool?