diff --git a/doc/source/admin/components.rst b/doc/source/admin/components.rst
index 62053b390e..71bf2a26bd 100644
--- a/doc/source/admin/components.rst
+++ b/doc/source/admin/components.rst
@@ -75,6 +75,11 @@ location may be supplied on the command line) which uses an INI file
 syntax.  Each component may have its own configuration file, though
 you may find it simpler to use the same file for all components.
 
+Zuul will interpolate environment variables starting with the ``ZUUL_``
+prefix given in the config file escaped as python string expansion.
+``foo=%(ZUUL_HOME)s`` will set the value of ``foo`` to the same value
+as the environment variable named ``ZUUL_HOME``.
+
 An example ``zuul.conf``:
 
 .. code-block:: ini
diff --git a/doc/source/admin/examples/docker-compose.yaml b/doc/source/admin/examples/docker-compose.yaml
index 99df901630..785cfdfe71 100644
--- a/doc/source/admin/examples/docker-compose.yaml
+++ b/doc/source/admin/examples/docker-compose.yaml
@@ -46,6 +46,7 @@ services:
       - http_proxy
       - https_proxy
       - no_proxy=${no_proxy},gerrit
+      - ZUUL_MYSQL_PASSWORD=secret
     command: "sh -c '/var/playbooks/wait-to-start.sh && zuul-scheduler -d'"
     # FIXME: The scheduler has no ansible anymore so use the executor image.
     #        This needs to be changes such that ansible is not required for startup.
@@ -62,6 +63,8 @@ services:
     ports:
       - "9000:9000"
     image: zuul/zuul-web
+    environment:
+      ZUUL_MYSQL_PASSWORD: secret
     volumes:
       - "./etc_zuul/:/etc/zuul/:z"
       - "./playbooks/:/var/playbooks/:z"
@@ -71,6 +74,7 @@ services:
       - http_proxy
       - https_proxy
       - no_proxy=${no_proxy},gerrit,scheduler
+      - ZUUL_MYSQL_PASSWORD=secret
     command: "zuul-executor -d"
     depends_on:
       - scheduler
diff --git a/doc/source/admin/examples/etc_zuul/zuul.conf b/doc/source/admin/examples/etc_zuul/zuul.conf
index b60a1604ee..8b8c34c236 100644
--- a/doc/source/admin/examples/etc_zuul/zuul.conf
+++ b/doc/source/admin/examples/etc_zuul/zuul.conf
@@ -28,7 +28,7 @@ baseurl=https://opendev.org
 [connection "mysql"]
 name=mysql
 driver=sql
-dburi=mysql+pymysql://zuul:secret@mysql/zuul
+dburi=mysql+pymysql://zuul:%(ZUUL_MYSQL_PASSWORD)s@mysql/zuul
 
 [web]
 listen_address=0.0.0.0
diff --git a/tests/unit/test_cmd.py b/tests/unit/test_cmd.py
new file mode 100644
index 0000000000..9f8184b67f
--- /dev/null
+++ b/tests/unit/test_cmd.py
@@ -0,0 +1,42 @@
+# Copyright 2013 Hewlett-Packard Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import fixtures
+import tempfile
+import testtools
+
+import zuul.cmd
+
+
+FAKE_CONFIG = b'''
+[DEFAULT]
+foo=%(ZUUL_ENV_TEST)s
+'''
+
+
+class TestCmd(testtools.TestCase):
+    def test_read_config_with_environment(self):
+        "Test that readConfig interpolates environment vars"
+
+        self.useFixture(fixtures.EnvironmentVariable(
+            'HISTTIMEFORMAT', '%Y-%m-%dT%T%z '))
+        self.useFixture(fixtures.EnvironmentVariable(
+            'ZUUL_ENV_TEST', 'baz'))
+        with tempfile.NamedTemporaryFile() as test_config:
+            test_config.write(FAKE_CONFIG)
+            test_config.flush()
+            app = zuul.cmd.ZuulApp()
+            app.parseArguments(['-c', test_config.name])
+            app.readConfig()
+            self.assertEquals('baz', app.config.get('DEFAULT', 'foo'))
diff --git a/tests/unit/test_model.py b/tests/unit/test_model.py
index 6176a121a4..1f6a3ff37a 100644
--- a/tests/unit/test_model.py
+++ b/tests/unit/test_model.py
@@ -39,7 +39,10 @@ class Dummy(object):
 
 class TestJob(BaseTestCase):
     def setUp(self):
+        self._env_fixture = self.useFixture(
+            fixtures.EnvironmentVariable('HISTTIMEFORMAT', '%Y-%m-%dT%T%z '))
         super(TestJob, self).setUp()
+        # Toss in % in env vars to trigger the configparser issue
         self.connections = zuul.lib.connections.ConnectionRegistry()
         self.addCleanup(self.connections.stop)
         self.connection = Dummy(connection_name='dummy_connection')
diff --git a/zuul/cmd/__init__.py b/zuul/cmd/__init__.py
index 0c2204e4f7..709c984303 100755
--- a/zuul/cmd/__init__.py
+++ b/zuul/cmd/__init__.py
@@ -123,7 +123,11 @@ class ZuulApp(object):
         return parser
 
     def readConfig(self):
-        self.config = configparser.ConfigParser()
+        safe_env = {
+            k: v for k, v in os.environ.items()
+            if k.startswith('ZUUL_')
+        }
+        self.config = configparser.ConfigParser(safe_env)
         if self.args.config:
             locations = [self.args.config]
         else: