diff --git a/README.md b/README.md
index 25feba3..acaef16 100644
--- a/README.md
+++ b/README.md
@@ -50,6 +50,14 @@ See the `-help` output for more options.
       Path under which to expose metrics. (default "/metrics")
 ```
 
+### Environment Variables
+
+Some values can be set via environment variables:
+
+| Name     | Description |
+| -------- | ----------- |
+| ICINGA2_EXPORTER_HTTP_PASSWORD   | Password to use for basic auth |
+
 ### Cache
 
 The exporter caches the responses from the Icinga2 API to decrease load on the API.
diff --git a/icinga2_exporter.go b/icinga2_exporter.go
index 96dcf6b..185028b 100644
--- a/icinga2_exporter.go
+++ b/icinga2_exporter.go
@@ -111,6 +111,12 @@ func main() {
 		Level: logLevel,
 	}))
 
+	if cliPassword == "" {
+		if v, ok := os.LookupEnv("ICINGA2_EXPORTER_HTTP_PASSWORD"); ok {
+			cliPassword = v
+		}
+	}
+
 	// In general, listen to gosec. But it this case, I don't think someone
 	// is going to overflow the uint TTL for the cache lifetime.
 	// nolint:gosec