diff --git a/benchmark/common.js b/benchmark/common.js
index 8443da40d79e..fa108b706831 100644
--- a/benchmark/common.js
+++ b/benchmark/common.js
@@ -198,6 +198,21 @@ class Benchmark {
   }
 
   _run() {
+    // A forked child is told to run the benchmark function directly, rather
+    // than build its own queue and fork again, through the
+    // NODE_RUN_BENCHMARK_FN environment variable. A child always inherits
+    // this.flags in its execArgv, so reaching _run() with those flags already
+    // applied means the variable did not survive to the child and every
+    // generation would keep forking. Fail loudly instead of forking forever.
+    if (process.send &&
+        this.flags.length > 0 &&
+        this.flags.every((flag) => process.execArgv.includes(flag))) {
+      throw new Error(
+        'Benchmark child process was started with the benchmark flags but ' +
+        'without NODE_RUN_BENCHMARK_FN, refusing to fork again. Something ' +
+        'removed the variable from the child environment.');
+    }
+
     // If forked, report to the parent.
     if (process.send) {
       process.send({
@@ -213,6 +228,20 @@ class Benchmark {
       this.originalOptions.setup(this.queue);
     }
 
+    // Enforcing the permission model removes the environment variables
+    // --allow-env does not grant access to at startup, which would drop the
+    // NODE_RUN_BENCHMARK_FN set below. The child only ever sees the
+    // environment this process hands it, so granting access to all of it does
+    // not widen what the benchmark can reach. Audit mode removes nothing, so
+    // it is left alone to keep its diagnostics intact.
+    const childExecArgv = this.flags.concat(process.execArgv);
+    const enforcesPermission = (arg) =>
+      arg === '--permission' || arg.startsWith('--permission=');
+    if (childExecArgv.some(enforcesPermission) &&
+        !childExecArgv.some((arg) => arg.startsWith('--allow-env'))) {
+      childExecArgv.push('--allow-env=*');
+    }
+
     const recursive = (queueIndex) => {
       const config = this.queue[queueIndex];
 
@@ -233,7 +262,7 @@ class Benchmark {
 
       const child = child_process.fork(require.main.filename, childArgs, {
         env: childEnv,
-        execArgv: this.flags.concat(process.execArgv),
+        execArgv: childExecArgv,
       });
       child.on('message', sendResult);
       child.on('close', (code) => {
diff --git a/doc/api/cli.md b/doc/api/cli.md
index 1fd1e9864338..3d0e86aaa5a4 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -191,6 +191,50 @@ This behavior also applies to `child_process.spawn()`, but in that case, the
 flags are propagated via the `NODE_OPTIONS` environment variable rather than
 directly through the process arguments.
 
+### `--allow-env`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.1 - Active development
+
+When using the [Permission Model][], the process starts without the environment
+variables it has not been granted access to. At startup, every variable that
+`--allow-env` does not match is removed from the process environment. Removed
+variables are absent from `process.env`, from diagnostic reports, from native
+code calling `getenv()`, and from the environment of child processes and worker
+threads.
+
+The valid values are:
+
+* `*` - Grants access to every environment variable.
+* A variable name, for example `--allow-env=DATABASE_URL`.
+* A variable name prefix followed by `*`, for example `--allow-env=APP_*`.
+
+Multiple values can be passed by repeating the flag, or by separating them with
+commas: `--allow-env=PORT,APP_*`. Variable names are case-insensitive on
+Windows.
+
+Example:
+
+```js
+console.log(process.env.DATABASE_URL);
+console.log(process.env.AWS_SECRET_ACCESS_KEY);
+```
+
+```console
+$ node --permission --allow-fs-read=* --allow-env=DATABASE_URL index.js
+postgres://localhost/app
+undefined
+(node:1234) Warning: The permission model removed the environment variable "AWS_SECRET_ACCESS_KEY" at startup. Use --allow-env to manage permissions.
+```
+
+The variables that Node.js and its bundled dependencies read, such as
+`NODE_OPTIONS`, `PATH`, `HOME`, `TZ`, and `SSL_CERT_FILE`, are always kept, as
+are the variables defined in [`--env-file`][] files. See
+[Environment variable permissions][] for details.
+
 ### `--allow-ffi`
 
 <!-- YAML
@@ -2538,6 +2582,7 @@ following permissions are restricted:
 * File System - manageable through
   [`--allow-fs-read`][], [`--allow-fs-write`][] flags
 * Network - manageable through [`--allow-net`][] flag
+* Environment variables - manageable through [`--allow-env`][] flag
 * Child Process - manageable through [`--allow-child-process`][] flag
 * Worker Threads - manageable through [`--allow-worker`][] flag
 * WASI - manageable through [`--allow-wasi`][] flag
@@ -4128,6 +4173,7 @@ one is included in the list below.
 
 * `--allow-addons`
 * `--allow-child-process`
+* `--allow-env`
 * `--allow-ffi`
 * `--allow-fs-read`
 * `--allow-fs-vfs`
@@ -4776,6 +4822,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [CommonJS module]: modules.md
 [DEP0025 warning]: deprecations.md#dep0025-requirenodesys
 [ECMAScript module]: esm.md#modules-ecmascript-modules
+[Environment variable permissions]: permissions.md#environment-variable-permissions
 [EventSource Web API]: https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events
 [ExperimentalWarning: `vm.measureMemory` is an experimental feature]: vm.md#vmmeasurememoryoptions
 [FIPS mode]: crypto.md#fips-mode
@@ -4799,6 +4846,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [`'crypto.fips.indicator'`]: diagnostics_channel.md#event-cryptofipsindicator
 [`--allow-addons`]: #--allow-addons
 [`--allow-child-process`]: #--allow-child-process
+[`--allow-env`]: #--allow-env
 [`--allow-fs-read`]: #--allow-fs-read
 [`--allow-fs-write`]: #--allow-fs-write
 [`--allow-net`]: #--allow-net
diff --git a/doc/api/embedding.md b/doc/api/embedding.md
index dfb84b49ef9b..3bbff4dfb3e6 100644
--- a/doc/api/embedding.md
+++ b/doc/api/embedding.md
@@ -72,6 +72,51 @@ int main(int argc, char** argv) {
 }
 ```
 
+### Restricting access to environment variables
+
+<!-- YAML
+added: REPLACEME
+-->
+
+When the arguments passed to `node::InitializeOncePerProcess()` enable the
+[Permission Model][] without `--allow-env=*`, the process environment must not
+contain any variable that [`--allow-env`][] does not grant access to.
+`node::InitializeOncePerProcess()` fails otherwise. Unlike the `node`
+executable, embedders own the process environment, so Node.js does not remove
+these variables itself.
+
+`node::ScrubProcessEnvironment()` removes them. Because it modifies the process
+environment without any locking that native code calling `getenv()`
+participates in, it must be called before starting any thread that may read the
+environment, and before `node::InitializeOncePerProcess()`:
+
+```cpp
+int main(int argc, char** argv) {
+  argv = uv_setup_args(argc, argv);
+  std::vector<std::string> args(argv, argv + argc);
+
+  // Keep the variables the embedder itself reads, in addition to the ones
+  // Node.js reads (see node::GetRuntimeEnvironmentDefaults()).
+  node::ProcessEnvironmentScrubOptions scrub_options;
+  scrub_options.allow = {"PORT", "APP_*"};
+  if (node::ScrubProcessEnvironment(scrub_options).IsNothing()) {
+    return 1;
+  }
+
+  // args contains, for example, --permission --allow-env=PORT
+  std::unique_ptr<node::InitializationResult> result =
+      node::InitializeOncePerProcess(args, {
+        node::ProcessInitializationFlags::kNoInitializeV8,
+        node::ProcessInitializationFlags::kNoInitializeNodeV8Platform
+      });
+  // ...
+}
+```
+
+`process.permission.drop('env', name)` removes a variable from the process
+environment, so it throws when called from a `node::Environment` created
+without `node::EnvironmentFlags::kOwnsProcessState`.
+
 ### Setting up a per-instance state
 
 <!-- YAML
@@ -178,6 +223,8 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
 ```
 
 [CLI options]: cli.md
+[Permission Model]: permissions.md#permission-model
+[`--allow-env`]: cli.md#--allow-env
 [`process.memoryUsage()`]: process.md#processmemoryusage
 [deprecation policy]: deprecations.md
 [embedtest.cc]: https://github.com/nodejs/node/blob/HEAD/test/embedding/embedtest.cc
diff --git a/doc/api/permissions.md b/doc/api/permissions.md
index dc5e3e6111ca..b023b42a85f8 100644
--- a/doc/api/permissions.md
+++ b/doc/api/permissions.md
@@ -61,9 +61,9 @@ The Permission Model has two operational modes:
 
 When starting Node.js with `--permission`,
 the ability to access the file system through the `fs` module, access the network,
-spawn processes, use `node:worker_threads`, use native addons, use WASI, use
-FFI, and enable the runtime inspector will be restricted (the listener for
-SIGUSR1 won't be created).
+access environment variables, spawn processes, use `node:worker_threads`, use
+native addons, use WASI, use FFI, and enable the runtime inspector will be
+restricted (the listener for SIGUSR1 won't be created).
 
 ```console
 $ node --permission index.js
@@ -79,6 +79,8 @@ Error: Access to this API has been restricted
 Allowing access to spawning a process and creating worker threads can be done
 using the [`--allow-child-process`][] and [`--allow-worker`][] respectively.
 
+To grant access to environment variables, use [`--allow-env`][].
+
 To allow network access, use [`--allow-net`][] and for allowing native addons
 when using permission model, use the [`--allow-addons`][]
 flag. For WASI, use the [`--allow-wasi`][] flag. For FFI, use the
@@ -157,9 +159,9 @@ mode. Execution continues normally.
 Audit mode is useful for discovering what permissions your application
 requires before deploying with [`--permission`][]. It can also be combined
 with the [`--allow-fs-read`][], [`--allow-fs-write`][], [`--allow-net`][],
-[`--allow-child-process`][], [`--allow-worker`][], [`--allow-addons`][],
-[`--allow-wasi`][], and [`--allow-ffi`][] flags to audit a subset of
-permissions while granting others.
+[`--allow-env`][], [`--allow-child-process`][], [`--allow-worker`][],
+[`--allow-addons`][], [`--allow-wasi`][], and [`--allow-ffi`][] flags to audit
+a subset of permissions while granting others.
 
 When a permission check fails in audit mode, a message is published to the
 diagnostics channel corresponding to the denied scope. The channel names are:
@@ -172,6 +174,7 @@ diagnostics channel corresponding to the denied scope. The channel names are:
 * `node:permission-model:wasi` — WASI
 * `node:permission-model:addon` — Native Addons
 * `node:permission-model:ffi` — FFI
+* `node:permission-model:env` — Environment variables
 
 Each message is an object with the following properties:
 
@@ -266,6 +269,78 @@ both to the top-level `node:fs` functions and to the equivalent
 `FileHandle` methods, and currently includes `fsync`/`fdatasync`,
 `fchmod`, and `fchown` (and their synchronous variants).
 
+#### Environment variable permissions
+
+When the Permission Model is enforced, the process only has access to the
+environment variables that [`--allow-env`][] grants access to.
+
+Instead of checking each access, Node.js removes every other variable from the
+process environment at startup, before any JavaScript code runs and before
+Node.js starts any other thread. Removed variables are absent from everything
+that exposes the environment of the process: `process.env`, diagnostic reports,
+native code calling `getenv()`, worker threads, and the environment inherited by
+child processes.
+
+```console
+$ node --permission --allow-env=PORT --allow-env=APP_* index.js
+```
+
+The valid arguments for the flag are:
+
+* `*` - Grants access to every environment variable. Nothing is removed.
+* A variable name, such as `PORT`.
+* A variable name prefix followed by `*`, such as `APP_*`.
+
+Some variables are always kept:
+
+* The variables that Node.js and its bundled dependencies read after startup,
+  such as `NODE_OPTIONS`, `NODE_EXTRA_CA_CERTS`, `PATH`, `HOME`, `TMPDIR`, `TZ`,
+  `LANG`, `SSL_CERT_FILE`, and the variables that terminal color detection
+  reads. Other variables whose names start with `NODE_`, such as
+  `NODE_AUTH_TOKEN`, are not kept.
+* The variables defined in the files passed to [`--env-file`][] and
+  [`--env-file-if-exists`][]. If a variable is defined in such a file and also
+  inherited from the parent process, and `--allow-env` does not grant access to
+  it, the inherited value is removed and the value from the file is used.
+
+Proxy URLs often contain credentials, so the `HTTP_PROXY`, `HTTPS_PROXY`, and
+`NO_PROXY` variables are not kept. Grant access to them explicitly when using
+[`--use-env-proxy`][].
+
+Reading a variable that was removed at startup returns `undefined`, emits a
+warning the first time, and publishes a message to the
+`node:permission-model:env` diagnostics channel.
+
+Variables set at runtime, for example with `process.env.KEY = 'value'` or
+[`process.loadEnvFile()`][], are not restricted, as they cannot reveal what was
+removed.
+
+Dropping a variable with [`permission.drop()`][] removes it from the
+environment. Dropping the whole `env` scope removes every variable except the
+ones Node.js reads itself. This makes it possible to read a secret during
+initialization, and then remove it:
+
+```js
+const databaseUrl = process.env.DATABASE_URL;
+process.permission.drop('env', 'DATABASE_URL');
+```
+
+When a process that enforces the Permission Model spawns a child process, the
+child is started with `--allow-env=*`: the environment it inherits only contains
+variables that the parent had access to.
+
+In audit mode, nothing is removed. Accesses to variables that `--allow-env`
+does not grant access to are published to the `node:permission-model:env`
+diagnostics channel instead.
+
+On Linux, `/proc/<pid>/environ` exposes the environment a process was started
+with. While access to environment variables is restricted, reading any
+`/proc/<pid>/environ` file is denied, regardless of [`--allow-fs-read`][], and
+the removed variables are overwritten in the initial environment block of the
+process. This does not affect the environment of other processes, such as the
+parent process. A process granted [`--allow-child-process`][] can read their
+environment through other programs.
+
 #### Configuration file support
 
 In addition to passing permission flags on the command line, they can also be
@@ -297,6 +372,20 @@ automatically enables the `--permission` flag. Run with:
 $ node --experimental-default-config-file app.js
 ```
 
+A configuration file, like the `NODE_OPTIONS` defined in an [`--env-file`][]
+file, may be controlled by the project being run rather than by whoever starts
+Node.js. When the command line or the `NODE_OPTIONS` environment variable
+enable the Permission Model, the `allow-env` values these files define can only
+narrow the access that [`--allow-env`][] grants, and never widen it:
+
+```console
+$ node --permission --allow-env=APP_* --experimental-config-file=node.config.json app.js
+```
+
+With `"allow-env": ["*"]` in `node.config.json`, only the variables starting with
+`APP_` are kept. With `"allow-env": ["APP_DATABASE_URL", "OTHER"]`, only
+`APP_DATABASE_URL` is.
+
 #### Using the Permission Model with `npx`
 
 If you're using [`npx`][] to execute a Node.js script, you can enable the
@@ -342,6 +431,7 @@ There are constraints you need to know before using this system:
 * When using the Permission Model the following features will be restricted:
   * Native modules
   * Network
+  * Environment variables
   * Child process
   * Worker Threads
   * Inspector protocol
@@ -404,6 +494,7 @@ Developers relying on --permission to sandbox untrusted code should be aware tha
 [Security Policy]: https://github.com/nodejs/node/blob/main/SECURITY.md
 [`--allow-addons`]: cli.md#--allow-addons
 [`--allow-child-process`]: cli.md#--allow-child-process
+[`--allow-env`]: cli.md#--allow-env
 [`--allow-ffi`]: cli.md#--allow-ffi
 [`--allow-fs-read`]: cli.md#--allow-fs-read
 [`--allow-fs-write`]: cli.md#--allow-fs-write
@@ -411,8 +502,13 @@ Developers relying on --permission to sandbox untrusted code should be aware tha
 [`--allow-openssl-store`]: cli.md#--allow-openssl-store
 [`--allow-wasi`]: cli.md#--allow-wasi
 [`--allow-worker`]: cli.md#--allow-worker
+[`--env-file-if-exists`]: cli.md#--env-file-if-existsfile
+[`--env-file`]: cli.md#--env-filefile
 [`--permission-audit`]: cli.md#--permission-audit
 [`--permission`]: cli.md#--permission
+[`--use-env-proxy`]: cli.md#--use-env-proxy
 [`crypto.createPrivateKey()`]: crypto.md#cryptocreateprivatekeykey
 [`npx`]: https://docs.npmjs.com/cli/commands/npx
+[`permission.drop()`]: process.md#processpermissiondropscope-reference
 [`permission.has()`]: process.md#processpermissionhasscope-reference
+[`process.loadEnvFile()`]: process.md#processloadenvfilepath
diff --git a/doc/api/process.md b/doc/api/process.md
index c237943b69f0..5df839f77611 100644
--- a/doc/api/process.md
+++ b/doc/api/process.md
@@ -3163,6 +3163,7 @@ The available scopes are:
 * `fs.read` - File System read operations
 * `fs.write` - File System write operations
 * `child` - Child process spawning operations
+* `env` - Environment variables
 * `openssl.store` - Loading keys through OpenSSL STORE loaders
 * `worker` - Worker thread spawning operation
 * `ffi` - Foreign function interface operations
@@ -3220,6 +3221,8 @@ The available scopes are the same as [`process.permission.has()`][]:
 * `fs.read` - File System read operations
 * `fs.write` - File System write operations
 * `child` - Child process spawning operations
+* `env` - Environment variables. Dropping a variable removes it from the
+  environment
 * `openssl.store` - Loading keys through OpenSSL STORE loaders
 * `worker` - Worker thread spawning operation
 * `net` - Network operations
diff --git a/doc/node.1 b/doc/node.1
index 1b873d1eccaa..c67904fbc8d6 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -118,6 +118,41 @@ This behavior also applies to \fBchild_process.spawn()\fR, but in that case, the
 flags are propagated via the \fBNODE_OPTIONS\fR environment variable rather than
 directly through the process arguments.
 .
+.It Fl -allow-env
+When using the Permission Model, the process starts without the environment
+variables it has not been granted access to. At startup, every variable that
+\fB--allow-env\fR does not match is removed from the process environment. Removed
+variables are absent from \fBprocess.env\fR, from diagnostic reports, from native
+code calling \fBgetenv()\fR, and from the environment of child processes and worker
+threads.
+The valid values are:
+.Bl -bullet
+.It
+\fB*\fR - Grants access to every environment variable.
+.It
+A variable name, for example \fB--allow-env=DATABASE_URL\fR.
+.It
+A variable name prefix followed by \fB*\fR, for example \fB--allow-env=APP_*\fR.
+.El
+Multiple values can be passed by repeating the flag, or by separating them with
+commas: \fB--allow-env=PORT,APP_*\fR. Variable names are case-insensitive on
+Windows.
+Example:
+.Bd -literal
+console.log(process.env.DATABASE_URL);
+console.log(process.env.AWS_SECRET_ACCESS_KEY);
+.Ed
+.Bd -literal
+$ node --permission --allow-fs-read=* --allow-env=DATABASE_URL index.js
+postgres://localhost/app
+undefined
+(node:1234) Warning: The permission model removed the environment variable "AWS_SECRET_ACCESS_KEY" at startup. Use --allow-env to manage permissions.
+.Ed
+The variables that Node.js and its bundled dependencies read, such as
+\fBNODE_OPTIONS\fR, \fBPATH\fR, \fBHOME\fR, \fBTZ\fR, and \fBSSL_CERT_FILE\fR, are always kept, as
+are the variables defined in \fB--env-file\fR files. See
+Environment variable permissions for details.
+.
 .It Fl -allow-ffi
 When using the Permission Model, the process will not be able to use FFI
 APIs by default. Attempts to use FFI APIs will throw an \fBERR_ACCESS_DENIED\fR
@@ -1274,6 +1309,8 @@ File System - manageable through
 .It
 Network - manageable through \fB--allow-net\fR flag
 .It
+Environment variables - manageable through \fB--allow-env\fR flag
+.It
 Child Process - manageable through \fB--allow-child-process\fR flag
 .It
 Worker Threads - manageable through \fB--allow-worker\fR flag
@@ -2088,6 +2125,8 @@ one is included in the list below.
 .It
 \fB--allow-child-process\fR
 .It
+\fB--allow-env\fR
+.It
 \fB--allow-ffi\fR
 .It
 \fB--allow-fs-read\fR
diff --git a/lib/child_process.js b/lib/child_process.js
index 1fdc520d31e8..e2eb30d15b64 100644
--- a/lib/child_process.js
+++ b/lib/child_process.js
@@ -570,14 +570,26 @@ function copyPermissionModelFlagsToEnv(env, key, args) {
     return;
   }
 
+  // Enforcing the permission model removed the variables --allow-env does not
+  // grant access to at startup, so everything left in the environment a child
+  // inherits is accessible. A child can never see more than its parent had.
+  const allowAllEnv = !permission.isAuditMode();
+
   const flagsToCopy = getPermissionModelFlagsToCopy();
   for (const arg of process.execArgv) {
+    if (allowAllEnv && arg.startsWith('--allow-env')) {
+      continue;
+    }
     for (const flag of flagsToCopy) {
       if (arg.startsWith(flag)) {
         env[key] = `${env[key] ? env[key] + ' ' + arg : arg}`;
       }
     }
   }
+
+  if (allowAllEnv) {
+    env[key] = `${env[key] ? env[key] + ' ' : ''}--allow-env=*`;
+  }
 }
 
 let emittedDEP0190Already = false;
diff --git a/lib/internal/process/permission.js b/lib/internal/process/permission.js
index acfbab036bbb..d2921694b99a 100644
--- a/lib/internal/process/permission.js
+++ b/lib/internal/process/permission.js
@@ -76,6 +76,7 @@ module.exports = ObjectFreeze({
       '--allow-fs-write',
       '--allow-addons',
       '--allow-child-process',
+      '--allow-env',
       '--allow-net',
       '--allow-inspector',
       '--allow-wasi',
diff --git a/node.gyp b/node.gyp
index 8692f42c8976..c89869628165 100644
--- a/node.gyp
+++ b/node.gyp
@@ -186,6 +186,7 @@
       'src/node_worker.cc',
       'src/node_zlib.cc',
       'src/path.cc',
+      'src/permission/env_permission.cc',
       'src/permission/fs_permission.cc',
       'src/permission/permission.cc',
       'src/pipe_wrap.cc',
@@ -321,6 +322,7 @@
       'src/node_worker.h',
       'src/path.h',
       'src/permission/boolean_permission.h',
+      'src/permission/env_permission.h',
       'src/permission/fs_permission.h',
       'src/permission/permission.h',
       'src/permission/permission_base.h',
diff --git a/src/env.cc b/src/env.cc
index d35c28fcf7ed..0a9733295cea 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -8,6 +8,7 @@
 #include "node_buffer.h"
 #include "node_context_data.h"
 #include "node_contextify.h"
+#include "node_dotenv.h"
 #include "node_errors.h"
 #include "node_file_utils.h"
 #include "node_internals.h"
@@ -1120,6 +1121,20 @@ Environment::Environment(IsolateData* isolate_data,
       permission()->Apply(this, args, permission::PermissionScope::kWASI);
     }
 
+    {
+      std::vector<std::string> allow_env =
+          permission::ParseEnvAllowList(options_->allow_env);
+      // Variables defined in env files are allowed. The environment scrub
+      // removed any inherited values they had, so only the files' values
+      // are visible.
+      if (options_->has_env_file_string) {
+        for (std::string& key : per_process::dotenv_file.GetKeys()) {
+          allow_env.push_back(std::move(key));
+        }
+      }
+      permission()->Apply(this, allow_env, permission::PermissionScope::kEnv);
+    }
+
     // Implicit allow entrypoint to kFileSystemRead
     if (!options_->has_eval_string && !options_->force_repl) {
       std::string first_argv;
diff --git a/src/node.cc b/src/node.cc
index b8b43c59c91f..98d30cd353a8 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -46,6 +46,7 @@
 #include "node_snapshot_builder.h"
 #include "node_v8_platform-inl.h"
 #include "node_version.h"
+#include "permission/env_permission.h"
 
 #if HAVE_OPENSSL
 #include "ncrypto.h"
@@ -855,6 +856,62 @@ int ProcessGlobalArgs(std::vector<std::string>* args,
 
 static std::atomic_bool init_called{false};
 
+// Collects --allow-env per option source. Files (the configuration file, and
+// NODE_OPTIONS defined in env files) may be controlled by the project being
+// run rather than by whoever started Node.js, so when the command line or the
+// NODE_OPTIONS environment variable enable the permission model, --allow-env
+// values from files can only narrow the access those sources grant.
+class AllowEnvSources {
+ public:
+  explicit AllowEnvSources(EnvironmentOptions* options) : options_(options) {}
+
+  // Must be called before the options of a source are parsed.
+  void BeginSource() {
+    saved_permission_ = options_->permission;
+    saved_permission_audit_ = options_->permission_audit;
+    options_->permission = false;
+    options_->permission_audit = false;
+  }
+
+  // Must be called after the options of a source are parsed.
+  void EndSource(bool trusted) {
+    if (trusted && (options_->permission || options_->permission_audit)) {
+      trusted_enables_permission_ = true;
+    }
+    options_->permission = options_->permission || saved_permission_;
+    options_->permission_audit =
+        options_->permission_audit || saved_permission_audit_;
+
+    std::vector<std::string>& values = trusted ? trusted_ : from_files_;
+    values.insert(
+        values.end(), options_->allow_env.begin(), options_->allow_env.end());
+    options_->allow_env.clear();
+  }
+
+  // Must be called once every source has been parsed.
+  void Finish() {
+    std::vector<std::string> trusted = permission::ParseEnvAllowList(trusted_);
+    std::vector<std::string> from_files =
+        permission::ParseEnvAllowList(from_files_);
+    if (trusted_enables_permission_ && !from_files.empty()) {
+      options_->allow_env =
+          permission::IntersectEnvAllowLists(trusted, from_files);
+      return;
+    }
+    options_->allow_env = std::move(trusted);
+    options_->allow_env.insert(
+        options_->allow_env.end(), from_files.begin(), from_files.end());
+  }
+
+ private:
+  EnvironmentOptions* options_;
+  std::vector<std::string> trusted_;
+  std::vector<std::string> from_files_;
+  bool trusted_enables_permission_ = false;
+  bool saved_permission_ = false;
+  bool saved_permission_audit_ = false;
+};
+
 // TODO(addaleax): Turn this into a wrapper around InitializeOncePerProcess()
 // (with the corresponding additional flags set), then eventually remove this.
 static ExitCode InitializeNodeWithArgsInternal(
@@ -974,6 +1031,9 @@ static ExitCode InitializeNodeWithArgsInternal(
 
   node_options = node_options_from_config + node_options_from_dotenv;
 
+  AllowEnvSources allow_env_sources(
+      per_process::cli_options->per_isolate->per_env.get());
+
 #if !defined(NODE_WITHOUT_NODE_OPTIONS)
   bool should_parse_node_options =
       !(flags & ProcessInitializationFlags::kDisableNodeOptionsEnv);
@@ -987,8 +1047,9 @@ static ExitCode InitializeNodeWithArgsInternal(
 #endif
   if (should_parse_node_options) {
     // NODE_OPTIONS environment variable is preferred over the file one.
-    if (credentials::SafeGetenv("NODE_OPTIONS", &node_options) ||
-        !node_options.empty()) {
+    const bool node_options_from_env =
+        credentials::SafeGetenv("NODE_OPTIONS", &node_options);
+    if (node_options_from_env || !node_options.empty()) {
       std::vector<std::string> env_argv =
           ParseNodeOptionsEnvVar(node_options, errors);
 
@@ -997,9 +1058,11 @@ static ExitCode InitializeNodeWithArgsInternal(
       // [0] is expected to be the program name, fill it in from the real argv.
       env_argv.insert(env_argv.begin(), argv->at(0));
 
+      allow_env_sources.BeginSource();
       const ExitCode exit_code = ProcessGlobalArgsInternal(
           &env_argv, nullptr, errors, kAllowedInEnvvar);
       if (exit_code != ExitCode::kNoFailure) return exit_code;
+      allow_env_sources.EndSource(/* trusted */ node_options_from_env);
     }
   } else {
     std::string node_repl_external_env = {};
@@ -1022,15 +1085,21 @@ static ExitCode InitializeNodeWithArgsInternal(
     // [0] is expected to be the program name, fill it in from the real argv.
     extra_argv.insert(extra_argv.begin(), argv->at(0));
     // Parse the extra argv coming from the config file
+    allow_env_sources.BeginSource();
     ExitCode exit_code = ProcessGlobalArgsInternal(
         &extra_argv, nullptr, errors, kDisallowedInEnvvar);
     if (exit_code != ExitCode::kNoFailure) return exit_code;
+    allow_env_sources.EndSource(/* trusted */ false);
     // Parse options coming from the command line.
+    allow_env_sources.BeginSource();
     exit_code =
         ProcessGlobalArgsInternal(argv, exec_argv, errors, kDisallowedInEnvvar);
     if (exit_code != ExitCode::kNoFailure) return exit_code;
+    allow_env_sources.EndSource(/* trusted */ true);
   }
 
+  allow_env_sources.Finish();
+
   // Every option source has now been parsed, so cross-source option
   // constraints can finally be validated.
   CheckGlobalBenchOptions(errors);
@@ -1166,10 +1235,17 @@ bool CanEnableWebAssemblyTrapHandler() {
 }
 #endif  // NODE_USE_V8_WASM_TRAP_HANDLER
 
+// Whether InitializeOncePerProcessInternal() scrubs the process environment
+// when the permission model restricts access to it. Only node::Start() does
+// this. Embedders own their process environment, and scrub it themselves.
+enum class EnvironmentScrubMode { kNever, kIfRestricted };
+
 static std::shared_ptr<InitializationResultImpl>
-InitializeOncePerProcessInternal(const std::vector<std::string>& args,
-                                 ProcessInitializationFlags::Flags flags =
-                                     ProcessInitializationFlags::kNoFlags) {
+InitializeOncePerProcessInternal(
+    const std::vector<std::string>& args,
+    ProcessInitializationFlags::Flags flags =
+        ProcessInitializationFlags::kNoFlags,
+    EnvironmentScrubMode scrub_mode = EnvironmentScrubMode::kNever) {
   auto result = std::make_shared<InitializationResultImpl>();
   result->args_ = args;
 
@@ -1358,6 +1434,54 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
 #endif  // HAVE_OPENSSL
   }
 
+  {
+    const auto& env_options = per_process::cli_options->per_isolate->per_env;
+    const std::vector<std::string> allow =
+        permission::ParseEnvAllowList(env_options->allow_env);
+    const bool allow_all =
+        std::find(allow.begin(), allow.end(), "*") != allow.end();
+    if (env_options->permission_audit && !allow_all) {
+      // In audit mode nothing is removed, but accesses to the variables that
+      // enforcing the permission model would remove are published.
+      permission::RecordAuditedEnvironmentVariables(allow);
+    } else if (env_options->permission && !allow_all) {
+      if (scrub_mode == EnvironmentScrubMode::kIfRestricted) {
+        // When the permission model is enforced, remove every environment
+        // variable that --allow-env does not grant access to. Every
+        // per-process consumer of the environment has read it by now, and the
+        // process is still single-threaded: the platform worker threads start
+        // below.
+        permission::ScrubProcessEnvironment({.allow = allow});
+      } else {
+        // Embedders own the process environment, and must remove these
+        // variables themselves, with ScrubProcessEnvironment().
+        const std::vector<std::string> denied =
+            permission::FindDeniedEnvironmentVariables(allow);
+        if (!denied.empty()) {
+          constexpr size_t kMaxListedNames = 5;
+          std::string names;
+          for (size_t i = 0; i < denied.size() && i < kMaxListedNames; i++) {
+            if (i > 0) names += ", ";
+            names += denied[i];
+          }
+          if (denied.size() > kMaxListedNames) {
+            names += ", and " +
+                     std::to_string(denied.size() - kMaxListedNames) + " more";
+          }
+          result->errors_.push_back(
+              "The process environment contains variables that --allow-env "
+              "does not grant access to (" +
+              names +
+              "). Remove them with node::ScrubProcessEnvironment() before "
+              "calling node::InitializeOncePerProcess().");
+          result->exit_code_ = ExitCode::kInvalidCommandLineArgument;
+          result->early_return_ = true;
+          return result;
+        }
+      }
+    }
+  }
+
   if (!(flags & ProcessInitializationFlags::kNoInitializeNodeV8Platform)) {
     uv_thread_setname("node-MainThread");
     per_process::v8_platform.Initialize(
@@ -1431,6 +1555,29 @@ std::shared_ptr<InitializationResult> InitializeOncePerProcess(
   return InitializeOncePerProcessInternal(args, flags);
 }
 
+v8::Maybe<std::vector<std::string>> ScrubProcessEnvironment(
+    const ProcessEnvironmentScrubOptions& options) {
+  if (per_process::v8_initialized) {
+    return v8::Nothing<std::vector<std::string>>();
+  }
+  for (const std::string& pattern : options.allow) {
+    if (!permission::IsValidEnvAllowPattern(pattern)) {
+      return v8::Nothing<std::vector<std::string>>();
+    }
+  }
+  return v8::Just(permission::ScrubProcessEnvironment({
+      .allow = options.allow,
+      .keep_runtime_defaults = options.keep_runtime_defaults,
+      .wipe_initial_block = options.wipe_initial_block,
+  }));
+}
+
+std::vector<std::string> GetRuntimeEnvironmentDefaults() {
+  const std::span<const std::string_view> defaults =
+      permission::GetRuntimeEnvironmentDefaults();
+  return std::vector<std::string>(defaults.begin(), defaults.end());
+}
+
 void TearDownOncePerProcess() {
   const uint32_t flags = init_process_flags.load();
   ResetStdio();
@@ -1662,7 +1809,9 @@ static ExitCode StartInternal(int argc, char** argv) {
 
   std::shared_ptr<InitializationResultImpl> result =
       InitializeOncePerProcessInternal(
-          std::vector<std::string>(argv, argv + argc));
+          std::vector<std::string>(argv, argv + argc),
+          ProcessInitializationFlags::kNoFlags,
+          EnvironmentScrubMode::kIfRestricted);
   for (const std::string& error : result->errors()) {
     FPrintF(stderr, "%s: %s\n", result->args().at(0), error);
   }
diff --git a/src/node.h b/src/node.h
index ab5a542270ca..8244422c8318 100644
--- a/src/node.h
+++ b/src/node.h
@@ -324,6 +324,42 @@ inline std::shared_ptr<InitializationResult> InitializeOncePerProcess(
       args, static_cast<ProcessInitializationFlags::Flags>(flags_accum));
 }
 
+struct ProcessEnvironmentScrubOptions {
+  // The environment variables to keep. Each entry is `*`, a variable name, or
+  // a variable name prefix followed by `*`. Names are case-insensitive on
+  // Windows.
+  std::vector<std::string> allow;
+  // Whether to also keep the variables that Node.js and its bundled
+  // dependencies read after startup, see GetRuntimeEnvironmentDefaults().
+  bool keep_runtime_defaults = true;
+  // Whether to overwrite the removed variables in the environment block the
+  // process was started with, which /proc/<pid>/environ exposes. Only
+  // implemented on Linux.
+  bool wipe_initial_block = true;
+};
+
+// Removes every variable that `options` does not keep from the process
+// environment, and returns the names of the removed variables.
+//
+// node::Start() does this automatically when the permission model restricts
+// access to environment variables. When `args` passed to
+// InitializeOncePerProcess() enable the permission model without
+// `--allow-env=*`, the embedder must remove the variables that `--allow-env`
+// does not grant access to first: InitializeOncePerProcess() fails if the
+// process environment contains any of them.
+//
+// This modifies the process environment without any locking that native code
+// calling getenv() participates in. It must be called before starting any
+// thread that may read the environment, and before
+// InitializeOncePerProcess(). Returns Nothing() if `options.allow` contains an
+// invalid entry, or if InitializeOncePerProcess() has already completed.
+NODE_EXTERN v8::Maybe<std::vector<std::string>> ScrubProcessEnvironment(
+    const ProcessEnvironmentScrubOptions& options);
+
+// Returns the names, and name prefixes followed by `*`, of the environment
+// variables that Node.js and its bundled dependencies read after startup.
+NODE_EXTERN std::vector<std::string> GetRuntimeEnvironmentDefaults();
+
 enum OptionEnvvarSettings {
   // Allow the options to be set via the environment variable, like
   // `NODE_OPTIONS`.
diff --git a/src/node_dotenv.cc b/src/node_dotenv.cc
index e42eb3c9deaf..0c6fa30a41d7 100644
--- a/src/node_dotenv.cc
+++ b/src/node_dotenv.cc
@@ -86,6 +86,15 @@ Maybe<void> Dotenv::SetEnvironment(node::Environment* env) {
   return JustVoid();
 }
 
+std::vector<std::string> Dotenv::GetKeys() const {
+  std::vector<std::string> keys;
+  keys.reserve(store_.size());
+  for (const auto& entry : store_) {
+    keys.push_back(entry.first);
+  }
+  return keys;
+}
+
 MaybeLocal<Object> Dotenv::ToObject(Environment* env) const {
   EscapableHandleScope scope(env->isolate());
 
diff --git a/src/node_dotenv.h b/src/node_dotenv.h
index 689c763907c2..e0069bb08ce8 100644
--- a/src/node_dotenv.h
+++ b/src/node_dotenv.h
@@ -30,6 +30,8 @@ class Dotenv {
   void AssignNodeOptionsIfAvailable(std::string* node_options) const;
   v8::Maybe<void> SetEnvironment(Environment* env);
   v8::MaybeLocal<v8::Object> ToObject(Environment* env) const;
+  // The names of the variables parsed from the env files.
+  std::vector<std::string> GetKeys() const;
 
   static std::vector<env_file_data> GetDataFromArgs(
       const std::vector<std::string>& args);
@@ -38,6 +40,11 @@ class Dotenv {
   std::map<std::string, std::string> store_;
 };
 
+namespace per_process {
+// The env files passed with --env-file and --env-file-if-exists.
+extern Dotenv dotenv_file;
+}  // namespace per_process
+
 }  // namespace node
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/node_env_var.cc b/src/node_env_var.cc
index 25e405be86d2..b55d099cbca1 100644
--- a/src/node_env_var.cc
+++ b/src/node_env_var.cc
@@ -4,6 +4,8 @@
 #include "node_external_reference.h"
 #include "node_i18n.h"
 #include "node_process-inl.h"
+#include "permission/env_permission.h"
+#include "permission/permission.h"
 #include "util.h"
 
 #include <time.h>  // tzset(), _tzset()
@@ -429,6 +431,40 @@ void TraceEnvVar(Environment* env,
   }
 }
 
+// Called when process.env does not have `property`. If the permission model
+// removed the variable at startup, publishes the denial and warns once, so
+// that the variable does not just silently read as undefined.
+static Maybe<void> ReportRemovedEnvVar(Environment* env,
+                                       Local<String> property) {
+  if (!permission::IsProcessEnvironmentScrubbed()) return JustVoid();
+  Utf8Value key(env->isolate(), property);
+  if (!permission::WasRemovedByEnvironmentScrub(key.ToStringView())) {
+    return JustVoid();
+  }
+  env->permission()->PublishDenied(
+      env, permission::PermissionScope::kEnv, key.ToStringView());
+  if (permission::ShouldWarnAboutRemovedEnvVar(key.ToStringView()) &&
+      ProcessEmitWarning(env,
+                         "The permission model removed the environment "
+                         "variable \"%s\" at startup. Use --allow-env to "
+                         "manage permissions.",
+                         *key)
+          .IsNothing()) {
+    return Nothing<void>();
+  }
+  return JustVoid();
+}
+
+// In audit mode nothing is removed at startup. Publishes accesses to the
+// variables that enforcing the permission model would have removed instead.
+static void AuditEnvVar(Environment* env, Local<String> property) {
+  Utf8Value key(env->isolate(), property);
+  if (!permission::WasDeniedAtStartup(key.ToStringView())) return;
+  // is_granted() publishes the denial.
+  env->permission()->is_granted(
+      env, permission::PermissionScope::kEnv, key.ToStringView());
+}
+
 static Intercepted EnvGetter(Local<Name> property,
                              const PropertyCallbackInfo<Value>& info) {
   Environment* env = Environment::GetCurrent(info);
@@ -445,8 +481,15 @@ static Intercepted EnvGetter(Local<Name> property,
 
   Local<Value> ret;
   if (!value_string.ToLocal(&ret)) {
+    if (env->permission()->enabled() &&
+        ReportRemovedEnvVar(env, property.As<String>()).IsNothing()) {
+      return Intercepted::kYes;
+    }
     return Intercepted::kNo;
   }
+  if (env->permission()->warning_only()) {
+    AuditEnvVar(env, property.As<String>());
+  }
   info.GetReturnValue().Set(ret);
   return Intercepted::kYes;
 }
@@ -496,10 +539,17 @@ static Intercepted EnvQuery(Local<Name> property,
     bool has_env = (rc != -1);
     TraceEnvVar(env, "query", property.As<String>());
     if (has_env) {
+      if (env->permission()->warning_only()) {
+        AuditEnvVar(env, property.As<String>());
+      }
       // Return attributes for the property.
       info.GetReturnValue().Set(v8::None);
       return Intercepted::kYes;
     }
+    if (env->permission()->enabled() &&
+        ReportRemovedEnvVar(env, property.As<String>()).IsNothing()) {
+      return Intercepted::kYes;
+    }
   }
   return Intercepted::kNo;
 }
diff --git a/src/node_options.cc b/src/node_options.cc
index 89c2d66b3942..0973c8051f14 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -7,6 +7,7 @@
 #include "node_external_reference.h"
 #include "node_internals.h"
 #include "node_sea.h"
+#include "permission/env_permission.h"
 #include "uv.h"
 #if HAVE_OPENSSL
 #include "ncrypto.h"  // Defines OPENSSL_VERSION_PREREQ for BoringSSL.
@@ -213,6 +214,14 @@ void EnvironmentOptions::CheckOptions(std::vector<std::string>* errors,
     errors->push_back("either --check or --eval can be used, not both");
   }
 
+  for (const std::string& pattern : permission::ParseEnvAllowList(allow_env)) {
+    if (!permission::IsValidEnvAllowPattern(pattern)) {
+      errors->push_back("--allow-env must be '*', a variable name, or a "
+                        "variable name prefix followed by '*'");
+      break;
+    }
+  }
+
   if (!unhandled_rejections.empty() &&
       unhandled_rejections != "warn-with-error-code" &&
       unhandled_rejections != "throw" &&
@@ -764,6 +773,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             BOOL_FIELD(permission_audit),
             kAllowedInEnvvar,
             false);
+  AddOption("--allow-env",
+            "allow access to environment variables when any permissions are "
+            "set",
+            &EnvironmentOptions::allow_env,
+            kAllowedInEnvvar,
+            OptionNamespaces::kPermissionNamespace);
   AddOption("--allow-fs-read",
             "allow permissions to read the filesystem",
             &EnvironmentOptions::allow_fs_read,
diff --git a/src/node_options.h b/src/node_options.h
index cad2e850e316..3e9fb9fd71fe 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -160,6 +160,7 @@ class EnvironmentOptions : public Options {
 #endif  // HAVE_INSPECTOR
 
   std::vector<std::string> conditions;
+  std::vector<std::string> allow_env;
   std::vector<std::string> allow_fs_read;
   std::vector<std::string> allow_fs_write;
   std::vector<std::string> disable_warnings;
diff --git a/src/permission/env_permission.cc b/src/permission/env_permission.cc
new file mode 100644
index 000000000000..1a40f4d3df82
--- /dev/null
+++ b/src/permission/env_permission.cc
@@ -0,0 +1,499 @@
+#include "permission/env_permission.h"
+
+#include "env-inl.h"
+#include "node_internals.h"
+#include "node_mutex.h"
+#include "util-inl.h"
+#include "uv.h"
+#include "v8.h"
+
+#include <algorithm>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <utility>
+
+#if defined(__linux__)
+extern char** environ;
+#endif
+
+namespace node {
+
+using v8::Array;
+using v8::Context;
+using v8::HandleScope;
+using v8::Isolate;
+using v8::Local;
+using v8::String;
+using v8::Value;
+
+namespace permission {
+
+namespace {
+
+constexpr std::string_view kRuntimeEnvironmentDefaults[] = {
+    // Read by Node.js itself after startup.
+    "NODE_BENCH_CONTEXT",
+    "NODE_BENCH_FILE_RUN_ID",
+    "NODE_BENCH_RUN_ID",
+    "NODE_CHANNEL_FD",
+    "NODE_CHANNEL_SERIALIZATION_MODE",
+    "NODE_CLUSTER_SCHED_POLICY",
+    "NODE_COMPILE_CACHE",
+    "NODE_COMPILE_CACHE_PORTABLE",
+    "NODE_COMPILE_CACHE_READONLY",
+    "NODE_DEBUG",
+    "NODE_DEBUG_NATIVE",
+    "NODE_DISABLE_COLORS",
+    "NODE_DISABLE_COMPILE_CACHE",
+    "NODE_EXTRA_CA_CERTS",
+    "NODE_ICU_DATA",
+    "NODE_INSPECT_RESUME_ON_START",
+    "NODE_NO_WARNINGS",
+    "NODE_OPTIONS",
+    "NODE_PATH",
+    "NODE_PENDING_DEPRECATION",
+    "NODE_PENDING_PIPE_INSTANCES",
+    "NODE_PRESERVE_SYMLINKS",
+    "NODE_REDIRECT_WARNINGS",
+    "NODE_REPL_EXTERNAL_MODULE",
+    "NODE_REPL_HISTORY",
+    "NODE_TEST_CONTEXT",
+    "NODE_TEST_WORKER_ID",
+    "NODE_TLS_REJECT_UNAUTHORIZED",
+    "NODE_UNIQUE_ID",
+    "NODE_USE_ENV_PROXY",
+    "NODE_USE_SYSTEM_CA",
+    "NODE_V8_COVERAGE",
+    "WATCH_REPORT_DEPENDENCIES",
+    // Terminal and CI detection, see lib/internal/tty.js.
+    "APPVEYOR",
+    "BUILDKITE",
+    "CI",
+    "CI_NAME",
+    "CIRCLECI",
+    "COLORTERM",
+    "DRONE",
+    "FORCE_COLOR",
+    "GITEA_ACTIONS",
+    "GITHUB_ACTIONS",
+    "GITLAB_CI",
+    "NO_COLOR",
+    "TEAMCITY_VERSION",
+    "TERM",
+    "TERM_PROGRAM",
+    "TERM_PROGRAM_VERSION",
+    "TMUX",
+    "TRAVIS",
+    // libuv.
+    "HOME",
+    "PATH",
+    "TEMP",
+    "TMP",
+    "TMPDIR",
+    "USERPROFILE",
+    "UV_THREADPOOL_SIZE",
+    "UV_USE_IO_URING",
+    // Copied into child process environments by libuv on Windows, and read
+    // by lib/child_process.js.
+    "COMSPEC",
+    "HOMEDRIVE",
+    "HOMEPATH",
+    "LOGONSERVER",
+    "SYSTEMDRIVE",
+    "SYSTEMROOT",
+    "USERDOMAIN",
+    "USERNAME",
+    "WINDIR",
+    // c-ares and the system resolver.
+    "HOSTALIASES",
+    "LOCALDOMAIN",
+    "RES_OPTIONS",
+    // ICU, the time zone and the locale.
+    "ICU_DATA",
+    "LANG",
+    "LANGUAGE",
+    "LC_*",
+    "TZ",
+    // OpenSSL.
+    "OPENSSL_CONF",
+    "OPENSSL_CONF_INCLUDE",
+    "OPENSSL_ENGINES",
+    "OPENSSL_MODULES",
+    "SSL_CERT_DIR",
+    "SSL_CERT_FILE",
+    // The dynamic loader, for addons and FFI.
+    "DYLD_FALLBACK_LIBRARY_PATH",
+    "DYLD_LIBRARY_PATH",
+    "LD_LIBRARY_PATH",
+    "LIBPATH",
+};
+
+struct EnvScrubState {
+  Mutex mutex;
+  // Whether ScrubProcessEnvironment() removed the variables in `denied`.
+  std::atomic<bool> scrubbed{false};
+  // Whether RecordAuditedEnvironmentVariables() recorded them instead.
+  std::atomic<bool> audited{false};
+  std::unordered_set<std::string> denied;
+  std::unordered_set<std::string> warned;
+};
+
+EnvScrubState& GetScrubState() {
+  // Intentionally leaked, so that it can be used during process teardown.
+  static EnvScrubState* state = new EnvScrubState();
+  return *state;
+}
+
+// The key under which a name is stored in the sets above.
+std::string NormalizeEnvName(std::string_view name) {
+#ifdef _WIN32
+  return ToUpper(std::string(name));
+#else
+  return std::string(name);
+#endif
+}
+
+bool MatchesAnyPattern(std::span<const std::string> patterns,
+                       std::string_view name) {
+  return std::any_of(
+      patterns.begin(), patterns.end(), [&](const std::string& pattern) {
+        return EnvNameMatchesPattern(pattern, name);
+      });
+}
+
+#ifdef _WIN32
+// libuv modifies the environment block of the process, but the C runtime keeps
+// its own copy of the environment, which getenv() reads. Removes a variable
+// from that copy.
+void UnsetCrtEnvironmentVariable(const std::string& name) {
+  _wputenv_s(ConvertUTF8ToWideString(name).c_str(), L"");
+}
+#endif  // _WIN32
+
+#if defined(__linux__)
+// Reads the [start, end) address range of the environment block the process
+// was started with from fields 50 and 51 of /proc/self/stat (Linux 3.5+).
+bool GetInitialEnvironmentBlock(uintptr_t* start, uintptr_t* end) {
+  FILE* fp = fopen("/proc/self/stat", "re");
+  if (fp == nullptr) return false;
+  char buf[4096];
+  size_t length = fread(buf, 1, sizeof(buf) - 1, fp);
+  fclose(fp);
+  buf[length] = '\0';
+
+  // The command name in field 2 may contain spaces and parentheses, so start
+  // after the last ')', where field 3 begins.
+  char* p = strrchr(buf, ')');
+  if (p == nullptr) return false;
+  p++;
+
+  constexpr int kEnvStartField = 50;
+  constexpr int kEnvEndField = 51;
+  for (int field = 3; field <= kEnvEndField; field++) {
+    char* next;
+    uint64_t value = strtoull(p, &next, 10);
+    if (next == p) {
+      // A non-numeric field, such as the state in field 3.
+      while (*p == ' ') p++;
+      while (*p != ' ' && *p != '\0') p++;
+      if (*p == '\0') return false;
+    } else {
+      p = next;
+    }
+    if (field == kEnvStartField) *start = static_cast<uintptr_t>(value);
+    if (field == kEnvEndField) *end = static_cast<uintptr_t>(value);
+  }
+  return *start != 0 && *start < *end;
+}
+
+// Returns the entries for `names` that still point into the initial
+// environment block, which unsetenv() leaves untouched.
+std::vector<std::pair<char*, size_t>> FindInitialEnvironmentEntries(
+    const std::vector<std::string>& names) {
+  std::vector<std::pair<char*, size_t>> entries;
+  uintptr_t start = 0;
+  uintptr_t end = 0;
+  if (!GetInitialEnvironmentBlock(&start, &end)) return entries;
+
+  for (char** e = environ; e != nullptr && *e != nullptr; e++) {
+    char* entry = *e;
+    const uintptr_t address = reinterpret_cast<uintptr_t>(entry);
+    if (address < start || address >= end) continue;
+    const char* equals = strchr(entry, '=');
+    if (equals == nullptr) continue;
+    const std::string_view name(entry, equals - entry);
+    if (std::find(names.begin(), names.end(), name) == names.end()) continue;
+    size_t length = strlen(entry);
+    if (address + length > end) length = end - address;
+    entries.emplace_back(entry, length);
+  }
+  return entries;
+}
+#endif  // defined(__linux__)
+
+}  // namespace
+
+std::vector<std::string> ParseEnvAllowList(
+    std::span<const std::string> values) {
+  std::vector<std::string> patterns;
+  for (const std::string& value : values) {
+    size_t begin = 0;
+    while (begin <= value.size()) {
+      size_t end = value.find(',', begin);
+      if (end == std::string::npos) end = value.size();
+      if (end > begin) patterns.emplace_back(value.substr(begin, end - begin));
+      begin = end + 1;
+    }
+  }
+  return patterns;
+}
+
+bool IsValidEnvAllowPattern(std::string_view pattern) {
+  const size_t wildcard = pattern.find('*');
+  return !pattern.empty() && pattern.find('=') == std::string_view::npos &&
+         (wildcard == std::string_view::npos || wildcard == pattern.size() - 1);
+}
+
+bool EnvNameMatchesPattern(std::string_view pattern, std::string_view name) {
+  if (pattern == "*") return true;
+  const bool is_prefix = !pattern.empty() && pattern.back() == '*';
+  if (is_prefix) pattern.remove_suffix(1);
+  if (is_prefix ? name.size() < pattern.size()
+                : name.size() != pattern.size()) {
+    return false;
+  }
+#ifdef _WIN32
+  for (size_t i = 0; i < pattern.size(); i++) {
+    if (ToUpper(pattern[i]) != ToUpper(name[i])) return false;
+  }
+  return true;
+#else
+  return name.compare(0, pattern.size(), pattern) == 0;
+#endif
+}
+
+// Whether every name `specific` matches is also matched by `general`.
+static bool EnvPatternCovers(std::string_view general,
+                             std::string_view specific) {
+  if (general == "*") return true;
+  if (specific.empty() || specific == "*") return false;
+  if (specific.back() != '*') return EnvNameMatchesPattern(general, specific);
+  // Two prefixes: `P*` only matches names `G*` matches if P starts with G.
+  if (general.empty() || general.back() != '*') return false;
+  specific.remove_suffix(1);
+  return EnvNameMatchesPattern(general, specific);
+}
+
+std::vector<std::string> IntersectEnvAllowLists(
+    std::span<const std::string> a, std::span<const std::string> b) {
+  std::vector<std::string> result;
+  for (const std::string& x : a) {
+    for (const std::string& y : b) {
+      if (EnvPatternCovers(x, y)) {
+        result.push_back(y);
+      } else if (EnvPatternCovers(y, x)) {
+        result.push_back(x);
+      }
+    }
+  }
+  return result;
+}
+
+std::span<const std::string_view> GetRuntimeEnvironmentDefaults() {
+  return kRuntimeEnvironmentDefaults;
+}
+
+bool IsRuntimeEnvironmentDefault(std::string_view name) {
+  return std::any_of(std::begin(kRuntimeEnvironmentDefaults),
+                     std::end(kRuntimeEnvironmentDefaults),
+                     [&](std::string_view pattern) {
+                       return EnvNameMatchesPattern(pattern, name);
+                     });
+}
+
+// Returns the names of the variables in the process environment that neither
+// `allow` nor, if `keep_runtime_defaults` is set, the runtime defaults match.
+// The caller must hold per_process::env_var_mutex.
+static std::vector<std::string> FindUnmatchedEnvironmentVariables(
+    std::span<const std::string> allow, bool keep_runtime_defaults) {
+  uv_env_item_t* items = nullptr;
+  int count = 0;
+  // Failing to enumerate the environment must not leave it unscrubbed.
+  CHECK_EQ(uv_os_environ(&items, &count), 0);
+  auto cleanup = OnScopeLeave([&]() { uv_os_free_environ(items, count); });
+
+  std::vector<std::string> names;
+  for (int i = 0; i < count; i++) {
+    const std::string_view name(items[i].name);
+    if (name.empty()) continue;
+#ifdef _WIN32
+    // Hidden variables, such as the per-drive working directories ("=C:").
+    if (name[0] == '=') continue;
+#endif
+    if (keep_runtime_defaults && IsRuntimeEnvironmentDefault(name)) continue;
+    if (MatchesAnyPattern(allow, name)) continue;
+    names.emplace_back(name);
+  }
+  return names;
+}
+
+std::vector<std::string> FindDeniedEnvironmentVariables(
+    std::span<const std::string> allow) {
+  Mutex::ScopedLock env_lock(per_process::env_var_mutex);
+  return FindUnmatchedEnvironmentVariables(allow, true);
+}
+
+std::vector<std::string> ScrubProcessEnvironment(
+    const EnvScrubOptions& options) {
+  EnvScrubState& state = GetScrubState();
+  Mutex::ScopedLock state_lock(state.mutex);
+  Mutex::ScopedLock env_lock(per_process::env_var_mutex);
+
+  std::vector<std::string> removed = FindUnmatchedEnvironmentVariables(
+      options.allow, options.keep_runtime_defaults);
+
+#if defined(__linux__)
+  std::vector<std::pair<char*, size_t>> initial_entries;
+  if (options.wipe_initial_block) {
+    initial_entries = FindInitialEnvironmentEntries(removed);
+  }
+#endif
+
+  for (const std::string& name : removed) {
+    uv_os_unsetenv(name.c_str());
+#ifdef _WIN32
+    UnsetCrtEnvironmentVariable(name);
+#endif
+    state.denied.insert(NormalizeEnvName(name));
+  }
+
+#if defined(__linux__)
+  // Now that environ no longer refers to them, overwrite the removed entries
+  // so that /proc/<pid>/environ does not expose them either.
+  for (const auto& [entry, length] : initial_entries) {
+    memset(entry, 0, length);
+  }
+#endif
+
+  state.scrubbed.store(true);
+  return removed;
+}
+
+void RecordAuditedEnvironmentVariables(std::span<const std::string> allow) {
+  EnvScrubState& state = GetScrubState();
+  Mutex::ScopedLock state_lock(state.mutex);
+  Mutex::ScopedLock env_lock(per_process::env_var_mutex);
+  for (const std::string& name :
+       FindUnmatchedEnvironmentVariables(allow, true)) {
+    state.denied.insert(NormalizeEnvName(name));
+  }
+  state.audited.store(true);
+}
+
+bool IsProcessEnvironmentScrubbed() {
+  return GetScrubState().scrubbed.load();
+}
+
+bool WasRemovedByEnvironmentScrub(std::string_view name) {
+  EnvScrubState& state = GetScrubState();
+  if (!state.scrubbed.load()) return false;
+  Mutex::ScopedLock lock(state.mutex);
+  return state.denied.contains(NormalizeEnvName(name));
+}
+
+bool WasDeniedAtStartup(std::string_view name) {
+  EnvScrubState& state = GetScrubState();
+  if (!state.scrubbed.load() && !state.audited.load()) return false;
+  Mutex::ScopedLock lock(state.mutex);
+  return state.denied.contains(NormalizeEnvName(name));
+}
+
+bool ShouldWarnAboutRemovedEnvVar(std::string_view name) {
+  EnvScrubState& state = GetScrubState();
+  Mutex::ScopedLock lock(state.mutex);
+  return state.warned.insert(NormalizeEnvName(name)).second;
+}
+
+void EnvPermission::Apply(Environment* env,
+                          std::span<const std::string> allow,
+                          PermissionScope scope) {
+  patterns_.assign(allow.begin(), allow.end());
+  if (std::find(patterns_.begin(), patterns_.end(), "*") != patterns_.end()) {
+    granted_all_.store(true);
+  }
+}
+
+void EnvPermission::Drop(Environment* env,
+                         PermissionScope scope,
+                         std::string_view param) {
+  granted_all_.store(false);
+  if (param.empty()) {
+    dropped_all_ = true;
+    patterns_.clear();
+    dropped_.clear();
+  } else {
+    dropped_.insert(NormalizeEnvName(param));
+  }
+  RemoveFromEnvironment(env, param.empty(), param);
+}
+
+bool EnvPermission::is_granted(Environment* env,
+                               PermissionScope perm,
+                               std::string_view param) const {
+  if (param.empty()) return granted_all();
+  if (!dropped_.empty() && dropped_.contains(NormalizeEnvName(param))) {
+    return false;
+  }
+  if (granted_all()) return true;
+  return IsRuntimeEnvironmentDefault(param) ||
+         (!dropped_all_ && MatchesAnyPattern(patterns_, param));
+}
+
+void EnvPermission::RemoveFromEnvironment(Environment* env,
+                                          bool drop_all,
+                                          std::string_view name) {
+  if (env == nullptr) return;
+  // An Environment that does not own the process state shares the real
+  // process environment with the embedder, and must not modify it.
+  if (env->env_vars() == per_process::system_environment &&
+      !env->owns_process_state()) {
+    return;
+  }
+
+  Isolate* isolate = env->isolate();
+  HandleScope handle_scope(isolate);
+  Local<Context> context = env->context();
+
+  const auto remove = [&](Local<String> key) {
+    env->env_vars()->Delete(isolate, key);
+#ifdef _WIN32
+    if (env->env_vars() == per_process::system_environment) {
+      UnsetCrtEnvironmentVariable(Utf8Value(isolate, key).ToString());
+    }
+#endif
+  };
+
+  if (!drop_all) {
+    Local<Value> key;
+    if (ToV8Value(context, name, isolate).ToLocal(&key) && key->IsString()) {
+      remove(key.As<String>());
+    }
+    return;
+  }
+
+  Local<Array> keys;
+  if (!env->env_vars()->Enumerate(isolate).ToLocal(&keys)) return;
+  const uint32_t length = keys->Length();
+  for (uint32_t i = 0; i < length; i++) {
+    Local<Value> key;
+    if (!keys->Get(context, i).ToLocal(&key) || !key->IsString()) continue;
+    Utf8Value key_utf8(isolate, key);
+    if (IsRuntimeEnvironmentDefault(key_utf8.ToStringView())) continue;
+    remove(key.As<String>());
+  }
+}
+
+}  // namespace permission
+
+}  // namespace node
diff --git a/src/permission/env_permission.h b/src/permission/env_permission.h
new file mode 100644
index 000000000000..051ee2b9cb37
--- /dev/null
+++ b/src/permission/env_permission.h
@@ -0,0 +1,121 @@
+#ifndef SRC_PERMISSION_ENV_PERMISSION_H_
+#define SRC_PERMISSION_ENV_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "permission/permission_base.h"
+
+#include <atomic>
+#include <span>
+#include <string>
+#include <string_view>
+#include <unordered_set>
+#include <vector>
+
+namespace node {
+
+class Environment;
+
+namespace permission {
+
+// Splits the values of --allow-env (which may be given more than once, and
+// may each hold a comma-separated list) into individual patterns.
+std::vector<std::string> ParseEnvAllowList(std::span<const std::string> values);
+
+// Whether `pattern` is `*`, a variable name, or a variable name prefix
+// followed by `*`.
+bool IsValidEnvAllowPattern(std::string_view pattern);
+
+// Whether `name` matches `pattern`: `*`, an exact name, or a prefix followed
+// by `*`. Names are compared case-insensitively on Windows, where environment
+// variable names are case-insensitive.
+bool EnvNameMatchesPattern(std::string_view pattern, std::string_view name);
+
+// Returns the patterns matching exactly the names that both `a` and `b` match.
+std::vector<std::string> IntersectEnvAllowLists(std::span<const std::string> a,
+                                                std::span<const std::string> b);
+
+// Environment variables that Node.js and its bundled dependencies read after
+// startup. The scrub keeps them, and dropping the whole env scope keeps them.
+std::span<const std::string_view> GetRuntimeEnvironmentDefaults();
+bool IsRuntimeEnvironmentDefault(std::string_view name);
+
+struct EnvScrubOptions {
+  // Names or patterns to keep, see EnvNameMatchesPattern().
+  std::span<const std::string> allow;
+  // Whether to keep GetRuntimeEnvironmentDefaults().
+  bool keep_runtime_defaults = true;
+  // Whether to overwrite the removed entries in the environment block the
+  // process started with, which /proc/<pid>/environ still exposes after
+  // unsetenv(). Best effort, and currently only implemented on Linux.
+  bool wipe_initial_block = true;
+};
+
+// Removes every environment variable that `options` does not keep from the
+// process environment, and returns the names it removed.
+//
+// This modifies the process environment without any locking that native
+// code calling getenv() participates in, so it must be called before any
+// such thread is started.
+std::vector<std::string> ScrubProcessEnvironment(
+    const EnvScrubOptions& options);
+
+// Returns the names of the variables in the process environment that neither
+// `allow` nor GetRuntimeEnvironmentDefaults() match.
+std::vector<std::string> FindDeniedEnvironmentVariables(
+    std::span<const std::string> allow);
+
+// In audit mode, nothing is removed. Records the names of the variables that
+// ScrubProcessEnvironment() would remove instead.
+void RecordAuditedEnvironmentVariables(std::span<const std::string> allow);
+
+// Whether ScrubProcessEnvironment() has run in this process.
+bool IsProcessEnvironmentScrubbed();
+
+// Whether `name` was removed by ScrubProcessEnvironment().
+bool WasRemovedByEnvironmentScrub(std::string_view name);
+
+// Whether `name` was removed by ScrubProcessEnvironment(), or recorded by
+// RecordAuditedEnvironmentVariables().
+bool WasDeniedAtStartup(std::string_view name);
+
+// Returns true only the first time it is called for a given `name`.
+bool ShouldWarnAboutRemovedEnvVar(std::string_view name);
+
+class EnvPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             std::span<const std::string> allow,
+             PermissionScope scope) override;
+  void Drop(Environment* env,
+            PermissionScope scope,
+            std::string_view param) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  std::string_view param) const override;
+
+  // Whether every environment variable is accessible. Safe to call from
+  // any thread.
+  bool granted_all() const {
+    return granted_all_.load(std::memory_order_relaxed);
+  }
+
+ private:
+  // Removes the variables `drop_all` or `name` refer to from the
+  // environment `env` exposes as process.env.
+  void RemoveFromEnvironment(Environment* env,
+                             bool drop_all,
+                             std::string_view name);
+
+  std::atomic<bool> granted_all_{false};
+  bool dropped_all_ = false;
+  std::vector<std::string> patterns_;
+  std::unordered_set<std::string> dropped_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_ENV_PERMISSION_H_
diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index 5a873e9db5bd..67df94036158 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -8,6 +8,7 @@
 #include "node_file.h"
 
 #include "permission/boolean_permission.h"
+#include "permission/env_permission.h"
 #include "permission/fs_permission.h"
 #include "permission/permission_base.h"
 #include "v8-fast-api-calls.h"
@@ -58,11 +59,21 @@ constexpr std::string_view GetDiagnosticsChannelName(PermissionScope scope) {
       return "node:permission-model:ffi";
     case PermissionScope::kOpenSSLStore:
       return "node:permission-model:openssl-store";
+    case PermissionScope::kEnv:
+      return "node:permission-model:env";
     default:
       return {};
   }
 }
 
+#if defined(__linux__)
+// /proc/<pid>/environ exposes the environment a process was started with,
+// including variables that the env scope does not grant access to.
+bool IsProcEnvironPath(std::string_view path) {
+  return path.starts_with("/proc/") && path.ends_with("/environ");
+}
+#endif  // defined(__linux__)
+
 Local<DictionaryTemplate> GetPermissionDiagnosticsTemplate(Environment* env) {
   auto tmpl = env->permission_diagnostic_channel_message();
   if (tmpl.IsEmpty()) {
@@ -89,6 +100,18 @@ static void Drop(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  // Dropping environment variables removes them from the environment. An
+  // Environment that does not own the process state shares the real process
+  // environment with the embedder, and must not modify it.
+  if (scope == PermissionScope::kEnv &&
+      env->env_vars() == per_process::system_environment &&
+      !env->owns_process_state()) {
+    return THROW_ERR_INVALID_STATE(
+        env,
+        "Environment variables can only be dropped from an Environment that "
+        "owns the process state");
+  }
+
   if (args.Length() > 1 && !args[1]->IsUndefined()) {
     // BufferValue copies raw bytes out of a Buffer/TypedArray as-is instead
     // of forcing a (potentially lossy) UTF-8 string conversion, since paths
@@ -241,6 +264,11 @@ Permission::Permission() : enabled_(false), warning_only_(false) {
   nodes_[static_cast<size_t>(PermissionScope::k##Name)] =                      \
       std::make_shared<AllowRevokePermission>();
   NET_PERMISSIONS(V)
+#undef V
+  env_permission_ = std::make_shared<EnvPermission>();
+#define V(Name, _, __, ___)                                                    \
+  nodes_[static_cast<size_t>(PermissionScope::k##Name)] = env_permission_;
+  ENV_PERMISSIONS(V)
 #undef V
 }
 
@@ -320,7 +348,16 @@ bool Permission::is_granted_quiet(Environment* env,
   CHECK(permission != PermissionScope::kPermissionsRoot &&
         permission != PermissionScope::kPermissionsCount);
   auto& perm_node = nodes_[static_cast<size_t>(permission)];
-  return perm_node && perm_node->is_granted(env, permission, res);
+  if (!perm_node || !perm_node->is_granted(env, permission, res)) {
+    return false;
+  }
+#if defined(__linux__)
+  if (permission == PermissionScope::kFileSystemRead &&
+      IsProcEnvironPath(res) && !env_permission_->granted_all()) {
+    return false;
+  }
+#endif  // defined(__linux__)
+  return true;
 }
 
 bool Permission::is_scope_granted(Environment* env,
diff --git a/src/permission/permission.h b/src/permission/permission.h
index 7422bb6a2375..6debc4102b19 100644
--- a/src/permission/permission.h
+++ b/src/permission/permission.h
@@ -5,6 +5,7 @@
 
 #include "debug_utils.h"
 #include "node_diagnostics_channel.h"
+#include "permission/env_permission.h"
 #include "permission/permission_base.h"
 
 #include <array>
@@ -150,6 +151,8 @@ class Permission {
       static_cast<size_t>(PermissionScope::kPermissionsCount);
 
   std::array<std::shared_ptr<PermissionBase>, kPermissionCount> nodes_;
+  // Also stored in nodes_, kept here for the file system scope to consult.
+  std::shared_ptr<EnvPermission> env_permission_;
   bool enabled_;
   bool warning_only_;
   mutable bool publishing_ = false;
diff --git a/src/permission/permission_base.h b/src/permission/permission_base.h
index 658175611ecd..fb7b2a85d430 100644
--- a/src/permission/permission_base.h
+++ b/src/permission/permission_base.h
@@ -39,6 +39,8 @@ namespace permission {
 #define OPENSSL_STORE_PERMISSIONS(V)                                           \
   V(OpenSSLStore, "openssl.store", PermissionsRoot, "--allow-openssl-store")
 
+#define ENV_PERMISSIONS(V) V(Env, "env", PermissionsRoot, "--allow-env")
+
 #define PERMISSIONS(V)                                                         \
   FILESYSTEM_PERMISSIONS(V)                                                    \
   CHILD_PROCESS_PERMISSIONS(V)                                                 \
@@ -48,7 +50,8 @@ namespace permission {
   NET_PERMISSIONS(V)                                                           \
   ADDON_PERMISSIONS(V)                                                         \
   FFI_PERMISSIONS(V)                                                           \
-  OPENSSL_STORE_PERMISSIONS(V)
+  OPENSSL_STORE_PERMISSIONS(V)                                                 \
+  ENV_PERMISSIONS(V)
 
 #define V(name, _, __, ___) k##name,
 enum class PermissionScope {
diff --git a/test/cctest/test_env_permission.cc b/test/cctest/test_env_permission.cc
new file mode 100644
index 000000000000..8d1876b26782
--- /dev/null
+++ b/test/cctest/test_env_permission.cc
@@ -0,0 +1,83 @@
+#include "gtest/gtest.h"
+#include "node.h"
+#include "node_test_fixture.h"
+#include "permission/env_permission.h"
+
+#include <string>
+#include <vector>
+
+using node::permission::EnvNameMatchesPattern;
+using node::permission::GetRuntimeEnvironmentDefaults;
+using node::permission::IntersectEnvAllowLists;
+using node::permission::IsRuntimeEnvironmentDefault;
+using node::permission::IsValidEnvAllowPattern;
+using node::permission::ParseEnvAllowList;
+
+TEST(EnvPermissionTest, ParseEnvAllowList) {
+  const std::vector<std::string> values = {"A,B", "C", "", ",D,,E,"};
+  EXPECT_EQ(ParseEnvAllowList(values),
+            (std::vector<std::string>{"A", "B", "C", "D", "E"}));
+}
+
+TEST(EnvPermissionTest, IsValidEnvAllowPattern) {
+  EXPECT_TRUE(IsValidEnvAllowPattern("*"));
+  EXPECT_TRUE(IsValidEnvAllowPattern("PATH"));
+  EXPECT_TRUE(IsValidEnvAllowPattern("APP_*"));
+  EXPECT_FALSE(IsValidEnvAllowPattern(""));
+  EXPECT_FALSE(IsValidEnvAllowPattern("A=B"));
+  EXPECT_FALSE(IsValidEnvAllowPattern("*A"));
+  EXPECT_FALSE(IsValidEnvAllowPattern("A*B"));
+  EXPECT_FALSE(IsValidEnvAllowPattern("A**"));
+}
+
+TEST(EnvPermissionTest, EnvNameMatchesPattern) {
+  EXPECT_TRUE(EnvNameMatchesPattern("*", "ANYTHING"));
+  EXPECT_TRUE(EnvNameMatchesPattern("PATH", "PATH"));
+  EXPECT_FALSE(EnvNameMatchesPattern("PATH", "PATHEXT"));
+  EXPECT_FALSE(EnvNameMatchesPattern("PATHEXT", "PATH"));
+  EXPECT_TRUE(EnvNameMatchesPattern("APP_*", "APP_"));
+  EXPECT_TRUE(EnvNameMatchesPattern("APP_*", "APP_DB_URL"));
+  EXPECT_FALSE(EnvNameMatchesPattern("APP_*", "APP"));
+  EXPECT_FALSE(EnvNameMatchesPattern("APP_*", "OTHER_APP_DB"));
+#ifdef _WIN32
+  EXPECT_TRUE(EnvNameMatchesPattern("path", "PATH"));
+  EXPECT_TRUE(EnvNameMatchesPattern("app_*", "APP_DB_URL"));
+#else
+  EXPECT_FALSE(EnvNameMatchesPattern("path", "PATH"));
+  EXPECT_FALSE(EnvNameMatchesPattern("app_*", "APP_DB_URL"));
+#endif
+}
+
+TEST(EnvPermissionTest, IntersectEnvAllowLists) {
+  using List = std::vector<std::string>;
+  EXPECT_EQ(IntersectEnvAllowLists(List{"*"}, List{"A", "B_*"}),
+            (List{"A", "B_*"}));
+  EXPECT_EQ(IntersectEnvAllowLists(List{"A", "B"}, List{"*"}),
+            (List{"A", "B"}));
+  EXPECT_EQ(IntersectEnvAllowLists(List{"A", "B"}, List{"B", "C"}),
+            (List{"B"}));
+  EXPECT_EQ(IntersectEnvAllowLists(List{"APP_*"}, List{"APP_DB*", "OTHER"}),
+            (List{"APP_DB*"}));
+  EXPECT_EQ(IntersectEnvAllowLists(List{"APP_DB_URL"}, List{"APP_*"}),
+            (List{"APP_DB_URL"}));
+  EXPECT_EQ(IntersectEnvAllowLists(List{"APP_*"}, List{"OTHER_*"}), List{});
+  EXPECT_EQ(IntersectEnvAllowLists(List{}, List{"*"}), List{});
+}
+
+TEST(EnvPermissionTest, RuntimeEnvironmentDefaults) {
+  EXPECT_TRUE(IsRuntimeEnvironmentDefault("NODE_OPTIONS"));
+  EXPECT_TRUE(IsRuntimeEnvironmentDefault("TZ"));
+  EXPECT_TRUE(IsRuntimeEnvironmentDefault("LC_ALL"));
+  EXPECT_FALSE(IsRuntimeEnvironmentDefault("NODE_AUTH_TOKEN"));
+  EXPECT_FALSE(IsRuntimeEnvironmentDefault("HTTP_PROXY"));
+  EXPECT_EQ(node::GetRuntimeEnvironmentDefaults().size(),
+            GetRuntimeEnvironmentDefaults().size());
+}
+
+class EnvPermissionScrubTest : public NodeZeroIsolateTestFixture {};
+
+TEST_F(EnvPermissionScrubTest, ScrubProcessEnvironmentAfterInitialization) {
+  // The fixture has already initialized Node.js, so modifying the process
+  // environment is no longer safe.
+  EXPECT_TRUE(node::ScrubProcessEnvironment({}).IsNothing());
+}
diff --git a/test/embedding/embedtest.cc b/test/embedding/embedtest.cc
index 8f94e6e910cb..760406f09182 100644
--- a/test/embedding/embedtest.cc
+++ b/test/embedding/embedtest.cc
@@ -100,6 +100,28 @@ NODE_MAIN(int argc, node::argv_type raw_argv[]) {
     args.erase(it);
     flags |= node::ProcessInitializationFlags::kNoHarvestBuiltinCodeCache;
   }
+  // --embedder-scrub-env=<names>: remove the environment variables other than
+  // the comma-separated <names> before initializing Node.js.
+  static constexpr std::string_view kScrubEnvFlag = "--embedder-scrub-env=";
+  it = std::find_if(args.begin(), args.end(), [](const std::string& arg) {
+    return arg.starts_with(kScrubEnvFlag);
+  });
+  if (it != args.end()) {
+    node::ProcessEnvironmentScrubOptions scrub_options;
+    const std::string names = it->substr(kScrubEnvFlag.size());
+    for (size_t begin = 0; begin < names.size();) {
+      size_t end = names.find(',', begin);
+      if (end == std::string::npos) end = names.size();
+      scrub_options.allow.push_back(names.substr(begin, end - begin));
+      begin = end + 1;
+    }
+    args.erase(it);
+    if (node::ScrubProcessEnvironment(scrub_options).IsNothing()) {
+      fprintf(
+          stderr, "%s: ScrubProcessEnvironment() failed\n", args[0].c_str());
+      return 1;
+    }
+  }
   std::shared_ptr<node::InitializationResult> result =
       node::InitializeOncePerProcess(
           args, static_cast<node::ProcessInitializationFlags::Flags>(flags));
diff --git a/test/embedding/test-embedding-permission-env.js b/test/embedding/test-embedding-permission-env.js
new file mode 100644
index 000000000000..8654cea2b9a2
--- /dev/null
+++ b/test/embedding/test-embedding-permission-env.js
@@ -0,0 +1,75 @@
+'use strict';
+
+// Tests node::ScrubProcessEnvironment(), and that embedders that enable the
+// permission model must remove the environment variables --allow-env does not
+// grant access to before node::InitializeOncePerProcess().
+
+const common = require('../common');
+const { spawnSyncAndAssert, spawnSyncAndExit } = require('../common/child_process');
+
+const embedtest = common.resolveBuiltBinary('embedtest');
+
+const env = {
+  ...process.env,
+  PERMISSION_ENV_SECRET: 'secret',
+  PERMISSION_ENV_ALLOWED: 'allowed',
+};
+
+const script = 'console.log(JSON.stringify([' +
+  'process.env.PERMISSION_ENV_SECRET, process.env.PERMISSION_ENV_ALLOWED]))';
+
+const permissionFlags = [
+  '--permission',
+  '--allow-fs-read=*',
+  '--allow-env=PERMISSION_ENV_ALLOWED',
+];
+
+// Initialization fails while the environment contains denied variables.
+// The child's environment is not fully under the test's control: macOS adds
+// __CF_USER_TEXT_ENCODING to it, so the message may list more than the
+// variables set here.
+spawnSyncAndExit(
+  embedtest,
+  [...permissionFlags, script],
+  {
+    env: {
+      PERMISSION_ENV_SECRET: 'secret',
+      PERMISSION_ENV_ALLOWED: 'allowed',
+    },
+  },
+  {
+    status: 9,
+    signal: null,
+    stderr: /The process environment contains variables that --allow-env does not grant access to \([^)]*\bPERMISSION_ENV_SECRET\b[^)]*\)\. Remove them with node::ScrubProcessEnvironment\(\) before calling node::InitializeOncePerProcess\(\)\./,
+  });
+
+// It succeeds once they have been removed.
+spawnSyncAndAssert(
+  embedtest,
+  ['--embedder-scrub-env=PERMISSION_ENV_ALLOWED', ...permissionFlags, script],
+  { env },
+  {
+    trim: true,
+    stdout: '[null,"allowed"]',
+  });
+
+// With --allow-env=*, nothing needs to be removed.
+spawnSyncAndAssert(
+  embedtest,
+  ['--permission', '--allow-fs-read=*', '--allow-env=*', script],
+  { env },
+  {
+    trim: true,
+    stdout: '["secret","allowed"]',
+  });
+
+// ScrubProcessEnvironment() rejects invalid patterns.
+spawnSyncAndExit(
+  embedtest,
+  ['--embedder-scrub-env=PERMISSION_*_ENV', script],
+  { env },
+  {
+    status: 1,
+    signal: null,
+    stderr: /ScrubProcessEnvironment\(\) failed/,
+  });
diff --git a/test/parallel/test-fs-readdir-recursive-permission.js b/test/parallel/test-fs-readdir-recursive-permission.js
index b44454a213ce..e877a4311e1b 100644
--- a/test/parallel/test-fs-readdir-recursive-permission.js
+++ b/test/parallel/test-fs-readdir-recursive-permission.js
@@ -28,6 +28,7 @@ assert(expected.includes(path.join('a', 'b', '2')));
 
 const { status, stderr } = spawnSync(process.execPath, [
   '--permission',
+  '--allow-env=ALLOWED,BLOCKED,EXPECTED',
   `--allow-fs-read=${allowed}`,
   '-e',
   `
diff --git a/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js b/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js
index f2d98a0b6f83..602a661a32a3 100644
--- a/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js
+++ b/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js
@@ -48,7 +48,7 @@ function run(flag, { op, name }) {
   };
   const { status, stdout, stderr } = spawnSync(
     process.execPath,
-    [flag, '-e', childScript],
+    [flag, '--allow-env=BLOCKED_FILE,LINK_PATH', '-e', childScript],
     { encoding: 'utf8', env },
   );
   assert.strictEqual(status, 0, stderr);
diff --git a/test/parallel/test-permission-env-child-process.js b/test/parallel/test-permission-env-child-process.js
new file mode 100644
index 000000000000..fae79e2415da
--- /dev/null
+++ b/test/parallel/test-permission-env-child-process.js
@@ -0,0 +1,77 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+if (process.config.variables.node_without_node_options) {
+  common.skip('missing NODE_OPTIONS support');
+}
+
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+const env = {
+  ...process.env,
+  PERMISSION_ENV_SECRET: 'secret',
+  PERMISSION_ENV_ALLOWED: 'allowed',
+};
+
+// The environment of a child spawned by a process that enforces the
+// permission model already reflects --allow-env, so the child gets access to
+// all of it: including variables the parent added, and ones added for the
+// child only. It still cannot see what the parent removed.
+spawnSyncAndAssert(
+  process.execPath,
+  [
+    '--permission', '--allow-child-process', '--no-warnings',
+    '--allow-env=PERMISSION_ENV_ALLOWED', '-e',
+    `
+    const assert = require('assert');
+    const { spawnSync } = require('child_process');
+    process.env.PERMISSION_ENV_RUNTIME = 'runtime';
+    const { status, stdout, stderr } = spawnSync(process.execPath, [
+      '--no-warnings', '-p',
+      'JSON.stringify([' +
+        'process.env.PERMISSION_ENV_ALLOWED, ' +
+        'process.env.PERMISSION_ENV_RUNTIME, ' +
+        'process.env.PERMISSION_ENV_CHILD, ' +
+        'process.env.PERMISSION_ENV_SECRET, ' +
+        'process.permission.has("env")])',
+    ], {
+      env: { ...process.env, PERMISSION_ENV_CHILD: 'child' },
+    });
+    assert.strictEqual(status, 0, stderr.toString());
+    assert.deepStrictEqual(
+      JSON.parse(stdout),
+      ['allowed', 'runtime', 'child', null, true]);
+    `,
+  ],
+  { env },
+  {});
+
+// In audit mode nothing was removed, so children audit the same policy.
+spawnSyncAndAssert(
+  process.execPath,
+  [
+    '--permission-audit', '--allow-child-process', '--no-warnings',
+    '--allow-env=PERMISSION_ENV_ALLOWED', '-e',
+    `
+    const assert = require('assert');
+    const { spawnSync } = require('child_process');
+    const { status, stdout, stderr } = spawnSync(process.execPath, [
+      '--no-warnings', '-p',
+      'JSON.stringify([' +
+        'process.permission.has("env"), ' +
+        'process.permission.has("env", "PERMISSION_ENV_ALLOWED"), ' +
+        'process.permission.has("env", "PERMISSION_ENV_SECRET"), ' +
+        'process.env.PERMISSION_ENV_SECRET])',
+    ]);
+    assert.strictEqual(status, 0, stderr.toString());
+    assert.deepStrictEqual(JSON.parse(stdout), [false, true, false, 'secret']);
+    `,
+  ],
+  { env },
+  {});
diff --git a/test/parallel/test-permission-env-cli.js b/test/parallel/test-permission-env-cli.js
new file mode 100644
index 000000000000..fbdeba0e0092
--- /dev/null
+++ b/test/parallel/test-permission-env-cli.js
@@ -0,0 +1,41 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+const assert = require('assert');
+const { spawnSyncAndAssert, spawnSyncAndExit } = require('../common/child_process');
+
+for (const value of ['A*B', '*A', 'A=B', 'A,B*C']) {
+  spawnSyncAndExit(
+    process.execPath,
+    ['--permission', `--allow-env=${value}`, '-e', ''],
+    {
+      status: 9,
+      signal: null,
+      stderr: /--allow-env must be '\*', a variable name, or a variable name prefix followed by '\*'/,
+    });
+}
+
+// --allow-env is accepted in NODE_OPTIONS.
+if (!process.config.variables.node_without_node_options) {
+  spawnSyncAndAssert(
+    process.execPath,
+    ['--permission', '-p', 'process.env.PERMISSION_ENV_ALLOWED'],
+    {
+      env: {
+        ...process.env,
+        NODE_OPTIONS: '--allow-env=PERMISSION_ENV_ALLOWED',
+        PERMISSION_ENV_ALLOWED: 'allowed',
+      },
+    },
+    {
+      stdout(output) {
+        assert.strictEqual(output.trim(), 'allowed');
+      },
+    });
+}
diff --git a/test/parallel/test-permission-env-config-file.js b/test/parallel/test-permission-env-config-file.js
new file mode 100644
index 000000000000..21a1f4d61260
--- /dev/null
+++ b/test/parallel/test-permission-env-config-file.js
@@ -0,0 +1,99 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+tmpdir.refresh();
+
+function writeConfig(name, allowEnv) {
+  const path = tmpdir.resolve(name);
+  fs.writeFileSync(path, JSON.stringify({ permission: { 'allow-env': allowEnv } }));
+  return path;
+}
+
+const bothConfig = writeConfig('both.json', ['PERMISSION_ENV_A', 'PERMISSION_ENV_B']);
+const allConfig = writeConfig('all.json', ['*']);
+const prefixConfig = writeConfig('prefix.json', ['PERMISSION_ENV_PREFIX_DB*']);
+
+const envFile = tmpdir.resolve('options.env');
+fs.writeFileSync(envFile, 'NODE_OPTIONS="--allow-env=*"\n');
+
+const env = {
+  ...process.env,
+  PERMISSION_ENV_A: 'a',
+  PERMISSION_ENV_B: 'b',
+  PERMISSION_ENV_PREFIX_DB_URL: 'db',
+  PERMISSION_ENV_PREFIX_OTHER: 'other',
+};
+
+function visible(flags, extraEnv = {}) {
+  let result;
+  spawnSyncAndAssert(
+    process.execPath,
+    [
+      ...flags, '--no-warnings', '-p',
+      'JSON.stringify(Object.keys(process.env).filter((name) => name.startsWith("PERMISSION_ENV_")).sort())',
+    ],
+    { env: { ...env, ...extraEnv } },
+    {
+      stdout(output) {
+        result = JSON.parse(output);
+      },
+    });
+  return result;
+}
+
+// When the command line enables the permission model, --allow-env values from
+// the configuration file can only narrow what the command line grants.
+assert.deepStrictEqual(
+  visible([
+    '--permission',
+    '--allow-env=PERMISSION_ENV_A',
+    `--experimental-config-file=${bothConfig}`,
+  ]),
+  ['PERMISSION_ENV_A']);
+
+assert.deepStrictEqual(
+  visible(['--permission', `--experimental-config-file=${allConfig}`]),
+  []);
+
+assert.deepStrictEqual(
+  visible([
+    '--permission',
+    '--allow-env=PERMISSION_ENV_PREFIX_*',
+    `--experimental-config-file=${prefixConfig}`,
+  ]),
+  ['PERMISSION_ENV_PREFIX_DB_URL']);
+
+// The same applies to NODE_OPTIONS defined in an env file.
+assert.deepStrictEqual(
+  visible([
+    '--permission',
+    '--allow-env=PERMISSION_ENV_A',
+    `--env-file=${envFile}`,
+  ]),
+  ['PERMISSION_ENV_A']);
+
+// When only the configuration file enables the permission model, its
+// --allow-env values apply.
+assert.deepStrictEqual(
+  visible([`--experimental-config-file=${bothConfig}`]),
+  ['PERMISSION_ENV_A', 'PERMISSION_ENV_B']);
+
+// The NODE_OPTIONS environment variable is not a file, and can grant access.
+if (!process.config.variables.node_without_node_options) {
+  assert.deepStrictEqual(
+    visible(
+      ['--permission', '--allow-env=PERMISSION_ENV_A'],
+      { NODE_OPTIONS: '--allow-env=PERMISSION_ENV_B' }),
+    ['PERMISSION_ENV_A', 'PERMISSION_ENV_B']);
+}
diff --git a/test/parallel/test-permission-env-drop.js b/test/parallel/test-permission-env-drop.js
new file mode 100644
index 000000000000..652513231e0c
--- /dev/null
+++ b/test/parallel/test-permission-env-drop.js
@@ -0,0 +1,70 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+const env = {
+  ...process.env,
+  PERMISSION_ENV_ONE: 'one',
+  PERMISSION_ENV_TWO: 'two',
+  TZ: 'UTC',
+};
+
+// Dropping a variable removes it from the environment.
+spawnSyncAndAssert(
+  process.execPath,
+  [
+    '--permission', '--allow-env=PERMISSION_ENV_ONE,PERMISSION_ENV_TWO', '-e',
+    `
+    const assert = require('assert');
+    const dc = require('diagnostics_channel');
+    const drops = [];
+    dc.subscribe('node:permission-model:env', (message) => {
+      if (message.drop) drops.push(message.resource);
+    });
+
+    assert.strictEqual(process.permission.has('env', 'PERMISSION_ENV_ONE'), true);
+    process.permission.drop('env', 'PERMISSION_ENV_ONE');
+    assert.strictEqual(process.permission.has('env', 'PERMISSION_ENV_ONE'), false);
+    assert.strictEqual(process.env.PERMISSION_ENV_ONE, undefined);
+    assert.strictEqual(process.permission.has('env', 'PERMISSION_ENV_TWO'), true);
+    assert.strictEqual(process.env.PERMISSION_ENV_TWO, 'two');
+
+    // Dropping the whole scope removes everything except the variables
+    // Node.js reads itself.
+    process.permission.drop('env');
+    assert.strictEqual(process.permission.has('env', 'PERMISSION_ENV_TWO'), false);
+    assert.strictEqual(process.env.PERMISSION_ENV_TWO, undefined);
+    assert.strictEqual(process.permission.has('env', 'TZ'), true);
+    assert.strictEqual(process.env.TZ, 'UTC');
+
+    assert.deepStrictEqual(drops, ['PERMISSION_ENV_ONE', '']);
+    `,
+  ],
+  { env },
+  {});
+
+// Dropping a variable when every variable is accessible.
+spawnSyncAndAssert(
+  process.execPath,
+  [
+    '--permission', '--allow-env=*', '-e',
+    `
+    const assert = require('assert');
+    assert.strictEqual(process.permission.has('env'), true);
+    process.permission.drop('env', 'PERMISSION_ENV_ONE');
+    assert.strictEqual(process.permission.has('env'), false);
+    assert.strictEqual(process.permission.has('env', 'PERMISSION_ENV_ONE'), false);
+    assert.strictEqual(process.env.PERMISSION_ENV_ONE, undefined);
+    assert.strictEqual(process.permission.has('env', 'PERMISSION_ENV_TWO'), true);
+    assert.strictEqual(process.env.PERMISSION_ENV_TWO, 'two');
+    `,
+  ],
+  { env },
+  {});
diff --git a/test/parallel/test-permission-env-file.js b/test/parallel/test-permission-env-file.js
new file mode 100644
index 000000000000..67513289db68
--- /dev/null
+++ b/test/parallel/test-permission-env-file.js
@@ -0,0 +1,71 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+tmpdir.refresh();
+
+const envFile = tmpdir.resolve('permission.env');
+fs.writeFileSync(
+  envFile,
+  'PERMISSION_ENV_FROM_FILE=file\nPERMISSION_ENV_BOTH=file\n');
+
+const env = {
+  ...process.env,
+  PERMISSION_ENV_BOTH: 'inherited',
+};
+
+const script = `console.log(JSON.stringify({
+  fromFile: process.env.PERMISSION_ENV_FROM_FILE,
+  both: process.env.PERMISSION_ENV_BOTH,
+  has: [
+    process.permission.has('env', 'PERMISSION_ENV_FROM_FILE'),
+    process.permission.has('env', 'PERMISSION_ENV_BOTH'),
+  ],
+}))`;
+
+// Variables defined in an env file are allowed. Only the file's values are
+// visible: an inherited value for the same name was removed at startup.
+spawnSyncAndAssert(
+  process.execPath,
+  ['--permission', `--env-file=${envFile}`, '-e', script],
+  { env },
+  {
+    stdout(output) {
+      assert.deepStrictEqual(JSON.parse(output), {
+        fromFile: 'file',
+        both: 'file',
+        has: [true, true],
+      });
+    },
+  });
+
+// A name that --allow-env grants access to keeps the usual precedence of the
+// inherited value over the file's.
+spawnSyncAndAssert(
+  process.execPath,
+  [
+    '--permission',
+    '--allow-env=PERMISSION_ENV_BOTH',
+    `--env-file=${envFile}`,
+    '-e', script,
+  ],
+  { env },
+  {
+    stdout(output) {
+      assert.deepStrictEqual(JSON.parse(output), {
+        fromFile: 'file',
+        both: 'inherited',
+        has: [true, true],
+      });
+    },
+  });
diff --git a/test/parallel/test-permission-env-proc-environ.js b/test/parallel/test-permission-env-proc-environ.js
new file mode 100644
index 000000000000..91b04c0886a1
--- /dev/null
+++ b/test/parallel/test-permission-env-proc-environ.js
@@ -0,0 +1,84 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+if (!common.isLinux) {
+  common.skip('/proc/<pid>/environ is specific to Linux');
+}
+
+const assert = require('assert');
+const fs = require('fs');
+const { spawn } = require('child_process');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+const env = {
+  ...process.env,
+  PERMISSION_ENV_SECRET: 'secret-value',
+  PERMISSION_ENV_ALLOWED: 'allowed-value',
+};
+
+// /proc/<pid>/environ exposes the environment a process started with, so
+// reading it is denied while the env scope is restricted, even when the file
+// system scope would allow it.
+spawnSyncAndAssert(
+  process.execPath,
+  [
+    '--permission', '--allow-fs-read=*', '-e',
+    `
+    const assert = require('assert');
+    const fs = require('fs');
+    for (const path of [
+      '/proc/self/environ',
+      '/proc/thread-self/environ',
+      '/proc/' + process.pid + '/environ',
+      '/proc/' + process.ppid + '/environ',
+    ]) {
+      assert.throws(() => fs.readFileSync(path), {
+        code: 'ERR_ACCESS_DENIED',
+        permission: 'FileSystemRead',
+        resource: path,
+      });
+    }
+    `,
+  ],
+  { env },
+  {});
+
+// Reading it is allowed when every variable is accessible.
+spawnSyncAndAssert(
+  process.execPath,
+  [
+    '--permission', '--allow-fs-read=*', '--allow-env=*', '-e',
+    'require("fs").readFileSync("/proc/self/environ")',
+  ],
+  { env },
+  {});
+
+// Other processes do not find the removed variables there either, because
+// they are overwritten in the initial environment block.
+{
+  const child = spawn(
+    process.execPath,
+    [
+      '--permission', '--allow-env=PERMISSION_ENV_ALLOWED', '-e',
+      'console.log("ready"); process.stdin.once("data", () => {});',
+    ],
+    { env, stdio: ['pipe', 'pipe', 'inherit'] });
+
+  child.stdout.once('data', common.mustCall(() => {
+    const environ = fs.readFileSync(`/proc/${child.pid}/environ`, 'latin1');
+    assert.doesNotMatch(environ, /PERMISSION_ENV_SECRET|secret-value/);
+    assert.match(environ, /PERMISSION_ENV_ALLOWED=allowed-value/);
+    child.stdin.end('done');
+  }));
+
+  child.on('exit', common.mustCall((code, signal) => {
+    assert.strictEqual(code, 0);
+    assert.strictEqual(signal, null);
+  }));
+}
diff --git a/test/parallel/test-permission-env-scrub.js b/test/parallel/test-permission-env-scrub.js
new file mode 100644
index 000000000000..c5d86a87f7a7
--- /dev/null
+++ b/test/parallel/test-permission-env-scrub.js
@@ -0,0 +1,164 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+const assert = require('assert');
+const { spawnSyncAndAssert, spawnSyncAndExit } = require('../common/child_process');
+
+const names = [
+  'PERMISSION_ENV_SECRET',
+  'PERMISSION_ENV_ALLOWED',
+  'PERMISSION_ENV_PREFIX_ONE',
+  'PERMISSION_ENV_PREFIX_TWO',
+  // Starts with NODE_, but is not one of the variables Node.js reads.
+  'NODE_AUTH_TOKEN',
+  // Read by Node.js itself, so it is kept.
+  'TZ',
+];
+
+const env = {
+  ...process.env,
+  PERMISSION_ENV_SECRET: 'secret',
+  PERMISSION_ENV_ALLOWED: 'allowed',
+  PERMISSION_ENV_PREFIX_ONE: 'one',
+  PERMISSION_ENV_PREFIX_TWO: 'two',
+  NODE_AUTH_TOKEN: 'token',
+  TZ: 'UTC',
+};
+
+const script = `
+  const names = ${JSON.stringify(names)};
+  const { environmentVariables } = process.report.getReport();
+  console.log(JSON.stringify({
+    values: Object.fromEntries(names.map((name) => [name, process.env[name]])),
+    keys: names.filter((name) => Object.keys(process.env).includes(name)),
+    report: names.filter((name) => name in environmentVariables),
+    has: process.permission &&
+      Object.fromEntries(names.map((name) => [name, process.permission.has('env', name)])),
+    hasAll: process.permission?.has('env'),
+  }));
+`;
+
+function run(...flags) {
+  let result;
+  spawnSyncAndAssert(
+    process.execPath,
+    [...flags, '--no-warnings', '-e', script],
+    { env },
+    {
+      stdout(output) {
+        result = JSON.parse(output);
+      },
+    });
+  return result;
+}
+
+// Variables --allow-env does not grant access to are removed at startup.
+{
+  const result = run(
+    '--permission',
+    '--allow-env=PERMISSION_ENV_ALLOWED,PERMISSION_ENV_PREFIX_*');
+  const visible = [
+    'PERMISSION_ENV_ALLOWED',
+    'PERMISSION_ENV_PREFIX_ONE',
+    'PERMISSION_ENV_PREFIX_TWO',
+    'TZ',
+  ];
+  assert.deepStrictEqual(result.values, {
+    PERMISSION_ENV_ALLOWED: 'allowed',
+    PERMISSION_ENV_PREFIX_ONE: 'one',
+    PERMISSION_ENV_PREFIX_TWO: 'two',
+    TZ: 'UTC',
+  });
+  assert.deepStrictEqual(result.keys, visible);
+  assert.deepStrictEqual(result.report, visible);
+  assert.deepStrictEqual(result.has, {
+    PERMISSION_ENV_SECRET: false,
+    PERMISSION_ENV_ALLOWED: true,
+    PERMISSION_ENV_PREFIX_ONE: true,
+    PERMISSION_ENV_PREFIX_TWO: true,
+    NODE_AUTH_TOKEN: false,
+    TZ: true,
+  });
+  assert.strictEqual(result.hasAll, false);
+}
+
+// --allow-env can be given more than once.
+{
+  const result = run(
+    '--permission',
+    '--allow-env=PERMISSION_ENV_ALLOWED',
+    '--allow-env=PERMISSION_ENV_PREFIX_ONE');
+  assert.deepStrictEqual(result.keys, [
+    'PERMISSION_ENV_ALLOWED',
+    'PERMISSION_ENV_PREFIX_ONE',
+    'TZ',
+  ]);
+}
+
+// Without --allow-env, only the variables Node.js reads itself are kept.
+{
+  const result = run('--permission');
+  assert.deepStrictEqual(result.keys, ['TZ']);
+  assert.strictEqual(result.hasAll, false);
+}
+
+// --allow-env=* grants access to every variable.
+{
+  const result = run('--permission', '--allow-env=*');
+  assert.deepStrictEqual(result.keys, names);
+  assert.deepStrictEqual(result.report, names);
+  assert.strictEqual(result.hasAll, true);
+}
+
+// Audit mode does not remove anything.
+{
+  const result = run('--permission-audit', '--allow-env=PERMISSION_ENV_ALLOWED');
+  assert.deepStrictEqual(result.keys, names);
+  assert.strictEqual(result.has.PERMISSION_ENV_SECRET, false);
+  assert.strictEqual(result.has.PERMISSION_ENV_ALLOWED, true);
+  assert.strictEqual(result.hasAll, false);
+}
+
+// --allow-env requires the permission model.
+spawnSyncAndExit(
+  process.execPath,
+  ['--allow-env=PERMISSION_ENV_ALLOWED', '-e', ''],
+  { env },
+  {
+    status: 1,
+    signal: null,
+    stderr: /ERR_MISSING_OPTION.*--permission is required|--permission is required/,
+  });
+
+// Workers see the removed variables as absent, whether they share the
+// environment or copy it.
+spawnSyncAndAssert(
+  process.execPath,
+  [
+    '--permission', '--allow-worker', '--no-warnings', '-e',
+    `
+    const assert = require('assert');
+    const { Worker, SHARE_ENV } = require('worker_threads');
+    for (const workerEnv of [SHARE_ENV, undefined]) {
+      new Worker(
+        'require("worker_threads").parentPort.postMessage(process.env.PERMISSION_ENV_SECRET)',
+        { eval: true, env: workerEnv },
+      ).on('message', (value) => assert.strictEqual(value, undefined));
+    }
+    `,
+  ],
+  { env },
+  {});
+
+// Environment variable names are case-insensitive on Windows.
+if (common.isWindows) {
+  const result = run('--permission', '--allow-env=permission_env_allowed');
+  assert.deepStrictEqual(result.keys, ['PERMISSION_ENV_ALLOWED', 'TZ']);
+  assert.strictEqual(result.has.PERMISSION_ENV_ALLOWED, true);
+}
diff --git a/test/parallel/test-permission-env-warning.js b/test/parallel/test-permission-env-warning.js
new file mode 100644
index 000000000000..dfbf6fe0d0a4
--- /dev/null
+++ b/test/parallel/test-permission-env-warning.js
@@ -0,0 +1,95 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+const assert = require('assert');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+const env = {
+  ...process.env,
+  PERMISSION_ENV_SECRET: 'secret',
+};
+
+// Reading a variable that was removed at startup publishes a denial every
+// time, and warns once.
+spawnSyncAndAssert(
+  process.execPath,
+  [
+    '--permission', '-e',
+    `
+    const assert = require('assert');
+    const dc = require('diagnostics_channel');
+    const events = [];
+    dc.subscribe('node:permission-model:env', (message) => {
+      events.push([message.permission, message.resource]);
+    });
+
+    assert.strictEqual(process.env.PERMISSION_ENV_SECRET, undefined);
+    assert.strictEqual(process.env.PERMISSION_ENV_SECRET, undefined);
+    assert.strictEqual('PERMISSION_ENV_SECRET' in process.env, false);
+    // Variables that were never set are not reported.
+    assert.strictEqual(process.env.PERMISSION_ENV_NEVER_SET, undefined);
+
+    assert.deepStrictEqual(events, [
+      ['Env', 'PERMISSION_ENV_SECRET'],
+      ['Env', 'PERMISSION_ENV_SECRET'],
+      ['Env', 'PERMISSION_ENV_SECRET'],
+    ]);
+    `,
+  ],
+  { env },
+  {
+    stderr(output) {
+      const warnings = output.match(
+        /Warning: The permission model removed the environment variable "PERMISSION_ENV_SECRET" at startup\. Use --allow-env to manage permissions\./g);
+      assert.strictEqual(warnings?.length, 1, output);
+      assert.doesNotMatch(output, /PERMISSION_ENV_NEVER_SET/);
+    },
+  });
+
+// --no-warnings silences the warning.
+spawnSyncAndAssert(
+  process.execPath,
+  ['--permission', '--no-warnings', '-e', 'process.env.PERMISSION_ENV_SECRET'],
+  { env },
+  { stderr: '' });
+
+// In audit mode nothing is removed. Accesses to variables that --allow-env
+// does not grant access to are published instead, without a warning.
+spawnSyncAndAssert(
+  process.execPath,
+  [
+    '--permission-audit', '--allow-env=PERMISSION_ENV_ALLOWED', '-e',
+    `
+    const assert = require('assert');
+    const dc = require('diagnostics_channel');
+    const events = [];
+    dc.subscribe('node:permission-model:env', (message) => {
+      events.push(message.resource);
+    });
+
+    assert.strictEqual(process.env.PERMISSION_ENV_SECRET, 'secret');
+    assert.strictEqual('PERMISSION_ENV_SECRET' in process.env, true);
+    assert.strictEqual(process.env.PERMISSION_ENV_ALLOWED, 'allowed');
+    process.env.TZ;
+    // Variables created at runtime would not have been removed either.
+    process.env.PERMISSION_ENV_RUNTIME = 'runtime';
+    assert.strictEqual(process.env.PERMISSION_ENV_RUNTIME, 'runtime');
+
+    assert.deepStrictEqual(events, [
+      'PERMISSION_ENV_SECRET',
+      'PERMISSION_ENV_SECRET',
+    ]);
+    `,
+  ],
+  { env: { ...env, PERMISSION_ENV_ALLOWED: 'allowed' } },
+  {
+    stderr(output) {
+      assert.doesNotMatch(output, /removed the environment variable/);
+    },
+  });
diff --git a/test/parallel/test-permission-fs-read.js b/test/parallel/test-permission-fs-read.js
index d36776b9496c..6261fe24020d 100644
--- a/test/parallel/test-permission-fs-read.js
+++ b/test/parallel/test-permission-fs-read.js
@@ -1,4 +1,4 @@
-// Flags: --permission --allow-fs-read=* --allow-fs-write=* --allow-child-process
+// Flags: --permission --allow-fs-read=* --allow-fs-write=* --allow-child-process --allow-env=NODE_TEST_DIR,TEST_*
 'use strict';
 
 const common = require('../common');
@@ -43,6 +43,7 @@ const commonPath = path.join(__filename, '../../common');
     process.execPath,
     [
       '--permission',
+      '--allow-env=BOUNDARY_FILE',
       ...grantedFiles.map((file) => `--allow-fs-read=${file}`),
       ...grantedFiles.map((file) => `--allow-fs-write=${file}`),
       '-e',
@@ -79,6 +80,7 @@ const commonPath = path.join(__filename, '../../common');
     process.execPath,
     [
       '--permission',
+      '--allow-env=BLOCKEDFILE,BLOCKEDFOLDER,ALLOWEDFOLDER',
       // Do not uncomment this line
       // `--allow-fs-read=${file}`,
       `--allow-fs-read=${commonPathWildcard}`,
diff --git a/test/parallel/test-permission-fs-symlink-target-write.js b/test/parallel/test-permission-fs-symlink-target-write.js
index 1cffead4dd7e..0df7a20b28e9 100644
--- a/test/parallel/test-permission-fs-symlink-target-write.js
+++ b/test/parallel/test-permission-fs-symlink-target-write.js
@@ -1,4 +1,4 @@
-// Flags: --permission --allow-fs-read=* --allow-fs-write=* --allow-child-process
+// Flags: --permission --allow-fs-read=* --allow-fs-write=* --allow-child-process --allow-env=NODE_TEST_DIR,TEST_*
 'use strict';
 
 const common = require('../common');
@@ -42,6 +42,7 @@ fs.writeFileSync(path.join(readWriteFolder, 'file'), 'NO evil file contents');
     process.execPath,
     [
       '--permission',
+      '--allow-env=READONLYFOLDER,READWRITEFOLDER,WRITEONLYFOLDER',
       `--allow-fs-read=${file}`, `--allow-fs-read=${commonPathWildcard}`, `--allow-fs-read=${readOnlyFolder}`, `--allow-fs-read=${readWriteFolder}`,
       `--allow-fs-write=${readWriteFolder}`, `--allow-fs-write=${writeOnlyFolder}`,
       file,
diff --git a/test/parallel/test-permission-fs-symlink.js b/test/parallel/test-permission-fs-symlink.js
index d918e4ea0fef..c8d6afe89ba3 100644
--- a/test/parallel/test-permission-fs-symlink.js
+++ b/test/parallel/test-permission-fs-symlink.js
@@ -1,4 +1,4 @@
-// Flags: --permission --allow-fs-read=* --allow-fs-write=* --allow-child-process
+// Flags: --permission --allow-fs-read=* --allow-fs-write=* --allow-child-process --allow-env=NODE_TEST_DIR,TEST_*
 'use strict';
 
 const common = require('../common');
@@ -54,6 +54,7 @@ const traversalSymlink = path.join(allowedFolder, 'deep1', 'deep2', 'deep3', 'go
     process.execPath,
     [
       '--permission',
+      '--allow-env=BLOCKEDFILE,BLOCKEDFOLDER,EXISTINGSYMLINK',
       `--allow-fs-read=${file}`, `--allow-fs-read=${commonPathWildcard}`, `--allow-fs-read=${symlinkFromBlockedFile}`,
       `--allow-fs-read=${allowedFolder}`,
       `--allow-fs-write=${symlinkFromBlockedFile}`,
diff --git a/test/parallel/test-permission-fs-traversal-path.js b/test/parallel/test-permission-fs-traversal-path.js
index ed9e434b6b86..4c502359a537 100644
--- a/test/parallel/test-permission-fs-traversal-path.js
+++ b/test/parallel/test-permission-fs-traversal-path.js
@@ -1,4 +1,4 @@
-// Flags: --permission --allow-fs-read=* --allow-fs-write=* --allow-child-process
+// Flags: --permission --allow-fs-read=* --allow-fs-write=* --allow-child-process --allow-env=NODE_TEST_DIR,TEST_*
 'use strict';
 
 const common = require('../common');
@@ -38,6 +38,7 @@ const commonPathWildcard = path.join(__filename, '../../common*');
     process.execPath,
     [
       '--permission',
+      '--allow-env=ALLOWEDFOLDER,BLOCKEDFOLDER',
       `--allow-fs-read=${file}`, `--allow-fs-read=${commonPathWildcard}`, `--allow-fs-read=${allowedFolder}`,
       `--allow-fs-write=${allowedFolder}`,
       file,
diff --git a/test/parallel/test-permission-fs-write-report.js b/test/parallel/test-permission-fs-write-report.js
index 728bc4d34c85..7a726ce8e50a 100644
--- a/test/parallel/test-permission-fs-write-report.js
+++ b/test/parallel/test-permission-fs-write-report.js
@@ -15,7 +15,7 @@ if (!common.hasCrypto) {
 // We need to define the flags dynamically to account for the `NODE_TEST_DIR` env var.
 if (!process.permission) {
   spawnSyncAndExitWithoutError(process.execPath, [
-    '--permission',
+    '--permission', '--allow-env=NODE_TEST_DIR,TEST_*',
     '--allow-fs-read=*', `--allow-fs-write=${process.env.NODE_TEST_DIR || './test'}/.tmp.*`, '--allow-child-process',
     __filename,
   ]);
diff --git a/test/parallel/test-permission-fs-write.js b/test/parallel/test-permission-fs-write.js
index 385a37e2a92d..2269c5847ef6 100644
--- a/test/parallel/test-permission-fs-write.js
+++ b/test/parallel/test-permission-fs-write.js
@@ -1,4 +1,4 @@
-// Flags: --permission --allow-fs-read=* --allow-child-process
+// Flags: --permission --allow-fs-read=* --allow-child-process --allow-env=NODE_TEST_DIR,TEST_*
 'use strict';
 
 const common = require('../common');
@@ -31,6 +31,7 @@ const file = fixtures.path('permission', 'fs-write.js');
     process.execPath,
     [
       '--permission',
+      '--allow-env=ALLOWEDFILE,ALLOWEDFOLDER,BLOCKEDFILE,BLOCKEDFOLDER,RELATIVEBLOCKEDFILE,RELATIVEBLOCKEDFOLDER',
       '--allow-fs-read=*',
       `--allow-fs-write=${regularFile}`, `--allow-fs-write=${commonPath}`,
       file,
diff --git a/test/parallel/test-permission-has-reference-types.js b/test/parallel/test-permission-has-reference-types.js
index 8509046dc5ee..0f92aa2e579b 100644
--- a/test/parallel/test-permission-has-reference-types.js
+++ b/test/parallel/test-permission-has-reference-types.js
@@ -32,6 +32,7 @@ const { status, stderr } = spawnSync(
   process.execPath,
   [
     '--permission',
+    '--allow-env=ALLOWED_DIR,ALLOWED_FILE,DENIED_FILE',
     `--allow-fs-read=${allowedDir}`,
     fixtures.path('permission', 'has-reference-types.js'),
   ],
diff --git a/test/parallel/test-permission-net-fetch.js b/test/parallel/test-permission-net-fetch.js
index c943188aeb33..934681de5b0e 100644
--- a/test/parallel/test-permission-net-fetch.js
+++ b/test/parallel/test-permission-net-fetch.js
@@ -25,6 +25,7 @@ const server = http.createServer((req, res) => {
     process.execPath,
     [
       '--permission',
+      '--allow-env=URL',
       '--allow-fs-read=*',
       file,
     ],
diff --git a/test/parallel/test-permission-net-tcp.js b/test/parallel/test-permission-net-tcp.js
index fdc33366702b..5fcf490e652a 100644
--- a/test/parallel/test-permission-net-tcp.js
+++ b/test/parallel/test-permission-net-tcp.js
@@ -21,6 +21,7 @@ const server = net.createServer().listen(0, common.mustCall(() => {
     process.execPath,
     [
       '--permission',
+      '--allow-env=HOST,PORT',
       '--allow-fs-read=*',
       file,
     ],
diff --git a/test/parallel/test-permission-net-warning.js b/test/parallel/test-permission-net-warning.js
index 65fae2a1001b..1f5ab7ef5e6a 100644
--- a/test/parallel/test-permission-net-warning.js
+++ b/test/parallel/test-permission-net-warning.js
@@ -1,4 +1,4 @@
-// Flags: --permission --allow-net --allow-fs-read=*
+// Flags: --permission --allow-net --allow-fs-read=* --allow-env=*
 'use strict';
 
 const common = require('../common');
diff --git a/test/parallel/test-permission-openssl-store.js b/test/parallel/test-permission-openssl-store.js
index f97657051ca9..b1cfcdc49882 100644
--- a/test/parallel/test-permission-openssl-store.js
+++ b/test/parallel/test-permission-openssl-store.js
@@ -1,4 +1,4 @@
-// Flags: --permission --allow-fs-read=* --allow-fs-write=* --allow-openssl-store --allow-child-process
+// Flags: --permission --allow-fs-read=* --allow-fs-write=* --allow-openssl-store --allow-child-process --allow-env=NODE_TEST_DIR,TEST_*
 'use strict';
 
 const common = require('../common');