diff --git a/codersdk/deployment.go b/codersdk/deployment.go
index ebace3488709d..44f67c3895cbb 100644
--- a/codersdk/deployment.go
+++ b/codersdk/deployment.go
@@ -900,7 +900,7 @@ when required by your organization's security policy.`,
 			Name:        "OIDC Group Mapping",
 			Description: "A map of OIDC group IDs and the group in Coder it should map to. This is useful for when OIDC providers only return group IDs.",
 			Flag:        "oidc-group-mapping",
-			Env:         "OIDC_GROUP_MAPPING",
+			Env:         "CODER_OIDC_GROUP_MAPPING",
 			Default:     "{}",
 			Value:       &c.OIDC.GroupMapping,
 			Group:       &deploymentGroupOIDC,
diff --git a/codersdk/deployment_test.go b/codersdk/deployment_test.go
index 3d73734b1c0de..ea48c1fbddd22 100644
--- a/codersdk/deployment_test.go
+++ b/codersdk/deployment_test.go
@@ -1,6 +1,7 @@
 package codersdk_test
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -101,6 +102,12 @@ func TestDeploymentValues_HighlyConfigurable(t *testing.T) {
 			t.Errorf("Option %q is excluded but has an env name", opt.Name)
 		}
 
+		// Also check all env vars are prefixed with CODER_
+		const prefix = "CODER_"
+		if opt.Env != "" && !strings.HasPrefix(opt.Env, prefix) {
+			t.Errorf("Option %q has an env name (%q) that is not prefixed with %s", opt.Name, opt.Env, prefix)
+		}
+
 		delete(excludes, opt.Name)
 	}
 
diff --git a/docs/cli/server.md b/docs/cli/server.md
index e9c9e73bb68d7..accbcd7bb05d6 100644
--- a/docs/cli/server.md
+++ b/docs/cli/server.md
@@ -371,7 +371,7 @@ Change the OIDC default 'groups' claim field. By default, will be 'groups' if pr
 |             |                                        |
 | ----------- | -------------------------------------- |
 | Type        | <code>struct[map[string]string]</code> |
-| Environment | <code>$OIDC_GROUP_MAPPING</code>       |
+| Environment | <code>$CODER_OIDC_GROUP_MAPPING</code> |
 | Default     | <code>{}</code>                        |
 
 A map of OIDC group IDs and the group in Coder it should map to. This is useful for when OIDC providers only return group IDs.