diff --git a/Keter/App.hs b/Keter/App.hs
index 4ad9eed..f2fc85a 100644
--- a/Keter/App.hs
+++ b/Keter/App.hs
@@ -44,6 +44,7 @@ import           Keter.PortPool            (PortPool, getPort, releasePort)
 import           Keter.Types
 import qualified Network
 import           Prelude                   hiding (FilePath)
+import           System.Environment        (getEnvironment)
 import           System.IO                 (hClose)
 import           System.Posix.Files        (fileAccess)
 import           System.Posix.Types        (EpochTime)
@@ -267,6 +268,7 @@ launchWebApp :: AppStartConfig
              -> IO a
 launchWebApp AppStartConfig {..} aid BundleConfig {..} mdir rlog WebAppConfig {..} f = do
     otherEnv <- pluginsGetEnv ascPlugins name bconfigPlugins
+    systemEnv <- getEnvironment
     let httpPort  = kconfigExternalHttpPort  ascKeterConfig
         httpsPort = kconfigExternalHttpsPort ascKeterConfig
         (scheme, extport) =
@@ -277,6 +279,7 @@ launchWebApp AppStartConfig {..} aid BundleConfig {..} mdir rlog WebAppConfig {.
             -- Ordering chosen specifically to precedence rules: app specific,
             -- plugins, global, and then auto-set Keter variables.
             [ waconfigEnvironment
+            , Map.filterWithKey (\k _ -> Set.member k waconfigForwardEnv) $ Map.fromList $ map (\x -> (pack (fst x), pack (snd x))) systemEnv
             , Map.fromList otherEnv
             , kconfigEnvironment ascKeterConfig
             , Map.singleton "PORT" $ pack $ show waconfigPort
diff --git a/Keter/Types/V10.hs b/Keter/Types/V10.hs
index 39c2de3..c0ed842 100644
--- a/Keter/Types/V10.hs
+++ b/Keter/Types/V10.hs
@@ -327,6 +327,7 @@ data WebAppConfig port = WebAppConfig
     , waconfigHosts       :: !(Set Host) -- ^ all hosts, not including the approot host
     , waconfigSsl         :: !Bool
     , waconfigPort        :: !port
+    , waconfigForwardEnv  :: !(Set Text)
     }
     deriving Show
 
@@ -340,6 +341,7 @@ instance ToCurrent (WebAppConfig ()) where
         , waconfigHosts = Set.map CI.mk hosts
         , waconfigSsl = ssl
         , waconfigPort = ()
+        , waconfigForwardEnv = Set.empty
         }
 
 instance ParseYamlFile (WebAppConfig ()) where
@@ -361,6 +363,7 @@ instance ParseYamlFile (WebAppConfig ()) where
             <*> return hosts
             <*> o .:? "ssl" .!= False
             <*> return ()
+            <*> o .:? "forward-env" .!= Set.empty
 
 instance ToJSON (WebAppConfig ()) where
     toJSON WebAppConfig {..} = object
@@ -369,6 +372,7 @@ instance ToJSON (WebAppConfig ()) where
         , "env" .= waconfigEnvironment
         , "hosts" .= map CI.original (waconfigApprootHost : Set.toList waconfigHosts)
         , "ssl" .= waconfigSsl
+        , "forward-env" .= waconfigForwardEnv
         ]
 
 data AppInput = AIBundle !FilePath !EpochTime
diff --git a/incoming/foo1_0/config/keter.yaml b/incoming/foo1_0/config/keter.yaml
index 6b7d580..2e62652 100644
--- a/incoming/foo1_0/config/keter.yaml
+++ b/incoming/foo1_0/config/keter.yaml
@@ -5,6 +5,9 @@ stanzas:
         - Hello World 2
       env:
         FROM_KETER_CONFIG: foo bar baz
+      forward-env:
+        - FROM_SYSTEM_ENV
+        - ANOTHER_ENV_VAR
       hosts:
         - keter1_0
         - pong1_0