diff --git a/cmd/restic/global.go b/cmd/restic/global.go
index 4c662d742..d333f9ee3 100644
--- a/cmd/restic/global.go
+++ b/cmd/restic/global.go
@@ -238,7 +238,11 @@ func Exitf(exitcode int, format string, args ...interface{}) {
 }
 
 // resolvePassword determines the password to be used for opening the repository.
-func resolvePassword(opts GlobalOptions, env string) (string, error) {
+func resolvePassword(opts GlobalOptions) (string, error) {
+	if opts.Password != "" {
+		return opts.Password, nil
+	}
+
 	if opts.PasswordFile != "" {
 		s, err := textfile.Read(opts.PasswordFile)
 		if os.IsNotExist(errors.Cause(err)) {
@@ -247,10 +251,6 @@ func resolvePassword(opts GlobalOptions, env string) (string, error) {
 		return strings.TrimSpace(string(s)), errors.Wrap(err, "Readfile")
 	}
 
-	if pwd := os.Getenv(env); pwd != "" {
-		return pwd, nil
-	}
-
 	return "", nil
 }
 
diff --git a/cmd/restic/main.go b/cmd/restic/main.go
index 3b3a62028..da66c7cc9 100644
--- a/cmd/restic/main.go
+++ b/cmd/restic/main.go
@@ -70,7 +70,7 @@ directories in an encrypted repository stored on different backends.
 		if c.Name() == "version" {
 			return nil
 		}
-		pwd, err := resolvePassword(globalOptions, "RESTIC_PASSWORD")
+		pwd, err := resolvePassword(globalOptions)
 		if err != nil {
 			fmt.Fprintf(os.Stderr, "Resolving password failed: %v\n", err)
 			Exit(1)
diff --git a/internal/ui/config/config.go b/internal/ui/config/config.go
index fab783d38..e5642d845 100644
--- a/internal/ui/config/config.go
+++ b/internal/ui/config/config.go
@@ -15,7 +15,8 @@ import (
 
 // Config contains configuration items read from a file.
 type Config struct {
-	Repo string `hcl:"repo" flag:"repo" env:"RESTIC_REPOSITORY"`
+	Repo     string `hcl:"repo" flag:"repo" env:"RESTIC_REPOSITORY"`
+	Password string `hcl:"password" env:"RESTIC_PASSWORD"`
 
 	Backends map[string]Backend `hcl:"backend"`
 	Backup   *Backup            `hcl:"backup"`