diff --git a/internal/config/config.go b/internal/config/config.go
index 2f37436..1783e23 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -137,8 +137,8 @@ func LoadConfigFromEnv() (*Config, error) {
         config.TrustLevel = trustLevel
     }
 
-    if dryRun := os.Getenv("DRY_RUN"); dryRun == "true" || dryRun == "1" {
-        config.DryRun = true
+    if dryRun, ok := os.LookupEnv("DRY_RUN"); ok {
+        config.DryRun = dryRun == "true" || dryRun == "1"
     }
 
     if endpoints := os.Getenv("GITOPIA_GRPC_ENDPOINTS"); endpoints != "" {
@@ -156,8 +156,8 @@ func LoadConfigFromEnv() (*Config, error) {
         config.HTTPPort = port
     }
 
-    if v := os.Getenv("APPROVAL_MODE"); v == "true" || v == "1" {
-        config.ApprovalMode = true
+    if v, ok := os.LookupEnv("APPROVAL_MODE"); ok {
+        config.ApprovalMode = v == "true" || v == "1"
     }
 
     if v := os.Getenv("APPROVAL_TTL"); v != "" {
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 2160363..0bdc8ca 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -118,6 +118,24 @@ func TestLoadConfigFromEnv_ApprovalMode_False(t *testing.T) {
 	assert.False(t, cfg.ApprovalMode)
 }
 
+func TestLoadConfigFromEnv_BooleanOverridesCanDisableFileValues(t *testing.T) {
+	tmpDir := t.TempDir()
+	cfgPath := filepath.Join(tmpDir, "config.json")
+	require.NoError(t, os.WriteFile(cfgPath, []byte(`{
+		"dry_run": true,
+		"approval_mode": true
+	}`), 0644))
+
+	t.Setenv("MCP_CONFIG_FILE", cfgPath)
+	t.Setenv("DRY_RUN", "false")
+	t.Setenv("APPROVAL_MODE", "false")
+
+	cfg, err := LoadConfigFromEnv()
+	require.NoError(t, err)
+	assert.False(t, cfg.DryRun)
+	assert.False(t, cfg.ApprovalMode)
+}
+
 func TestLoadConfigFromEnv_ApprovalTTL(t *testing.T) {
 	t.Setenv("APPROVAL_TTL", "10m")
 	cfg, err := LoadConfigFromEnv()