diff --git a/internal/helm/config.go b/internal/helm/config.go
index 3f5991c..7c9a78f 100644
--- a/internal/helm/config.go
+++ b/internal/helm/config.go
@@ -53,7 +53,25 @@ type Config struct {
 
 // NewConfig creates a Config and reads environment variables into it, accounting for several possible formats.
 func NewConfig(stdout, stderr io.Writer) (*Config, error) {
+	var aliases settingAliases
+	if err := envconfig.Process("plugin", &aliases); err != nil {
+		return nil, err
+	}
+
+	if err := envconfig.Process("", &aliases); err != nil {
+		return nil, err
+	}
+
 	cfg := Config{
+		Command:        aliases.Command,
+		AddRepos:       aliases.AddRepos,
+		APIServer:      aliases.APIServer,
+		ServiceAccount: aliases.ServiceAccount,
+		Wait:           aliases.Wait,
+		Force:          aliases.Force,
+		KubeToken:      aliases.KubeToken,
+		Certificate:    aliases.Certificate,
+
 		Stdout: stdout,
 		Stderr: stderr,
 	}
@@ -65,35 +83,6 @@ func NewConfig(stdout, stderr io.Writer) (*Config, error) {
 		return nil, err
 	}
 
-	var aliases settingAliases
-	if err := envconfig.Process("plugin", &aliases); err != nil {
-		return nil, err
-	}
-	if aliases.Command != nil {
-		cfg.Command = *aliases.Command
-	}
-	if aliases.AddRepos != nil {
-		cfg.AddRepos = *aliases.AddRepos
-	}
-	if aliases.APIServer != nil {
-		cfg.APIServer = *aliases.APIServer
-	}
-	if aliases.ServiceAccount != nil {
-		cfg.ServiceAccount = *aliases.ServiceAccount
-	}
-	if aliases.Wait != nil {
-		cfg.Wait = *aliases.Wait
-	}
-	if aliases.Force != nil {
-		cfg.Force = *aliases.Force
-	}
-	if aliases.KubeToken != nil {
-		cfg.KubeToken = *aliases.KubeToken
-	}
-	if aliases.Certificate != nil {
-		cfg.Certificate = *aliases.Certificate
-	}
-
 	if justNumbers.MatchString(cfg.Timeout) {
 		cfg.Timeout = fmt.Sprintf("%ss", cfg.Timeout)
 	}
@@ -125,12 +114,12 @@ func (cfg *Config) deprecationWarn() {
 }
 
 type settingAliases struct {
-	Command        *string   `envconfig:"mode"`
-	AddRepos       *[]string `envconfig:"add_repos"`
-	APIServer      *string   `envconfig:"kube_api_server"`
-	ServiceAccount *string   `envconfig:"kube_service_account"`
-	Wait           *bool     `envconfig:"wait_for_upgrade"`
-	Force          *bool     `envconfig:"force_upgrade"`
-	KubeToken      *string   `envconfig:"kube_token"`
-	Certificate    *string   `envconfig:"kube_certificate"`
+	Command        string   `envconfig:"mode"`
+	AddRepos       []string `envconfig:"add_repos"`
+	APIServer      string   `envconfig:"kube_api_server"`
+	ServiceAccount string   `envconfig:"kube_service_account"`
+	Wait           bool     `envconfig:"wait_for_upgrade"`
+	Force          bool     `envconfig:"force_upgrade"`
+	KubeToken      string   `envconfig:"kube_token"`
+	Certificate    string   `envconfig:"kube_certificate"`
 }
diff --git a/internal/helm/config_test.go b/internal/helm/config_test.go
index 70ce91a..a59e3dd 100644
--- a/internal/helm/config_test.go
+++ b/internal/helm/config_test.go
@@ -105,6 +105,16 @@ func (suite *ConfigTestSuite) TestNewConfigWithAliases() {
 	suite.Equal("d2l0aCBpdHMgaGVhZA==", cfg.Certificate, "Certificate should be aliased")
 }
 
+func (suite *ConfigTestSuite) TestNewConfigWithAliasConflicts() {
+	suite.unsetenv("FORCE")
+	suite.setenv("PLUGIN_FORCE_UPGRADE", "true")
+	suite.setenv("PLUGIN_FORCE", "false") // should override even when set to the zero value
+
+	cfg, err := NewConfig(&strings.Builder{}, &strings.Builder{})
+	suite.NoError(err)
+	suite.False(cfg.Force, "official names should override alias names")
+}
+
 func (suite *ConfigTestSuite) TestNewConfigSetsWriters() {
 	stdout := &strings.Builder{}
 	stderr := &strings.Builder{}