diff --git a/core/installer/app.go b/core/installer/app.go
index c9c7ced..656b992 100644
--- a/core/installer/app.go
+++ b/core/installer/app.go
@@ -40,6 +40,7 @@
 	UDP        *AccessUDP
 	PostgreSQL *AccessPostgreSQL
 	MongoDB    *AccessMongoDB
+	EnvVar     *AccessEnvVar
 }
 
 func (a Access) MarshalJSON() ([]byte, error) {
@@ -93,6 +94,14 @@
 		}{*a.MongoDB, a.Type, a.Name}); err != nil {
 			return nil, err
 		}
+	case "env_var":
+		if err := json.NewEncoder(&buf).Encode(struct {
+			AccessEnvVar
+			Type string `json:"type"`
+			Name string `json:"name"`
+		}{*a.EnvVar, a.Type, a.Name}); err != nil {
+			return nil, err
+		}
 	default:
 		panic("MUST NOT REACH!")
 	}
@@ -135,6 +144,10 @@
 	Password string `json:"password"`
 }
 
+type AccessEnvVar struct {
+	Var string `json:"var"`
+}
+
 type EnvVar struct {
 	Name  string `json:"name"`
 	Value string `json:"value"`
@@ -408,6 +421,9 @@
 	if err != nil {
 		return cueApp{}, fmt.Errorf(errors.Details(err, nil))
 	}
+	if err := config.Err(); err != nil {
+		return cueApp{}, fmt.Errorf(errors.Details(err, nil))
+	}
 	return newCueApp(config, data)
 }
 
@@ -657,6 +673,14 @@
 				}
 				ret = append(ret, Access{Type: "mongodb", Name: nn, MongoDB: &q})
 			}
+		case "env_var":
+			{
+				var q AccessEnvVar
+				if err := i.Value().Decode(&q); err != nil {
+					return nil, err
+				}
+				ret = append(ret, Access{Type: "env_var", Name: nn, EnvVar: &q})
+			}
 		}
 	}
 	for _, sub := range []string{"ingress", "postgresql", "mongodb", "services", "vm"} {
@@ -707,9 +731,9 @@
 func NewDodoApp(appCfg []byte) (EnvApp, error) {
 	return NewCueEnvApp(CueAppData{
 		"app.cue":  appCfg,
-		"base.cue": []byte(cueBaseConfig),
+		"base.cue": cueBaseConfig,
 		"dodo.cue": dodoAppCue,
-		"env.cue":  []byte(cueEnvAppGlobal),
+		"env.cue":  cueEnvAppGlobal,
 	})
 }