diff --git a/internal/config/config.go b/internal/config/config.go
index aa3237b6..0f08664e 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -111,6 +111,9 @@ func Load() (*Config, error) {
 	v.SetEnvKeyReplacer(strings.NewReplacer(".", "__"))
 	v.AutomaticEnv()
 
+	// Explicitly bind top-level keys that might use double underscores in .env
+	v.BindEnv("encryption_key", "LLM_PROXY__ENCRYPTION_KEY")
+
 	// Config file
 	v.SetConfigName("config")
 	v.SetConfigType("toml")