diff --git a/packages/12factor-env/src/index.ts b/packages/12factor-env/src/index.ts
index 465ef1708..6f196e0d5 100644
--- a/packages/12factor-env/src/index.ts
+++ b/packages/12factor-env/src/index.ts
@@ -143,7 +143,9 @@ const env = <S extends Specs, V extends Specs>(
   const _secrets = secretEnv(varEnv as unknown as Record<string, string | undefined>, secrets);
 
   // Second pass: validate secrets with file values merged in
-  const mergedEnv = { ...varEnv, ..._secrets } as unknown as Record<string, string | undefined>;
+  // Include inputEnv first so env vars (e.g., Kubernetes secretKeyRef) are available,
+  // then varEnv overrides, then file-based secrets have highest priority
+  const mergedEnv = { ...inputEnv, ...varEnv, ..._secrets } as unknown as Record<string, string | undefined>;
   return cleanEnv(mergedEnv, secrets) as unknown as CleanedEnv<S & V>;
 };