diff --git a/helm/numtracker/templates/deployment.yaml b/helm/numtracker/templates/deployment.yaml
index 33f27e2..4865cec 100644
--- a/helm/numtracker/templates/deployment.yaml
+++ b/helm/numtracker/templates/deployment.yaml
@@ -56,11 +56,11 @@ spec:
               value: {{ .Values.numtracker.graylog.level }}
             {{- end }}
             {{- if .Values.numtracker.auth.enabled }}
-            - name: NUMTRACKER_AUTH_HOST
+            - name: NUMTRACKER_AUTHZ_HOST
               value: {{ .Values.numtracker.auth.host }}
-            - name: NUMTRACKER_AUTH_ACCESS
+            - name: NUMTRACKER_AUTHZ_ACCESS
               value: {{ .Values.numtracker.auth.access }}
-            - name: NUMTRACKER_AUTH_ADMIN
+            - name: NUMTRACKER_AUTHZ_ADMIN
               value: {{ .Values.numtracker.auth.admin }}
             {{- end }}
           securityContext:
diff --git a/src/cli/client.rs b/src/cli/client.rs
index 3b6e398..be1c365 100644
--- a/src/cli/client.rs
+++ b/src/cli/client.rs
@@ -24,7 +24,7 @@ pub struct ConnectionOptions {
     /// This should be the domain that has the .well-known/openid-configuration
     /// endpoint including scheme and port (if non-standard).
     /// eg https://authn.example.com/realms/master
-    #[clap(long, env = "NUMTRACKER_AUTH_HOST")]
+    #[clap(long, env = "NUMTRACKER_AUTHN_HOST")]
     pub auth: Option<Url>,
 }
 
diff --git a/src/cli/mod.rs b/src/cli/mod.rs
index f029203..4644625 100644
--- a/src/cli/mod.rs
+++ b/src/cli/mod.rs
@@ -99,17 +99,17 @@ pub struct PolicyOptions {
     /// Authorization Policy service
     ///
     /// eg, https://authz.diamond.ac.uk
-    #[clap(long = "policy", required = false, env = "NUMTRACKER_AUTH_HOST")]
+    #[clap(long = "policy", required = false, env = "NUMTRACKER_AUTHZ_HOST")]
     pub policy_host: String,
     /// The Rego rule used to generate instrument access data
     ///
     /// eg. v1/data/diamond/policy/session/write_to_beamline_visit
-    #[clap(long, required = false, env = "NUMTRACKER_AUTH_ACCESS")]
+    #[clap(long, required = false, env = "NUMTRACKER_AUTHZ_ACCESS")]
     pub access_query: String,
     /// The Rego rule used to generate admin access data
     ///
     /// eg. v1/data/diamond/policy/admin/configure_beamline
-    #[clap(long, required = false, env = "NUMTRACKER_AUTH_ADMIN")]
+    #[clap(long, required = false, env = "NUMTRACKER_AUTHZ_ADMIN")]
     pub admin_query: String,
 }