diff --git a/.changeset/pink-hounds-bake.md b/.changeset/pink-hounds-bake.md
new file mode 100644
index 000000000..0ca0a348a
--- /dev/null
+++ b/.changeset/pink-hounds-bake.md
@@ -0,0 +1,5 @@
+---
+'@churros/api': minor
+---
+
+validate env vars before launching server
diff --git a/.eslintrc.cjs b/.eslintrc.cjs
index ea3604fa4..9c0ea4952 100644
--- a/.eslintrc.cjs
+++ b/.eslintrc.cjs
@@ -32,6 +32,10 @@ module.exports = {
     '@typescript-eslint/no-non-null-assertion': 'off',
     '@typescript-eslint/no-throw-literal': 'off',
     '@typescript-eslint/prefer-nullish-coalescing': 'off',
+    '@typescript-eslint/no-empty-object-type': [
+      'error',
+      { allowInterfaces: 'with-single-extends' },
+    ],
     '@typescript-eslint/no-unused-vars': [
       'error',
       {
diff --git a/packages/api/package.json b/packages/api/package.json
index 52c1ef7ec..2a119433d 100644
--- a/packages/api/package.json
+++ b/packages/api/package.json
@@ -33,6 +33,7 @@
     "arborist": "workspace:^0.1.1",
     "argon2": "^0.41.1",
     "bunyan": "^1.8.15",
+    "chalk": "^5.3.0",
     "cli": "^1.0.1",
     "cli-progress": "^3.12.0",
     "colord": "^2.9.3",
@@ -74,6 +75,7 @@
     "linkify-plugin-mention": "^4.1.3",
     "linkifyjs": "^4.1.3",
     "lodash.countby": "^4.6.0",
+    "lodash.get": "^4.4.2",
     "lodash.groupby": "^4.6.0",
     "lodash.omit": "^4.5.0",
     "lodash.range": "^3.2.0",
@@ -143,6 +145,7 @@
     "@types/jsonwebtoken": "^9.0.7",
     "@types/ldapjs": "^3.0.6",
     "@types/lodash.countby": "^4.6.9",
+    "@types/lodash.get": "^4",
     "@types/lodash.omit": "^4.5.9",
     "@types/lodash.range": "^3.2.9",
     "@types/mjml": "^4.7.4",
diff --git a/packages/api/src/env.ts b/packages/api/src/env.ts
new file mode 100644
index 000000000..a58b9ca26
--- /dev/null
+++ b/packages/api/src/env.ts
@@ -0,0 +1,249 @@
+import { z } from 'zod';
+
+export const environmentSchema = z.object({
+  DATABASE_URL: uri('postgres').describe(
+    'Database connection string. See https://www.prisma.io/docs/reference/database-reference/connection-urls',
+  ),
+  REDIS_URL: uri('redis').describe('Redis connection string.'),
+  PROMETHEUS_URL: optionaluri().describe('Prometheus pushgateway URL.'),
+  PUBLIC_FRONTEND_ORIGIN: uri()
+    .refine((url) => !url.endsWith('/'))
+    .describe("Public frontend origin. Without trailing slash, it's an origin."),
+  INIT_CWD: z
+    .string()
+    .describe('See https://yarnpkg.com/advanced/lifecycle-scripts/#environment-variables'),
+  LDAP_SCHOOL: jsonobject({
+    servers: z.record(
+      z.object({
+        url: uri('ldap', 'ldaps').describe('URL of the LDAP server.'),
+        filterAttribute: z.string().describe('Attribute to use for filtering.'),
+        wholeEmail: z.boolean().describe('Whether the email is the whole login.'),
+        attributesMap: z
+          .object({
+            schoolUid: z.string().describe('Attribute for the school UID.'),
+            schoolEmail: z.string().describe('Attribute for the school email.'),
+            firstName: z.string().describe('Attribute for the first name.'),
+            lastName: z.string().describe('Attribute for the last name.'),
+          })
+          .describe('Mapping of attributes.'),
+      }),
+    ),
+    emailDomains: z
+      .record(z.string())
+      .describe('Map student email domains to their corresponding LDAP servers.'),
+  })
+    .optional()
+    .describe('Settings object for school LDAP servers.'),
+  PROJECT_CWD: z
+    .string()
+    .describe('See https://yarnpkg.com/advanced/lifecycle-scripts/#environment-variables'),
+  PUBLIC_API_URL: uri().describe('Publicly accessible URL to the (GraphQL) API.'),
+  PUBLIC_API_AUTH_URL: uri().describe('Publicly accessible URL to the auth API.'),
+  PUBLIC_API_WEBSOCKET_URL: uri('ws', 'wss').describe(
+    'Publicly accessible URL to the websocket API.',
+  ),
+  PUBLIC_STORAGE_URL: uri().describe('Publicly accessible URL to the storage API.'),
+  SMTP_URL: optionaluri('smtp').describe(
+    'SMTP string, to send emails. See https://nodemailer.com/smtp/',
+  ),
+  STORAGE: z.string().describe('Storage directory, relative to to working directory of the API.'),
+  PUBLIC_SUPPORT_EMAIL: z
+    .string()
+    .email()
+    .describe('The email from which will be sent all emails.'),
+  PUBLIC_LYDIA_API_URL: uri().describe('Lydia API URL.'),
+  LYDIA_WEBHOOK_URL: uri().describe(
+    'Lydia webhook URL: Where Lydia should notify us of payment acknowledgements.',
+  ),
+  PUBLIC_FOY_GROUPS: z.string().describe('DEPRECATED.').optional(),
+  PUBLIC_VAPID_KEY: z.string().describe('Public VAPID key. Used to send push notifications.'),
+  VAPID_PRIVATE_KEY: z.string().describe('Private VAPID key. Used to send push notifications.'),
+  PUBLIC_CONTACT_EMAIL: z.string().email().describe('Contact email.'),
+  GITLAB_PROJECT_ID: z
+    .string()
+    .regex(/^\d+$/)
+    .describe("Internal ID of the Churros project's repo, at https://git.inpt.fr/inp-net/churros.")
+    .default('1013'),
+  GITLAB_SUDO_TOKEN: z
+    .string()
+    .optional()
+    .describe(
+      'Personal access token with sudo, read_api and api scopes. Sudo is required to impersonate a user.',
+    ),
+  LDAP_URL: uri('ldap', 'ldaps').describe('LDAP URL.'),
+  LDAP_BASE_DN: z.string().describe('LDAP base DN.'),
+  LDAP_BIND_DN: z.string().describe('LDAP bind DN.'),
+  LDAP_BIND_PASSWORD: z.string().describe('LDAP bind password.'),
+  MASTER_PASSWORD_HASH: z
+    .string()
+    .regex(/^\$argon2id\$.*$/)
+    .optional()
+    .or(z.literal('')) // See https://github.com/colinhacks/zod/issues/310
+    .describe('argon2 hash of the master password.'),
+  PUBLIC_PAYPAL_CLIENT_ID: z.string().describe('Paypal client ID.'),
+  PAYPAL_CLIENT_SECRET: z.string().describe('Paypal client secret.'),
+  PUBLIC_PAYPAL_API_BASE_URL: uri().describe('Paypal API base URL.'),
+  PUBLIC_SCHOOL_UID: z
+    .string()
+    .describe(
+      "UID of the school to use for the logged-out view of the homepage. The 'main' school of the deployment.",
+    ),
+  GOOGLE_CLIENT_SECRET: z.string().optional().describe('Google APIs client secret.'),
+  PUBLIC_GOOGLE_CLIENT_ID: z.string().optional().describe('Google APIs client ID.'),
+  PUBLIC_GOOGLE_WALLET_ISSUER_ID: z.string().optional().describe('Google Wallet issuer ID.'),
+  GOOGLE_WALLET_ISSUER_KEY: googleServiceAccountKey().describe('Google Wallet issuer key.'),
+  PUBLIC_DEACTIVATE_SIGNUPS: z
+    .enum(['true', 'false'])
+    .describe('Set to "true" to deactivate signups.'),
+  PUBLIC_DEACTIVATE_SIGNUPS_MESSAGE: z
+    .string()
+    .optional()
+    .describe('Custom message to show when users try to hit the /register page.'),
+  PUBLIC_OAUTH_ENABLED: z.enum(['1', '0']).describe('Set to "1" to activate oauth2 login.'),
+  PUBLIC_OAUTH_CLIENT_ID: z.string().optional().describe('Oauth2 client ID.'),
+  PUBLIC_OAUTH_AUTHORIZE_URL: optionaluri().describe('Oauth2 authorize URL.'),
+  PUBLIC_OAUTH_TOKEN_URL: optionaluri().describe('Oauth2 token URL.'),
+  PUBLIC_OAUTH_USER_INFO_URL: optionaluri().describe('Oauth2 user info URL.'),
+  PUBLIC_OAUTH_LOGOUT_URL: optionaluri().describe('Oauth2 logout URL.'),
+  PUBLIC_OAUTH_SCOPES: z
+    .string()
+    .optional()
+    .describe('Oauth2 scopes, comma separated.')
+    .transform((scopes) => (scopes ? scopes.split(',').map((scope) => scope.trim()) : undefined)),
+  OAUTH_UID_KEY: z
+    .string()
+    .optional()
+    .describe(
+      "Property to use for the user's uid. Has to be accessible in the user info response.",
+    ),
+  OAUTH_CLIENT_SECRET: z.string().optional().describe('Oauth2 client secret.'),
+  SESSION_SECRET: z.string().describe('express-session secret.'),
+  APPLE_WALLET_PEM_CERTIFICATE: z.string().optional().describe('Contents of the .pem certificate.'),
+  APPLE_WALLET_PEM_KEY_PASSWORD: z
+    .string()
+    .optional()
+    .describe("The private key's optional password."),
+  APPLE_WALLET_PASS_TYPE_ID: z.string().optional().describe('Apple Wallet pass type ID.'),
+  APPLE_WALLET_TEAM_ID: z.string().optional().describe('Apple Wallet team ID.'),
+  MAILMAN_API_URL: optionaluri().describe('Mailman API URL to handle mailing lists automation.'),
+  MAILMAN_API_TOKEN: z.string().optional().describe('Mailman API token.'),
+  PUBLIC_GLOBAL_SEARCH_BUMPS: optionaljsonobject({
+    Users: z.number().optional(),
+    Groups: z.number().optional(),
+    Events: z.number().optional(),
+    Articles: z.number().optional(),
+    Documents: z.number().optional(),
+  }).describe(
+    "Additive modifier for favoring some types in global search results. A search result's rank is between 0 and 1. JSON object mapping types to rank bumps. Types are values of the `SearchResultType` GraphQL enum. Omitting a value means no bump.",
+  ),
+  PUBLIC_API_ORIGIN_WEB: optionaluri().describe(
+    "Origin of the public API for the web client. Defaults to PUBLIC_API_URL's origin.",
+  ),
+  PUBLIC_API_ORIGIN_ANDROID: optionaluri().describe(
+    "Origin of the public API for the Android client. Defaults to PUBLIC_API_URL's origin.",
+  ),
+  PUBLIC_API_ORIGIN_IOS: optionaluri().describe(
+    "Origin of the public API for the iOS client. Defaults to PUBLIC_API_URL's origin.",
+  ),
+  PUBLIC_FRONTEND_ORIGIN_ANDROID: optionaluri().describe(
+    'Origin of the public frontend for the Android client. Defaults to PUBLIC_FRONTEND_ORIGIN.',
+  ),
+  PUBLIC_FRONTEND_ORIGIN_IOS: optionaluri().describe(
+    'Origin of the public frontend for the iOS client. Defaults to PUBLIC_FRONTEND_ORIGIN.',
+  ),
+  FIREBASE_ADMIN_SERVICE_ACCOUNT_KEY: googleServiceAccountKey().describe(
+    'Firebase Admin SDK service account key. JSON contents of the key file, can be downloaded from the Firebase Admin console. Used to send push notifications to Android & iOS native clients.',
+  ),
+  PUBLIC_APP_PACKAGE_ID: z
+    .string()
+    .regex(/^[\d.a-z]+$/)
+    .describe('App package ID (Android) and Bundle ID (iOS).'),
+});
+
+function googleServiceAccountKey() {
+  return optionaljsonobject({
+    type: z.literal('service_account'),
+    project_id: z.string(),
+    private_key_id: z.string(),
+    private_key: privatekey(),
+    client_email: z.string().email(),
+    client_id: z.string(),
+    auth_uri: uri(),
+    token_uri: uri(),
+    auth_provider_x509_cert_url: uri(),
+    client_x509_cert_url: uri(),
+    universe_domain: z.string(),
+  });
+}
+
+function uri(...protocols: string[]) {
+  return z
+    .string()
+    .trim()
+    .url()
+    .refine((url) =>
+      (protocols.length > 0 ? protocols : ['http', 'https']).some((protocol) =>
+        url.startsWith(`${protocol}://`),
+      ),
+    );
+}
+
+function optionaluri(...protocols: string[]) {
+  return z
+    .string()
+    .trim()
+    .url()
+    .refine((url) =>
+      (protocols.length > 0 ? protocols : ['http', 'https']).some((protocol) =>
+        url.startsWith(`${protocol}://`),
+      ),
+    )
+    .or(z.literal('').transform(() => {}))
+    .optional();
+}
+
+function jsonobject<Shape extends z.ZodRawShape, Params extends z.RawCreateParams>(
+  shape: Shape,
+  params?: Params,
+) {
+  return z
+    .string()
+    .transform((x, ctx) => {
+      // See https://github.com/colinhacks/zod/issues/2918#issuecomment-1800824755
+      try {
+        return JSON.parse(x);
+      } catch (error) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: `Invalid JSON: ${error}` });
+        return z.NEVER;
+      }
+    })
+    .pipe(z.object(shape, params));
+}
+
+function optionaljsonobject<Shape extends z.ZodRawShape, Params extends z.RawCreateParams>(
+  shape: Shape,
+  params?: Params,
+) {
+  return z
+    .string()
+    .optional()
+    .transform((x, ctx) => {
+      if (!x) return;
+      // See https://github.com/colinhacks/zod/issues/2918#issuecomment-1800824755
+      try {
+        return JSON.parse(x);
+      } catch (error) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: `Invalid JSON: ${error}` });
+        return z.NEVER;
+      }
+    })
+    .pipe(z.object(shape, params).or(z.undefined()));
+}
+
+function privatekey() {
+  return z
+    .string()
+    .trim()
+    .startsWith('-----BEGIN PRIVATE KEY-----')
+    .endsWith('-----END PRIVATE KEY-----');
+}
diff --git a/packages/api/src/global.d.ts b/packages/api/src/global.d.ts
index 2c2e8bdc5..86d6daec6 100644
--- a/packages/api/src/global.d.ts
+++ b/packages/api/src/global.d.ts
@@ -1,123 +1,9 @@
-import { SessionUser } from '#lib';
+import { z } from 'zod';
+import { environmentSchema } from './env.js';
 
 declare global {
   namespace NodeJS {
-    export interface ProcessEnv {
-      /**
-       * Database connection string.
-       *
-       * @see https://www.prisma.io/docs/reference/database-reference/connection-urls
-       */
-      DATABASE_URL: string;
-      /**
-       * Redis connection string.
-       */
-      REDIS_URL: string;
-      /**
-       * Prometheus pushgateway URL.
-       */
-      PROMETHEUS_URL: string;
-      /**
-       * Public frontend origin.
-       *
-       * @example
-       *   'https://example.com';
-       *
-       * @remark /!\ Without trailing slash, it's an origin
-       */
-      PUBLIC_FRONTEND_ORIGIN: string;
-      /** @see https://yarnpkg.com/advanced/lifecycle-scripts/#environment-variables */
-      INIT_CWD: string;
-      /** Settings object for reference LDAP servers. */
-      LDAP_SCHOOL: string;
-      /** @see https://yarnpkg.com/advanced/lifecycle-scripts/#environment-variables */
-      PROJECT_CWD: string;
-      PUBLIC_API_URL: string;
-      PUBLIC_API_AUTH_URL: string;
-      PUBLIC_API_WEBSOCKET_URL: string;
-      PUBLIC_STORAGE_URL: string;
-      /**
-       * SMTP options string.
-       *
-       * @see https://nodemailer.com/smtp/
-       */
-      SMTP_URL: string;
-      /** Storage directory, relative to to working directory of the API. */
-      STORAGE: string;
-      /** The email from which will be sent all emails. */
-      PUBLIC_SUPPORT_EMAIL: string;
-      /** Lydia API URL. */
-      PUBLIC_LYDIA_API_URL: string;
-      /**
-       * Foy groups. Only users that are part of the bureau of one of these groups can create/modify
-       * bar weeks. Must be a comma-separated list of group UIDs.
-       */
-      PUBLIC_FOY_GROUPS: string;
-      /** VAPID keys */
-      PUBLIC_VAPID_KEY: string;
-      VAPID_PRIVATE_KEY: string;
-      /** Contact email (used for push notifications and maybe other things) */
-      PUBLIC_CONTACT_EMAIL: string;
-      /** Gitlab API info, for the issue creation form */
-      GITLAB_PROJECT_ID: string; // Id of the repo
-      GITLAB_SUDO_TOKEN: string; // personnal access token with sudo, read_api and api scopes. Sudo is required to impersonate a user so that we can say that he created it
-      /** LDAP URL */
-      LDAP_URL: string;
-      LDAP_BASE_DN: string;
-      LDAP_BIND_DN: string;
-      LDAP_BIND_PASSWORD: string;
-      /** Master password's hash (allows impersonation) */
-      MASTER_PASSWORD_HASH: string;
-      /** Paypal secrets */
-      PUBLIC_PAYPAL_CLIENT_ID: string;
-      PAYPAL_CLIENT_SECRET: string;
-      PUBLIC_PAYPAL_API_BASE_URL: string;
-      PUBLIC_SCHOOL_UID: string;
-      /** Google secrets */
-      GOOGLE_CLIENT_SECRET: string;
-      PUBLIC_GOOGLE_CLIENT_ID: string;
-      PUBLIC_GOOGLE_WALLET_ISSUER_ID: string;
-
-      GOOGLE_WALLET_ISSUER_KEY: string;
-      /** Mailman secrets */
-      MAILMAN_API_URL: string;
-      MAILMAN_API_TOKEN: string;
-      /** Set to "true" to deactivate signups */
-      PUBLIC_DEACTIVATE_SIGNUPS: string;
-      /**  Custom message to show when users try to hit the /register page */
-      PUBLIC_DEACTIVATE_SIGNUPS_MESSAGE: string;
-
-      /** Set to "true" to activate oauth2 login */
-      PUBLIC_OAUTH_ENABLED: string;
-      /** Oauth2 client secrets */
-      PUBLIC_OAUTH_CLIENT_ID: string;
-      PUBLIC_OAUTH_AUTHORIZE_URL: string;
-      PUBLIC_OAUTH_TOKEN_URL: string;
-      PUBLIC_OAUTH_USER_INFO_URL: string;
-      PUBLIC_OAUTH_LOGOUT_URL: string;
-      /** Oauth2 scopes, comma separated */
-      PUBLIC_OAUTH_SCOPES: string;
-      /** Oauth2 UID key */
-      OAUTH_UID_KEY: string;
-      OAUTH_CLIENT_SECRET: string;
-
-      /** express-session secret */
-      SESSION_SECRET: string;
-      /** Contents of the .pem certificate. See .env.example for instructions to get this file */
-      APPLE_WALLET_PEM_CERTIFICATE: string;
-      /** The private key's optional password. For net7 devs, this is in the vault. */
-      APPLE_WALLET_PEM_KEY_PASSWORD: string;
-      APPLE_WALLET_PASS_TYPE_ID: string;
-      /** Get it from https://developer.apple.com/account */
-      APPLE_WALLET_TEAM_ID: string;
-
-      /** Additive modifiers for favoring some types in global search results. */
-      PUBLIC_GLOBAL_SEARCH_BUMPS: string;
-      PUBLIC_API_ORIGIN_ANDROID: string;
-      PUBLIC_API_ORIGIN_WEB: string;
-      FIREBASE_ADMIN_SERVICE_ACCOUNT_KEY: string;
-      PUBLIC_APP_PACKAGE_ID: string;
-    }
+    export interface ProcessEnv extends Record<keyof z.infer<typeof environmentSchema>, string> {}
   }
 
   namespace Express {
diff --git a/packages/api/src/index.ts b/packages/api/src/index.ts
index cb169bb13..a3e5bba32 100644
--- a/packages/api/src/index.ts
+++ b/packages/api/src/index.ts
@@ -6,6 +6,8 @@ import { lydiaWebhook } from './server/lydia.js';
 import { maintenance } from './server/maintenance.js';
 import { prometheusServer } from './server/prometheus.js';
 
+// Validates env variables before doing anything else
+import './lib/env.js';
 startApiServer();
 
 lydiaWebhook.listen(4001, () => {
diff --git a/packages/api/src/lib/apple-wallet.ts b/packages/api/src/lib/apple-wallet.ts
index d4da9056e..ec0516fd8 100644
--- a/packages/api/src/lib/apple-wallet.ts
+++ b/packages/api/src/lib/apple-wallet.ts
@@ -6,27 +6,35 @@ import { existsSync } from 'node:fs';
 import { mkdir, writeFile } from 'node:fs/promises';
 import path from 'node:path/posix';
 import sharp from 'sharp';
+import { ENV } from './env.js';
 import { localID } from './global-id.js';
 import { storageRoot } from './storage.js';
 
 let appleWalletTemplate: Template | null = null;
 
 export async function writePemCertificate(to: string) {
-  if (!process.env.APPLE_WALLET_PEM_CERTIFICATE) {
+  const certificate = ENV.APPLE_WALLET_PEM_CERTIFICATE;
+  if (!certificate) {
     console.warn(
       `No APPLE_WALLET_PEM_CERTIFICATE set in environment variables, not writing certificate to ${to}.`,
     );
     return;
   }
-  await writeFile(to, process.env.APPLE_WALLET_PEM_CERTIFICATE);
+  await writeFile(to, certificate);
 }
 
 export async function registerAppleWalletPassTemplate() {
   if (appleWalletTemplate) return;
+  if (!ENV.APPLE_WALLET_PASS_TYPE_ID || !ENV.APPLE_WALLET_TEAM_ID) {
+    console.warn(
+      'No APPLE_WALLET_PASS_TYPE_ID or APPLE_WALLET_TEAM_ID set in environment variables, not registering Apple Wallet pass template.',
+    );
+    return;
+  }
   console.info('Registering Apple Wallet pass template...');
   const template = new Template('eventTicket', {
-    passTypeIdentifier: process.env.APPLE_WALLET_PASS_TYPE_ID,
-    teamIdentifier: process.env.APPLE_WALLET_TEAM_ID,
+    passTypeIdentifier: ENV.APPLE_WALLET_PASS_TYPE_ID,
+    teamIdentifier: ENV.APPLE_WALLET_TEAM_ID,
     backgroundColor: 'white',
     sharingProhibited: true,
     organizationName: 'net7', // TODO: dehardcode?
@@ -44,10 +52,7 @@ export async function registerAppleWalletPassTemplate() {
     appleWalletTemplate = null;
     return;
   }
-  await template.loadCertificate(
-    'apple-wallet-cert.pem',
-    process.env.APPLE_WALLET_PEM_KEY_PASSWORD,
-  );
+  await template.loadCertificate('apple-wallet-cert.pem', ENV.APPLE_WALLET_PEM_KEY_PASSWORD);
   appleWalletTemplate = template;
   return appleWalletTemplate;
 }
@@ -70,7 +75,7 @@ export async function createAppleWalletPass(
     relevantDate: subMinutes(booking.ticket.event.startsAt, 5).toISOString(),
     barcodes: [
       {
-        message: new URL(`/bookings/${booking.id}`, process.env.PUBLIC_FRONTEND_ORIGIN).toString(),
+        message: new URL(`/bookings/${booking.id}`, ENV.PUBLIC_FRONTEND_ORIGIN).toString(),
         format: 'PKBarcodeFormatQR',
         messageEncoding: 'iso-8859-1',
         altText: localID(booking.id).toUpperCase(),
@@ -104,7 +109,7 @@ export async function createAppleWalletPass(
     key: 'code',
     label: 'Code de réservation',
     value: localID(booking.id).toUpperCase(),
-    attributedValue: `<a href="${new URL(`/bookings/${localID(booking.id).toUpperCase()}`, process.env.PUBLIC_FRONTEND_ORIGIN)}">${localID(booking.id).toUpperCase()}</a>`,
+    attributedValue: `<a href="${new URL(`/bookings/${localID(booking.id).toUpperCase()}`, ENV.PUBLIC_FRONTEND_ORIGIN)}">${localID(booking.id).toUpperCase()}</a>`,
   });
   pass.primaryFields.add({
     key: 'title',
@@ -126,7 +131,7 @@ export async function createAppleWalletPass(
     booking.internalBeneficiary || booking.author
       ? new URL(
           `/${booking.internalBeneficiary?.uid ?? booking.author?.uid}`,
-          process.env.PUBLIC_FRONTEND_ORIGIN,
+          ENV.PUBLIC_FRONTEND_ORIGIN,
         )
       : null;
 
@@ -180,7 +185,7 @@ export async function createAppleWalletPass(
   pass.backFields.add({
     key: 'platform',
     label: 'Acheté sur',
-    value: new URL(process.env.PUBLIC_FRONTEND_ORIGIN).hostname,
+    value: new URL(ENV.PUBLIC_FRONTEND_ORIGIN).hostname,
   });
   if (booking.ticket.name || booking.ticket.event._count.tickets > 1) {
     pass.headerFields.add({
diff --git a/packages/api/src/lib/builder.ts b/packages/api/src/lib/builder.ts
index cab53c1c1..1d1009ee7 100644
--- a/packages/api/src/lib/builder.ts
+++ b/packages/api/src/lib/builder.ts
@@ -1,5 +1,6 @@
 import type { Context, GraphinxDirective, RateLimitDirective } from '#lib';
 import {
+  ENV,
   authScopes,
   context,
   decodeGlobalID,
@@ -215,7 +216,7 @@ builder.mutationType({
 
 builder.subscriptionType({
   description: `Permet de faire des requêtes de données temps-réel, via des _websockets_.
-L'endpoint pour le temps réel est \`${process.env.PUBLIC_API_WEBSOCKET_URL}\`. 
+L'endpoint pour le temps réel est \`${ENV.PUBLIC_API_WEBSOCKET_URL}\`. 
 
 Pour un client JavaScript, il y a par exemple [GraphQL-WebSocket](https://the-guild.dev/graphql/ws/get-started#use-the-client)`,
   directives: {
diff --git a/packages/api/src/lib/env.ts b/packages/api/src/lib/env.ts
index b6d7d4495..ca7948e9d 100644
--- a/packages/api/src/lib/env.ts
+++ b/packages/api/src/lib/env.ts
@@ -1,6 +1,70 @@
+import chalk from 'chalk';
+import getByPath from 'lodash.get';
+import { z } from 'zod';
+import { environmentSchema } from '../env.js';
+import { isValidJSON } from './utils.js';
+export { environmentSchema } from '../env.js';
+
 /**
  * Returns true if the server is running in development mode.
  */
 export function inDevelopment() {
   return process.env['NODE_ENV'] === 'development';
 }
+
+let _parsedEnv: z.infer<typeof environmentSchema> | undefined;
+
+export const ENV = new Proxy<NonNullable<typeof _parsedEnv>>({} as NonNullable<typeof _parsedEnv>, {
+  get(_target, property: keyof typeof environmentSchema.shape) {
+    if (_parsedEnv) return _parsedEnv[property];
+
+    try {
+      console.info('Validating environment variables...');
+      _parsedEnv = environmentSchema.parse(process.env);
+      return _parsedEnv[property];
+    } catch (error) {
+      if (!(error instanceof z.ZodError)) throw error;
+
+      console.error(chalk.red('Some environment variables are invalid:'));
+      formatZodErrors(error);
+      throw new Error('Invalid environment variables.');
+    }
+  },
+});
+
+function formatZodErrors(error: z.ZodError<unknown>) {
+  for (const { path, message } of error.issues) {
+    const variable = path[0]?.toString() as keyof typeof environmentSchema.shape;
+    const value = process.env[variable];
+    const description = environmentSchema.shape[variable]?.description;
+
+    if (path.length !== 1) {
+      console.error(
+        formatZodIssue(
+          description,
+          path.join('.'),
+          message,
+          path.length === 1 || !isValidJSON(value)
+            ? value
+            : getByPath(JSON.parse(value), path.slice(1)),
+        ),
+      );
+      continue;
+    }
+
+    console.error(formatZodIssue(description, variable, message, value));
+  }
+}
+
+function formatZodIssue(
+  description: string | undefined,
+  path: string,
+  message: string,
+  value: string | undefined,
+) {
+  return [
+    description ? chalk.dim(`\n# ${description}`) : '',
+    `${chalk.bold.cyan(path)}: ${message}`,
+    `Current value: ${chalk.green(JSON.stringify(value))}`,
+  ].join('\n');
+}
diff --git a/packages/api/src/lib/google-wallet.ts b/packages/api/src/lib/google-wallet.ts
index 79faa1d8f..31328d9a4 100644
--- a/packages/api/src/lib/google-wallet.ts
+++ b/packages/api/src/lib/google-wallet.ts
@@ -1,10 +1,9 @@
 import { fullName } from '#modules/users';
 import type { Prisma } from '@churros/db/prisma';
-import { GoogleAuth, type JWTInput } from 'google-auth-library';
+import { GoogleAuth } from 'google-auth-library';
+import { ENV } from './env.js';
 import { localID } from './global-id.js';
 
-const GOOGLE_WALLET_ISSUER_ID = process.env.PUBLIC_GOOGLE_WALLET_ISSUER_ID;
-
 const baseUrl = 'https://walletobjects.googleapis.com/walletobjects/v1';
 
 // Google Wallet does not like localhost URLs, so we replace localhost:* with churros.inpt.fr, even in dev.
@@ -31,10 +30,7 @@ export function makeGoogleWalletObject(
     classId: GOOGLE_WALLET_CLASS.id,
     logo: {
       sourceUri: {
-        uri: noLocalhostURL(
-          'android-chrome-512x512.png',
-          process.env.PUBLIC_FRONTEND_ORIGIN,
-        ).toString(),
+        uri: noLocalhostURL('android-chrome-512x512.png', ENV.PUBLIC_FRONTEND_ORIGIN).toString(),
       },
       contentDescription: {
         defaultValue: {
@@ -97,11 +93,8 @@ export function makeGoogleWalletObject(
     heroImage: {
       sourceUri: {
         uri: event.pictureFile
-          ? noLocalhostURL(event.pictureFile, process.env.PUBLIC_STORAGE_URL).toString()
-          : noLocalhostURL(
-              'android-chrome-512x512.png',
-              process.env.PUBLIC_FRONTEND_ORIGIN,
-            ).toString(),
+          ? noLocalhostURL(event.pictureFile, ENV.PUBLIC_STORAGE_URL).toString()
+          : noLocalhostURL('android-chrome-512x512.png', ENV.PUBLIC_FRONTEND_ORIGIN).toString(),
       },
       contentDescription: {
         defaultValue: {
@@ -128,7 +121,7 @@ makeGoogleWalletObject.prismaIncludes = {
 } as const satisfies Prisma.RegistrationInclude;
 
 export const GOOGLE_WALLET_CLASS = {
-  id: `${GOOGLE_WALLET_ISSUER_ID}.churros_event`,
+  id: `${ENV.PUBLIC_GOOGLE_WALLET_ISSUER_ID}.churros_event`,
   classTemplateInfo: {
     cardTemplateOverride: {
       cardRowTemplateInfos: [
@@ -182,15 +175,14 @@ export const GOOGLE_WALLET_CLASS = {
 };
 
 export async function registerGoogleWalletClass(data: typeof GOOGLE_WALLET_CLASS): Promise<string> {
-  let credentials: JWTInput;
-  try {
-    credentials = JSON.parse(process.env.GOOGLE_WALLET_ISSUER_KEY);
-  } catch (error) {
-    console.error(`Could not parse credentials for Google Wallet issuer service account: ${error}`);
+  if (!ENV.GOOGLE_WALLET_ISSUER_KEY) {
+    console.warn(
+      'No GOOGLE_WALLET_ISSUER_KEY set in environment variables, not registering Google Wallet class.',
+    );
     return '';
   }
   const httpClient = new GoogleAuth({
-    credentials,
+    credentials: ENV.GOOGLE_WALLET_ISSUER_KEY,
     scopes: 'https://www.googleapis.com/auth/wallet_object.issuer',
   });
   try {
diff --git a/packages/api/src/lib/ldap-school.ts b/packages/api/src/lib/ldap-school.ts
index 8f92168fc..ddf9fc0fd 100644
--- a/packages/api/src/lib/ldap-school.ts
+++ b/packages/api/src/lib/ldap-school.ts
@@ -2,6 +2,7 @@
 import { fromYearTier } from '#lib';
 import bunyan from 'bunyan';
 import ldap from 'ldapjs';
+import { ENV } from './env.js';
 
 const logger = bunyan.createLogger({ name: 'CRI INP ldap', level: 'debug' });
 
@@ -12,13 +13,7 @@ export interface LdapUser {
   lastName?: string;
 }
 
-export const schoolLdapSettings = JSON.parse(process.env.LDAP_SCHOOL || '{}') as {
-  servers: Record<
-    string,
-    { url: string; filterAttribute: string; wholeEmail: boolean; attributesMap: LdapUser }
-  >;
-  emailDomains: Record<string, string>;
-};
+export const schoolLdapSettings = ENV.LDAP_SCHOOL;
 
 function parseN7ApprenticeAndMajor(groups: string[] | undefined):
   | undefined
@@ -32,6 +27,7 @@ function parseN7ApprenticeAndMajor(groups: string[] | undefined):
     if (group.startsWith('cn=n7etu_')) {
       const fragment = group.split(',')[0];
       if (!fragment) return undefined;
+      // TODO use document obtained after DSI ticket
       const parts = /n7etu_(?<major>SN|MF2E|3EA)_(?<yearTier>\d)A(_APP)?/.exec(fragment);
       if (!parts) return;
       return {
@@ -69,6 +65,8 @@ export const findSchoolUser = async (
     })
   | undefined
 > => {
+  if (!schoolLdapSettings) return;
+
   let ldapFilter = '';
   let schoolServer: string | undefined;
   console.log({ findSchoolUser: searchBy });
diff --git a/packages/api/src/lib/logger.ts b/packages/api/src/lib/logger.ts
index 8f3146bbe..363a6f7f5 100644
--- a/packages/api/src/lib/logger.ts
+++ b/packages/api/src/lib/logger.ts
@@ -1,4 +1,5 @@
-import { inDevelopment, prisma, publish } from '#lib';
+import { prisma, publish } from '#lib';
+import { inDevelopment } from './env.js';
 
 export async function log(
   area: string,
diff --git a/packages/api/src/lib/mail.ts b/packages/api/src/lib/mail.ts
index 0543d4f2a..6f02532a6 100644
--- a/packages/api/src/lib/mail.ts
+++ b/packages/api/src/lib/mail.ts
@@ -15,12 +15,13 @@ import {
   type MailRequiredContentIDs,
   type MailTemplate,
 } from '../mail-templates/props.js';
+import { ENV } from './env.js';
 
 const compiledTemplates = await precompileTemplates();
 
 let mailer: ReturnType<typeof initializeMailer>;
 function initializeMailer() {
-  return createTransport(process.env.SMTP_URL || 'smtp://localhost');
+  return createTransport(ENV.SMTP_URL || 'smtp://localhost');
 }
 
 /**
@@ -44,7 +45,7 @@ export async function sendMail<Template extends MailTemplate>(
   to: string | string[],
   data: Template extends keyof MailProps ? MailProps[Template] : Record<string, never>,
   {
-    from = process.env.PUBLIC_SUPPORT_EMAIL,
+    from = ENV.PUBLIC_SUPPORT_EMAIL,
     attachments = {},
     subjectOverride = '',
   }: {
diff --git a/packages/api/src/lib/prometheus.ts b/packages/api/src/lib/prometheus.ts
index 413233eaa..8edec8b17 100644
--- a/packages/api/src/lib/prometheus.ts
+++ b/packages/api/src/lib/prometheus.ts
@@ -1,5 +1,6 @@
 import { Histogram } from 'prom-client';
 import { PrometheusDriver } from 'prometheus-query';
+import { ENV } from './env.js';
 
 const queriesHistogram = new Histogram({
   name: 'query_duration_ms',
@@ -63,6 +64,6 @@ export async function updateRateLimitHit({
 }
 
 export const prometheusClient = new PrometheusDriver({
-  endpoint: process.env.PROMETHEUS_URL || 'http://localhost:9090',
+  endpoint: ENV.PROMETHEUS_URL || 'http://localhost:9090',
   baseURL: '/api/v1',
 });
diff --git a/packages/api/src/lib/pubsub.ts b/packages/api/src/lib/pubsub.ts
index 307f34916..1c098197f 100644
--- a/packages/api/src/lib/pubsub.ts
+++ b/packages/api/src/lib/pubsub.ts
@@ -1,9 +1,10 @@
 import { createRedisEventTarget } from '@graphql-yoga/redis-event-target';
 import { createPubSub } from 'graphql-yoga';
 import { Redis } from 'ioredis';
+import { ENV } from './env.js';
 import { splitID } from './global-id.js';
 
-const REDIS_URL = new URL(process.env.REDIS_URL || 'redis://localhost:6379');
+const REDIS_URL = new URL(ENV.REDIS_URL || 'redis://localhost:6379');
 
 export const publishClient = new Redis({
   host: REDIS_URL.hostname,
diff --git a/packages/api/src/lib/redis.ts b/packages/api/src/lib/redis.ts
index 1b48f3253..cd1d5803b 100644
--- a/packages/api/src/lib/redis.ts
+++ b/packages/api/src/lib/redis.ts
@@ -1,9 +1,10 @@
 import { Redis } from 'ioredis';
+import { ENV } from './env.js';
 
 let _redisClient: Redis;
 function redisClient(): Redis {
   if (_redisClient) return _redisClient;
-  const redisURL = new URL(process.env.REDIS_URL || 'redis://localhost:6379');
+  const redisURL = new URL(ENV.REDIS_URL || 'redis://localhost:6379');
   return (_redisClient = new Redis({
     host: redisURL.hostname,
     port: Number.parseInt(redisURL.port),
diff --git a/packages/api/src/lib/storage.ts b/packages/api/src/lib/storage.ts
index 2b3dc96c5..37bed5a39 100644
--- a/packages/api/src/lib/storage.ts
+++ b/packages/api/src/lib/storage.ts
@@ -1,7 +1,7 @@
-import { inDevelopment } from '#lib';
 import { execSync } from 'node:child_process';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { ENV, inDevelopment } from './env.js';
 
 function gitRoot() {
   return execSync('git rev-parse --show-toplevel').toString().trim();
@@ -10,5 +10,5 @@ function gitRoot() {
 export function storageRoot() {
   return inDevelopment()
     ? path.join(gitRoot(), 'packages/api/storage')
-    : fileURLToPath(new URL(process.env.STORAGE));
+    : fileURLToPath(new URL(ENV.STORAGE));
 }
diff --git a/packages/api/src/lib/utils.ts b/packages/api/src/lib/utils.ts
index 83cddbfb5..1f35a852c 100644
--- a/packages/api/src/lib/utils.ts
+++ b/packages/api/src/lib/utils.ts
@@ -49,3 +49,12 @@ export function daysToSeconds(days: number): number {
 export function clamp(value: number, min: number, max: number): number {
   return Math.max(min, Math.min(max, value));
 }
+
+export function isValidJSON(str: string): boolean {
+  try {
+    JSON.parse(str);
+    return true;
+  } catch {
+    return false;
+  }
+}
diff --git a/packages/api/src/modules/comments/resolvers/mutation.upsert-comment.ts b/packages/api/src/modules/comments/resolvers/mutation.upsert-comment.ts
index 1a660df90..d639e4a33 100644
--- a/packages/api/src/modules/comments/resolvers/mutation.upsert-comment.ts
+++ b/packages/api/src/modules/comments/resolvers/mutation.upsert-comment.ts
@@ -1,4 +1,5 @@
 import {
+  ENV,
   TYPENAMES_TO_ID_PREFIXES,
   builder,
   localID,
@@ -85,11 +86,13 @@ builder.mutationField('upsertComment', (t) =>
       return true;
     },
     async resolve(query, _, { id, body, resourceId, inReplyToId }, { user }) {
-      const connection: {} | { articleId: string } | { documentId: string } = resourceId
-        ? {
-            [splitID(resourceId)[0] === 'Document' ? 'documentId' : 'articleId']: resourceId,
-          }
-        : {};
+      let connection: undefined | { articleId: string } | { documentId: string };
+
+      if (resourceId) {
+        connection = {
+          [splitID(resourceId)[0] === 'Document' ? 'documentId' : 'articleId']: resourceId,
+        } as typeof connection;
+      }
 
       await log(
         'comments',
@@ -144,7 +147,7 @@ builder.mutationField('upsertComment', (t) =>
         comment.document?.subject!.minors[0]?.majors[0]?.uid ??
         'unknown';
       const commentUrl =
-        process.env.PUBLIC_FRONTEND_ORIGIN +
+        ENV.PUBLIC_FRONTEND_ORIGIN +
         (comment.document
           ? `/documents/${documentMajor}/${
               comment.document.subject!.minors[0]?.yearTier ??
diff --git a/packages/api/src/modules/documents/resolvers/mutation.delete-document.ts b/packages/api/src/modules/documents/resolvers/mutation.delete-document.ts
index 4aaeb4f7e..b1bbe4e43 100644
--- a/packages/api/src/modules/documents/resolvers/mutation.delete-document.ts
+++ b/packages/api/src/modules/documents/resolvers/mutation.delete-document.ts
@@ -1,8 +1,7 @@
-import { builder, log, objectValuesFlat, prisma } from '#lib';
-
+import { builder, ENV, log, objectValuesFlat, prisma } from '#lib';
 import { userIsAdminOf } from '#permissions';
 import { rm, rmdir } from 'node:fs/promises';
-import path, { dirname } from 'node:path';
+import path from 'node:path';
 
 builder.mutationField('deleteDocument', (t) =>
   t.field({
@@ -38,13 +37,11 @@ builder.mutationField('deleteDocument', (t) =>
       await prisma.comment.deleteMany({ where: { documentId: id } });
       // Delete all files on disk
       await Promise.all(
-        paths.map(
-          async (filepath) => await rm(path.join(new URL(process.env.STORAGE).pathname, filepath)),
-        ),
+        paths.map(async (filepath) => await rm(path.join(new URL(ENV.STORAGE).pathname, filepath))),
       );
 
       if (paths.length > 0) {
-        await rmdir(dirname(path.join(new URL(process.env.STORAGE).pathname, paths[0]!))).catch(
+        await rmdir(path.dirname(path.join(new URL(ENV.STORAGE).pathname, paths[0]!))).catch(
           (error) =>
             `Could not delete ${paths[0]}: ${error} (this is considered OK, continuing mutation)`,
         );
diff --git a/packages/api/src/modules/forms/resolvers/mutation.mail-form-answers.ts b/packages/api/src/modules/forms/resolvers/mutation.mail-form-answers.ts
index e3ae3b9a4..d91246fa4 100644
--- a/packages/api/src/modules/forms/resolvers/mutation.mail-form-answers.ts
+++ b/packages/api/src/modules/forms/resolvers/mutation.mail-form-answers.ts
@@ -1,6 +1,6 @@
-import { builder, formatDateTime, localID, prisma, sendMail } from '#lib';
+import { builder, ENV, formatDateTime, localID, prisma, sendMail } from '#lib';
+import { answerToString } from '#modules/forms';
 import { GraphQLError } from 'graphql';
-import { answerToString } from '../utils/answers.js';
 
 builder.mutationField('mailFormAnswers', (t) =>
   t.string({
@@ -52,7 +52,7 @@ builder.mutationField('mailFormAnswers', (t) =>
           formId: form.id,
           linkToAnswers: new URL(
             `/forms/${localID(form.id)}/answer`,
-            process.env.PUBLIC_FRONTEND_ORIGIN,
+            ENV.PUBLIC_FRONTEND_ORIGIN,
           ).toString(),
         },
         {},
diff --git a/packages/api/src/modules/gitlab/resolvers/mutation.create-gitlab-issue.ts b/packages/api/src/modules/gitlab/resolvers/mutation.create-gitlab-issue.ts
index 6fc5cec0b..9a72def5c 100644
--- a/packages/api/src/modules/gitlab/resolvers/mutation.create-gitlab-issue.ts
+++ b/packages/api/src/modules/gitlab/resolvers/mutation.create-gitlab-issue.ts
@@ -1,4 +1,4 @@
-import { builder } from '#lib';
+import { builder, ENV } from '#lib';
 
 import { GraphQLError } from 'graphql';
 
@@ -14,6 +14,8 @@ builder.mutationField('createGitlabIssue', (t) =>
     },
     authScopes: () => true,
     async resolve(_, { title, description, isBug }, { user }) {
+      if (!ENV.GITLAB_SUDO_TOKEN) throw new GraphQLError('Intégration à Gitlab désactivée');
+
       let hasGitlabAccount = false;
       if (user) {
         const data = (await fetch(`https://git.inpt.fr/api/v4/users?username=${user.uid}`)
@@ -27,11 +29,12 @@ builder.mutationField('createGitlabIssue', (t) =>
       const url = (path: string) => {
         const result = new URL('/api/v4/' + path, `https://git.inpt.fr/`);
         result.searchParams.set('sudo', (hasGitlabAccount ? user?.uid : undefined) ?? 'issuebot');
-        result.searchParams.set('private_token', process.env.GITLAB_SUDO_TOKEN);
+        result.searchParams.set('private_token', ENV.GITLAB_SUDO_TOKEN!);
+
         return result.toString();
       };
 
-      const response = await fetch(url(`/projects/${process.env.GITLAB_PROJECT_ID}/issues`), {
+      const response = await fetch(url(`/projects/${ENV.GITLAB_PROJECT_ID}/issues`), {
         method: 'POST',
         body: JSON.stringify({
           description:
diff --git a/packages/api/src/modules/gitlab/resolvers/query.code-contributors.ts b/packages/api/src/modules/gitlab/resolvers/query.code-contributors.ts
index 481d13286..22ce1197e 100644
--- a/packages/api/src/modules/gitlab/resolvers/query.code-contributors.ts
+++ b/packages/api/src/modules/gitlab/resolvers/query.code-contributors.ts
@@ -1,4 +1,4 @@
-import { builder, prisma } from '#lib';
+import { builder, ENV, prisma } from '#lib';
 
 import { UserType } from '#modules/users';
 import { GraphQLError } from 'graphql';
@@ -11,7 +11,7 @@ builder.queryField('codeContributors', (t) =>
     authScopes: () => true,
     async resolve() {
       const codeContributors = (await fetch(
-        `https:///git.inpt.fr/api/v4/projects/${process.env.GITLAB_PROJECT_ID}/repository/contributors?pagination=keyset&per_page=1000&order_by=commits&sort=desc`,
+        `https:///git.inpt.fr/api/v4/projects/${ENV.GITLAB_PROJECT_ID}/repository/contributors?pagination=keyset&per_page=1000&order_by=commits&sort=desc`,
       )
         .then(async (r) => r.json())
         .catch(() => {
diff --git a/packages/api/src/modules/global/types/pictured.ts b/packages/api/src/modules/global/types/pictured.ts
index 27bce3800..6724ad0fe 100644
--- a/packages/api/src/modules/global/types/pictured.ts
+++ b/packages/api/src/modules/global/types/pictured.ts
@@ -1,4 +1,4 @@
-import { builder, decodeGlobalID } from '#lib';
+import { builder, decodeGlobalID, ENV } from '#lib';
 import path from 'node:path/posix';
 
 interface Pictured {
@@ -60,7 +60,7 @@ export const PicturedInterface = builder.interfaceRef<Pictured>('Pictured').impl
         const filepath = dark ? pictureFileDark || pictureFile : pictureFile;
         if (!filepath) return '';
 
-        const result = new URL(process.env.PUBLIC_STORAGE_URL);
+        const result = new URL(ENV.PUBLIC_STORAGE_URL);
         result.pathname = path.join(result.pathname, filepath);
         if (timestamp)
           result.searchParams.set('t', (updatedAt?.getTime() ?? Date.now()).toString());
diff --git a/packages/api/src/modules/groups/resolvers/query.groups.ts b/packages/api/src/modules/groups/resolvers/query.groups.ts
index ac7cb8630..105986539 100644
--- a/packages/api/src/modules/groups/resolvers/query.groups.ts
+++ b/packages/api/src/modules/groups/resolvers/query.groups.ts
@@ -1,4 +1,4 @@
-import { builder, prisma } from '#lib';
+import { builder, ENV, prisma } from '#lib';
 
 import { GroupEnumType, GroupType } from '../index.js';
 
@@ -25,7 +25,7 @@ builder.queryField('groups', (t) =>
                   school: {
                     OR: [
                       { id: { in: user?.major?.schools.map(({ id }) => id) ?? [] } },
-                      { uid: process.env.PUBLIC_SCHOOL_UID },
+                      { uid: ENV.PUBLIC_SCHOOL_UID },
                     ],
                   },
                 },
diff --git a/packages/api/src/modules/health-checks/types/health-check.ts b/packages/api/src/modules/health-checks/types/health-check.ts
index 49341d4fd..61aed5d44 100644
--- a/packages/api/src/modules/health-checks/types/health-check.ts
+++ b/packages/api/src/modules/health-checks/types/health-check.ts
@@ -3,8 +3,17 @@ import { builder, graphinx } from '#lib';
 export type HealthCheck = {
   redis: { publish: boolean; subscribe: boolean };
   database: { prisma: boolean };
-  ldap: { school: boolean; internal: boolean };
-  mail: { smtp: boolean };
+  ldap: { school: boolean | null; internal: boolean };
+  mail: { smtp: boolean | null };
+  features: {
+    prometheus: boolean;
+    gitlab: boolean;
+    googleAPIs: boolean;
+    googleWallet: boolean;
+    appleWallet: boolean;
+    oauth: boolean;
+    mailman: boolean;
+  };
 };
 
 export const HealthCheckType = builder.objectRef<HealthCheck>('HealthCheck').implement({
@@ -42,7 +51,9 @@ export const HealthCheckType = builder.objectRef<HealthCheck>('HealthCheck').imp
         ...graphinx('health-checks'),
         fields: (t) => ({
           school: t.boolean({
-            description: 'Whether the LDAP school client is ready',
+            description:
+              'Whether the LDAP school client is ready. Null when no LDAP_SCHOOL has been configured.',
+            nullable: true,
             resolve: ({ school }) => school,
           }),
           internal: t.boolean({
@@ -58,12 +69,50 @@ export const HealthCheckType = builder.objectRef<HealthCheck>('HealthCheck').imp
         ...graphinx('health-checks'),
         fields: (t) => ({
           smtp: t.boolean({
-            description: 'Whether the SMTP client is ready',
+            description: 'Whether the SMTP client is ready. Null if no SMTP_URL is configured.',
+            nullable: true,
             resolve: ({ smtp }) => smtp,
           }),
         }),
       }),
       resolve: ({ mail }) => mail,
     }),
+    features: t.field({
+      type: builder.objectRef<HealthCheck['features']>('FeaturesHealthCheck').implement({
+        ...graphinx('health-checks'),
+        fields: (t) => ({
+          prometheus: t.boolean({
+            description: 'Whether the Prometheus pushgateway is configured',
+            resolve: ({ prometheus }) => prometheus,
+          }),
+          gitlab: t.boolean({
+            description: 'Whether the GitLab API is configured',
+            resolve: ({ gitlab }) => gitlab,
+          }),
+          googleAPIs: t.boolean({
+            description: 'Whether Google APIs are configured',
+            resolve: ({ googleAPIs }) => googleAPIs,
+          }),
+          googleWallet: t.boolean({
+            description: 'Whether Google Wallet integration is configured',
+            resolve: ({ googleWallet }) => googleWallet,
+          }),
+          appleWallet: t.boolean({
+            description: 'Whether Apple Wallet integration is configured',
+            resolve: ({ appleWallet }) => appleWallet,
+          }),
+          oauth: t.boolean({
+            description: 'Whether OAuth login is configured',
+            resolve: ({ oauth }) => oauth,
+          }),
+          mailman: t.boolean({
+            description: 'Whether Mailman automation is configured',
+            authScopes: { admin: true, studentAssociationAdmin: true },
+            resolve: ({ mailman }) => mailman,
+          }),
+        }),
+      }),
+      resolve: ({ features }) => features,
+    }),
   }),
 });
diff --git a/packages/api/src/modules/health-checks/utils/checks.ts b/packages/api/src/modules/health-checks/utils/checks.ts
index 7d9d7e10f..854971acc 100644
--- a/packages/api/src/modules/health-checks/utils/checks.ts
+++ b/packages/api/src/modules/health-checks/utils/checks.ts
@@ -1,9 +1,11 @@
+import { ENV, prisma, publishClient, schoolLdapSettings, subscribeClient } from '#lib';
 import { Client } from '@inp-net/ldap7';
 import ldap from 'ldapjs';
 import { createTransport } from 'nodemailer';
-import { prisma, publishClient, schoolLdapSettings, subscribeClient } from '../../../lib/index.js';
 import type { HealthCheck } from '../types/index.js';
 
+const SMTP_URL = ENV.SMTP_URL;
+
 export const checkHealth = async (): Promise<HealthCheck> => ({
   redis: {
     publish: await publishClient
@@ -22,10 +24,12 @@ export const checkHealth = async (): Promise<HealthCheck> => ({
       .catch(() => false),
   },
   mail: {
-    smtp: await createTransport(process.env.SMTP_URL)
-      .verify()
-      .then(() => true)
-      .catch(() => false),
+    smtp: SMTP_URL
+      ? await createTransport(SMTP_URL)
+          .verify()
+          .then(() => true)
+          .catch(() => false)
+      : null,
   },
   ldap: {
     internal: await new Promise<boolean>((resolve) => {
@@ -35,11 +39,11 @@ export const checkHealth = async (): Promise<HealthCheck> => ({
         client
           .setup(
             {
-              url: process.env.LDAP_URL,
+              url: ENV.LDAP_URL,
             },
-            process.env.LDAP_BIND_DN,
-            process.env.LDAP_BIND_PASSWORD,
-            process.env.LDAP_BASE_DN,
+            ENV.LDAP_BIND_DN,
+            ENV.LDAP_BIND_PASSWORD,
+            ENV.LDAP_BASE_DN,
           )
           .catch(() => resolve(false))
           .then(() => resolve(true));
@@ -58,26 +62,43 @@ export const checkHealth = async (): Promise<HealthCheck> => ({
 
       setTimeout(() => resolve(false), 1000);
     }),
-    school: (
-      await Promise.all(
-        Object.values(schoolLdapSettings.servers).map(
-          (server) =>
-            new Promise((resolve) => {
-              try {
-                const c = ldap.createClient({ url: server.url });
-                c.on('error', () => resolve(false));
-                c.bind('', '', (err) => {
-                  if (err) resolve(false);
-                  resolve(true);
-                });
-              } catch {
-                resolve(false);
-              }
-            }),
-        ),
-      )
-    )
-      // eslint-disable-next-line unicorn/no-await-expression-member
-      .every(Boolean),
+    school: schoolLdapSettings
+      ? (
+          await Promise.all(
+            Object.values(schoolLdapSettings.servers).map(
+              (server) =>
+                new Promise((resolve) => {
+                  try {
+                    const c = ldap.createClient({ url: server.url });
+                    c.on('error', () => resolve(false));
+                    c.bind('', '', (err) => {
+                      if (err) resolve(false);
+                      resolve(true);
+                    });
+                  } catch {
+                    resolve(false);
+                  }
+                }),
+            ),
+          )
+        )
+          // eslint-disable-next-line unicorn/no-await-expression-member
+          .every(Boolean)
+      : null,
+  },
+  features: {
+    prometheus: Boolean(ENV.PROMETHEUS_URL),
+    gitlab: Boolean(ENV.GITLAB_SUDO_TOKEN && ENV.GITLAB_PROJECT_ID),
+    googleAPIs: Boolean(ENV.PUBLIC_GOOGLE_CLIENT_ID && ENV.GOOGLE_CLIENT_SECRET),
+    googleWallet: Boolean(ENV.PUBLIC_GOOGLE_WALLET_ISSUER_ID && ENV.GOOGLE_WALLET_ISSUER_KEY),
+    appleWallet: Boolean(ENV.PUBLIC_GOOGLE_WALLET_ISSUER_ID && ENV.GOOGLE_WALLET_ISSUER_KEY),
+    oauth: Boolean(
+      ENV.PUBLIC_OAUTH_AUTHORIZE_URL &&
+        ENV.PUBLIC_OAUTH_TOKEN_URL &&
+        ENV.PUBLIC_OAUTH_CLIENT_ID &&
+        ENV.OAUTH_CLIENT_SECRET &&
+        ENV.PUBLIC_OAUTH_SCOPES,
+    ),
+    mailman: Boolean(ENV.MAILMAN_API_URL && ENV.MAILMAN_API_TOKEN),
   },
 });
diff --git a/packages/api/src/modules/mails/utils/mailing-lists.ts b/packages/api/src/modules/mails/utils/mailing-lists.ts
index 364fc1ec8..45c801a4f 100644
--- a/packages/api/src/modules/mails/utils/mailing-lists.ts
+++ b/packages/api/src/modules/mails/utils/mailing-lists.ts
@@ -1,8 +1,8 @@
-import { prisma } from '#lib';
+import { ENV, prisma } from '#lib';
 import { GroupType } from '@churros/db/prisma';
 
-const apiUrl = process.env.MAILMAN_API_URL as unknown as string;
-const apiToken = process.env.MAILMAN_API_TOKEN as unknown as string;
+const apiUrl = ENV.MAILMAN_API_URL;
+const apiToken = ENV.MAILMAN_API_TOKEN;
 
 export async function removeMemberFromGroupMailingList(groupId: string, email: string) {
   const { mailingList } = await prisma.group.findUniqueOrThrow({
@@ -16,6 +16,10 @@ export async function removeMemberFromGroupMailingList(groupId: string, email: s
 }
 
 async function removeMemberFromMailingList(mailing: string, email: string) {
+  if (!apiUrl || !apiToken) {
+    console.warn('Mailman API not configured, skipping mailing list removal');
+    return;
+  }
   const endpoint = `${apiUrl}/${mailing}/member/${email}`;
   await fetch(endpoint, {
     method: 'DELETE',
@@ -130,6 +134,10 @@ export async function addMemberToGroupMailingList(groupId: string, email: string
 }
 
 async function addMemberToMailingList(mailingId: string, email: string) {
+  if (!apiUrl || !apiToken) {
+    console.warn('Mailman API not configured, skipping mailing list addition');
+    return;
+  }
   const endpoint = `${apiUrl}/${mailingId}/member`;
   await fetch(endpoint, {
     method: 'POST',
diff --git a/packages/api/src/modules/notifications/utils/send.ts b/packages/api/src/modules/notifications/utils/send.ts
index 3ca9c373e..be5f9443b 100644
--- a/packages/api/src/modules/notifications/utils/send.ts
+++ b/packages/api/src/modules/notifications/utils/send.ts
@@ -1,4 +1,4 @@
-import { prisma } from '#lib';
+import { ENV, prisma } from '#lib';
 import { serverCanSendNotificationToUser } from '#permissions';
 import { type NotificationSubscription, type User } from '@churros/db/prisma';
 import type { MaybePromise } from '@pothos/core';
@@ -8,19 +8,13 @@ import webpush, { WebPushError } from 'web-push';
 import type { PushNotification } from './push-notification.js';
 import { setVapidDetails } from './vapid.js';
 
-/*                  ↓ Vivement churros/churros!165 lol */
-const fireAppCreds: object | null = await new Promise((resolve) => {
-  try {
-    resolve(JSON.parse(process.env.FIREBASE_ADMIN_SERVICE_ACCOUNT_KEY));
-  } catch (error) {
-    console.error(`Invalid firebase admin credentials: ${error}`);
-    resolve(null);
-  }
-});
-
-const firebaseApp = fireAppCreds
+const firebaseApp = ENV.FIREBASE_ADMIN_SERVICE_ACCOUNT_KEY
   ? firebase.initializeApp({
-      credential: firebase.credential.cert(fireAppCreds),
+      credential: firebase.credential.cert({
+        clientEmail: ENV.FIREBASE_ADMIN_SERVICE_ACCOUNT_KEY.client_email,
+        privateKey: ENV.FIREBASE_ADMIN_SERVICE_ACCOUNT_KEY.private_key,
+        projectId: ENV.FIREBASE_ADMIN_SERVICE_ACCOUNT_KEY.project_id,
+      }),
     })
   : undefined;
 
@@ -135,9 +129,9 @@ async function sendWebPushNotification(
     JSON.stringify(notification),
     {
       vapidDetails: {
-        subject: `mailto:${process.env.PUBLIC_CONTACT_EMAIL}`,
-        publicKey: process.env.PUBLIC_VAPID_KEY,
-        privateKey: process.env.VAPID_PRIVATE_KEY,
+        subject: `mailto:${ENV.PUBLIC_CONTACT_EMAIL}`,
+        publicKey: ENV.PUBLIC_VAPID_KEY,
+        privateKey: ENV.VAPID_PRIVATE_KEY,
       },
     },
   );
@@ -155,7 +149,7 @@ async function sendNativePushNotification(
       original: JSON.stringify(notification),
     },
     android: {
-      restrictedPackageName: process.env.PUBLIC_APP_PACKAGE_ID,
+      restrictedPackageName: ENV.PUBLIC_APP_PACKAGE_ID,
       notification: {
         vibrateTimingsMillis: notification.vibrate,
         eventTimestamp: notification.timestamp ? new Date(notification.timestamp) : undefined,
diff --git a/packages/api/src/modules/notifications/utils/vapid.ts b/packages/api/src/modules/notifications/utils/vapid.ts
index de9b9077b..e50c02df5 100644
--- a/packages/api/src/modules/notifications/utils/vapid.ts
+++ b/packages/api/src/modules/notifications/utils/vapid.ts
@@ -1,15 +1,12 @@
+import { ENV } from '#lib';
 import webpush from 'web-push';
 
 export function setVapidDetails() {
-  if (
-    process.env.PUBLIC_CONTACT_EMAIL &&
-    process.env.PUBLIC_VAPID_KEY &&
-    process.env.VAPID_PRIVATE_KEY
-  ) {
+  if (ENV.PUBLIC_CONTACT_EMAIL && ENV.PUBLIC_VAPID_KEY && ENV.VAPID_PRIVATE_KEY) {
     webpush.setVapidDetails(
-      `mailto:${process.env.PUBLIC_CONTACT_EMAIL}`,
-      process.env.PUBLIC_VAPID_KEY,
-      process.env.VAPID_PRIVATE_KEY,
+      `mailto:${ENV.PUBLIC_CONTACT_EMAIL}`,
+      ENV.PUBLIC_VAPID_KEY,
+      ENV.VAPID_PRIVATE_KEY,
     );
   }
 }
diff --git a/packages/api/src/modules/pages/types/page.ts b/packages/api/src/modules/pages/types/page.ts
index 8271970f9..ea74ba860 100644
--- a/packages/api/src/modules/pages/types/page.ts
+++ b/packages/api/src/modules/pages/types/page.ts
@@ -1,4 +1,4 @@
-import { builder, toHtml } from '#lib';
+import { builder, ENV, toHtml } from '#lib';
 import path from 'node:path/posix';
 
 export const PageType = builder.prismaObject('Page', {
@@ -49,7 +49,7 @@ export const PageType = builder.prismaObject('Page', {
       description: 'URLs vers les fichiers inclus sur la page.',
       resolve: async ({ files }) =>
         files.map((file) => {
-          const result = new URL(process.env.PUBLIC_STORAGE_URL);
+          const result = new URL(ENV.PUBLIC_STORAGE_URL);
           result.pathname = path.join(result.pathname, file);
           return result.toString();
         }),
diff --git a/packages/api/src/modules/payments/utils/lydia/accounts.ts b/packages/api/src/modules/payments/utils/lydia/accounts.ts
index 9f588349b..622fe4fcc 100644
--- a/packages/api/src/modules/payments/utils/lydia/accounts.ts
+++ b/packages/api/src/modules/payments/utils/lydia/accounts.ts
@@ -1,10 +1,9 @@
-// Get the Lydia API URL from the environment
-const { PUBLIC_LYDIA_API_URL } = process.env;
+import { ENV } from '#lib';
 
 // Add lydia account to a group
 export async function checkLydiaAccount(vendor_token: string, vendor_id: string): Promise<void> {
   // Check if the lydia account is available
-  const response = await fetch(`${PUBLIC_LYDIA_API_URL}/api/auth/vendortoken.json`, {
+  const response = await fetch(`${ENV.PUBLIC_LYDIA_API_URL}/api/auth/vendortoken.json`, {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
diff --git a/packages/api/src/modules/payments/utils/lydia/pay.ts b/packages/api/src/modules/payments/utils/lydia/pay.ts
index f99b196fb..0603ffa25 100644
--- a/packages/api/src/modules/payments/utils/lydia/pay.ts
+++ b/packages/api/src/modules/payments/utils/lydia/pay.ts
@@ -1,11 +1,8 @@
-import { log, prisma } from '#lib';
+import { ENV, log, prisma } from '#lib';
 import { actualPrice, checkLydiaTransaction, sendLydiaPaymentRequest } from '#modules/payments';
 import type { LydiaTransaction } from '@churros/db/prisma';
 import { GraphQLError } from 'graphql';
 
-// Get the Lydia API URL from the environment
-const { PUBLIC_LYDIA_API_URL } = process.env;
-
 // Send a payment request to a number
 export async function payEventRegistrationViaLydia(
   phone: string,
@@ -94,7 +91,7 @@ export async function payEventRegistrationViaLydia(
 export async function cancelLydiaTransaction(transaction: LydiaTransaction, vendorToken: string) {
   if (!transaction.requestId)
     throw new GraphQLError("Aucune requête pour cette transaction, impossible de l'annuler");
-  await fetch(`${PUBLIC_LYDIA_API_URL}/api/request/cancel.json`, {
+  await fetch(`${ENV.PUBLIC_LYDIA_API_URL}/api/request/cancel.json`, {
     method: 'POST',
     body: new URLSearchParams({
       request_id: transaction.requestId,
diff --git a/packages/api/src/modules/payments/utils/lydia/transactions.ts b/packages/api/src/modules/payments/utils/lydia/transactions.ts
index 13ef51d32..4cc47ab53 100644
--- a/packages/api/src/modules/payments/utils/lydia/transactions.ts
+++ b/packages/api/src/modules/payments/utils/lydia/transactions.ts
@@ -1,11 +1,8 @@
-import { log, prisma } from '#lib';
+import { ENV, log, prisma } from '#lib';
 import type { LydiaTransaction } from '@churros/db/prisma';
 import { GraphQLError } from 'graphql';
 import { createHash } from 'node:crypto';
 
-// Get the Lydia API URL from the environment
-const { PUBLIC_LYDIA_API_URL, LYDIA_WEBHOOK_URL } = process.env;
-
 export function lydiaSignature(
   { privateToken }: { privateToken: string },
   params: Record<string, string>,
@@ -81,7 +78,7 @@ export enum LydiaTransactionState {
 export async function checkLydiaTransaction(transaction: LydiaTransaction) {
   if (!transaction.requestId)
     throw new GraphQLError('Aucune requête pour cette transaction, impossible de checker');
-  const res = await fetch(`${PUBLIC_LYDIA_API_URL}/api/request/state.json`, {
+  const res = await fetch(`${ENV.PUBLIC_LYDIA_API_URL}/api/request/state.json`, {
     method: 'POST',
     body: new URLSearchParams({
       request_id: transaction.requestId,
@@ -116,13 +113,13 @@ export async function sendLydiaPaymentRequest(
     type: 'phone',
     recipient: phone,
     vendor_token: vendorToken,
-    confirm_url: LYDIA_WEBHOOK_URL || '',
+    confirm_url: ENV.LYDIA_WEBHOOK_URL || '',
   };
 
   await log('lydia', 'request/sending', formParams, phone);
 
   // Send the lydia payment request
-  const response = await fetch(`${PUBLIC_LYDIA_API_URL}/api/request/do.json`, {
+  const response = await fetch(`${ENV.PUBLIC_LYDIA_API_URL}/api/request/do.json`, {
     method: 'POST',
     body: new URLSearchParams(formParams),
   });
diff --git a/packages/api/src/modules/payments/utils/paypal/transactions.ts b/packages/api/src/modules/payments/utils/paypal/transactions.ts
index 669d66853..6cad5a326 100644
--- a/packages/api/src/modules/payments/utils/paypal/transactions.ts
+++ b/packages/api/src/modules/payments/utils/paypal/transactions.ts
@@ -1,20 +1,19 @@
+import { ENV } from '#lib';
 import { PayPalTransactionStatus } from '@churros/db/prisma';
 
-const { PUBLIC_PAYPAL_CLIENT_ID, PAYPAL_CLIENT_SECRET, PUBLIC_PAYPAL_API_BASE_URL } = process.env;
-
 async function accessToken() {
-  const response = await fetch(new URL(`/v1/oauth2/token`, PUBLIC_PAYPAL_API_BASE_URL), {
+  const response = await fetch(new URL(`/v1/oauth2/token`, ENV.PUBLIC_PAYPAL_API_BASE_URL), {
     method: 'POST',
     headers: {
       'Content-Type': 'application/x-www-form-urlencoded',
       'Authorization': `Basic ${Buffer.from(
-        `${PUBLIC_PAYPAL_CLIENT_ID}:${PAYPAL_CLIENT_SECRET}`,
+        `${ENV.PUBLIC_PAYPAL_CLIENT_ID}:${ENV.PAYPAL_CLIENT_SECRET}`,
       ).toString('base64')}`,
     },
     body: 'grant_type=client_credentials',
   }).catch((error) => {
     console.error(
-      `Error while getting paypal access token: ${error}, secret=${PAYPAL_CLIENT_SECRET} && id=${PUBLIC_PAYPAL_CLIENT_ID}`,
+      `Error while getting paypal access token: ${error}, secret=${ENV.PAYPAL_CLIENT_SECRET} && id=${ENV.PUBLIC_PAYPAL_CLIENT_ID}`,
     );
     throw error;
   });
@@ -28,9 +27,9 @@ export async function initiatePaypalPayment(
   referenceId: string,
 ): Promise<string> {
   console.info(
-    `Initiating paypal payment with ref ${referenceId}, baseurl ${PUBLIC_PAYPAL_API_BASE_URL}`,
+    `Initiating paypal payment with ref ${referenceId}, baseurl ${ENV.PUBLIC_PAYPAL_API_BASE_URL}`,
   );
-  const response = await fetch(new URL('/v2/checkout/orders', PUBLIC_PAYPAL_API_BASE_URL), {
+  const response = await fetch(new URL('/v2/checkout/orders', ENV.PUBLIC_PAYPAL_API_BASE_URL), {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
@@ -68,7 +67,7 @@ export async function initiatePaypalPayment(
 
 export async function finishPaypalPayment(orderId: string) {
   const response = await fetch(
-    new URL(`/v2/checkout/orders/${orderId}/capture`, PUBLIC_PAYPAL_API_BASE_URL),
+    new URL(`/v2/checkout/orders/${orderId}/capture`, ENV.PUBLIC_PAYPAL_API_BASE_URL),
     {
       method: 'POST',
       headers: {
@@ -117,7 +116,7 @@ export async function checkPaypalPayment(
   orderId: string,
 ): Promise<{ paid: boolean; status: PayPalTransactionStatus }> {
   const response = await fetch(
-    new URL(`/v2/checkout/orders/${orderId}`, PUBLIC_PAYPAL_API_BASE_URL),
+    new URL(`/v2/checkout/orders/${orderId}`, ENV.PUBLIC_PAYPAL_API_BASE_URL),
     {
       method: 'GET',
       headers: {
diff --git a/packages/api/src/modules/search/resolvers/query.search.ts b/packages/api/src/modules/search/resolvers/query.search.ts
index 46306d5eb..bb03a2d6d 100644
--- a/packages/api/src/modules/search/resolvers/query.search.ts
+++ b/packages/api/src/modules/search/resolvers/query.search.ts
@@ -1,55 +1,14 @@
-import { builder, type SearchResult } from '#lib';
+import { builder, ENV, type SearchResult } from '#lib';
 import { searchDocuments } from '#modules/documents';
 import { searchEvents } from '#modules/events';
 import { searchGroups } from '#modules/groups';
 import { searchArticles } from '#modules/posts';
-import {
-  SearchableResourcesEnum,
-  SearchableResourcesEnumConfig,
-  SearchResultType,
-} from '#modules/search';
+import { SearchableResourcesEnum, SearchResultType } from '#modules/search';
 import { searchUsers } from '#modules/users';
 import type { Group, User } from '@churros/db/prisma';
 import { GraphQLError } from 'graphql';
-import { z } from 'zod';
 
-// TODO: valid entire env vars with zod, see !165
-const rankBumps = await new Promise<
-  Partial<Record<keyof typeof SearchableResourcesEnumConfig, number>>
->((resolve) => {
-  const result = z
-    .string()
-    .transform((x, ctx) => {
-      // See https://github.com/colinhacks/zod/issues/2918#issuecomment-1800824755
-      try {
-        return JSON.parse(x);
-      } catch (error) {
-        ctx.addIssue({ code: z.ZodIssueCode.custom, message: `Invalid JSON: ${error}` });
-        return z.NEVER;
-      }
-    })
-    .pipe(
-      z
-        .object(
-          Object.fromEntries(
-            Object.keys(SearchableResourcesEnumConfig).map((key) => [key, z.number()]),
-          ) as Record<keyof typeof SearchableResourcesEnumConfig, z.ZodNumber>,
-        )
-        .partial(),
-    )
-    .describe(
-      "Additive modifier for favoring some types in global search results. A search result's rank is between 0 and 1. JSON object mapping types to rank bumps. Types are values of the `SearchResultType` GraphQL enum. Omitting a value means no bump.",
-    )
-    .safeParse(process.env.PUBLIC_GLOBAL_SEARCH_BUMPS || '{}');
-
-  if (result.success) {resolve(result.data);}
-  else {
-    console.warn(
-      `PUBLIC_GLOBAL_SEARCH_BUMPS is invalid, defaulting to no bumps. Validation errors: ${result.error}. Value: ${process.env.PUBLIC_GLOBAL_SEARCH_BUMPS}`,
-    );
-    resolve({});
-  }
-});
+const rankBumps = ENV.PUBLIC_GLOBAL_SEARCH_BUMPS;
 
 builder.queryField('search', (t) =>
   t.field({
@@ -82,6 +41,7 @@ builder.queryField('search', (t) =>
       // Prefer user and group results by bumping their ranks
       // rank ∈ [0, 1], so bumping to 0.5 kinda ensures only _really_ relevant posts or events are shown before all user and group results
       function bumpRanks(res: ((typeof results)[number] & { status: 'fulfilled' })['value']) {
+        if (!rankBumps) return res;
         return res.map((result) => {
           if (rankBumps.Users && 'user' in result) result.rank += rankBumps.Users;
           if (rankBumps.Groups && 'group' in result) result.rank += rankBumps.Groups;
diff --git a/packages/api/src/modules/search/types/searchable-resources.ts b/packages/api/src/modules/search/types/searchable-resources.ts
index 9526d313e..80e8cc610 100644
--- a/packages/api/src/modules/search/types/searchable-resources.ts
+++ b/packages/api/src/modules/search/types/searchable-resources.ts
@@ -1,28 +1,33 @@
-import { builder } from '#lib';
-
-export const SearchableResourcesEnumConfig = {
-  Users: {
-    description: 'Utilisateur·ices',
-    value: 'Users',
-  },
-  Groups: {
-    description: 'Groupes',
-    value: 'Groups',
-  },
-  Events: {
-    description: 'Événements',
-    value: 'Events',
-  },
-  Articles: {
-    description: 'Posts',
-    value: 'Articles',
-  },
-  Documents: {
-    description: 'Documents',
-    value: 'Documents',
-  },
-} as const;
+import { builder, environmentSchema } from '#lib';
 
 export const SearchableResourcesEnum = builder.enumType('SearchableResources', {
-  values: SearchableResourcesEnumConfig,
+  values: {
+    Users: {
+      description: 'Utilisateur·ices',
+      value: 'Users',
+    },
+    Groups: {
+      description: 'Groupes',
+      value: 'Groups',
+    },
+    Events: {
+      description: 'Événements',
+      value: 'Events',
+    },
+    Articles: {
+      description: 'Posts',
+      value: 'Articles',
+    },
+    Documents: {
+      description: 'Documents',
+      value: 'Documents',
+    },
+  } satisfies Record<
+    // Ensures that we update the definition of the PUBLIC_GLOBAL_SEARCH_BUMPS environment variable when adding a new value
+    keyof NonNullable<typeof environmentSchema._type.PUBLIC_GLOBAL_SEARCH_BUMPS>,
+    {
+      description: string;
+      value: string;
+    }
+  >,
 });
diff --git a/packages/api/src/modules/ticketing/resolvers/mutation.create-apple-wallet-pass.ts b/packages/api/src/modules/ticketing/resolvers/mutation.create-apple-wallet-pass.ts
index e2a70f4c5..1b2aca569 100644
--- a/packages/api/src/modules/ticketing/resolvers/mutation.create-apple-wallet-pass.ts
+++ b/packages/api/src/modules/ticketing/resolvers/mutation.create-apple-wallet-pass.ts
@@ -3,6 +3,7 @@ import {
   canCreateAppleWalletPasses,
   createAppleWalletPass,
   ensureGlobalId,
+  ENV,
   localID,
   log,
   prisma,
@@ -41,7 +42,7 @@ builder.mutationField('createAppleWalletPass', (t) =>
           path.join(storageRoot(), destination),
           await createAppleWalletPass(booking).then((pass) => pass.asBuffer()),
         );
-        return new URL(destination, process.env.PUBLIC_STORAGE_URL).toString();
+        return new URL(destination, ENV.PUBLIC_STORAGE_URL).toString();
       } catch (error) {
         await log('bookings', 'create-pass/apple/error', { booking, error }, booking.id, user);
         throw new GraphQLError('Une erreur est survenue pendant la création du pass');
diff --git a/packages/api/src/modules/ticketing/resolvers/mutation.create-google-wallet-pass.ts b/packages/api/src/modules/ticketing/resolvers/mutation.create-google-wallet-pass.ts
index 81b643a87..c0d7f587d 100644
--- a/packages/api/src/modules/ticketing/resolvers/mutation.create-google-wallet-pass.ts
+++ b/packages/api/src/modules/ticketing/resolvers/mutation.create-google-wallet-pass.ts
@@ -1,8 +1,10 @@
-import { builder, ensureGlobalId, makeGoogleWalletObject, prisma } from '#lib';
+import { builder, ensureGlobalId, ENV, makeGoogleWalletObject, prisma } from '#lib';
 import { GraphQLError } from 'graphql';
 import jwt from 'jsonwebtoken';
 import { ZodError } from 'zod';
 
+const issuer = ENV.GOOGLE_WALLET_ISSUER_KEY;
+
 builder.mutationField('createGoogleWalletPass', (t) =>
   t.string({
     description: `Créer un pass Google Wallet pour une réservation donnée. Renvoie l'URL a utiliser pour ajouter le pass à Google Wallet.`,
@@ -19,10 +21,10 @@ builder.mutationField('createGoogleWalletPass', (t) =>
       });
       if (!booking) throw new GraphQLError('Réservation introuvable');
 
-      const credentials = JSON.parse(process.env.GOOGLE_WALLET_ISSUER_KEY);
+      if (!issuer) throw new GraphQLError("L'intégration Google Wallet est désactivée.");
 
       const claims = {
-        iss: credentials.client_email,
+        iss: issuer.client_email,
         aud: 'google',
         origins: [],
         typ: 'savetowallet',
@@ -31,7 +33,7 @@ builder.mutationField('createGoogleWalletPass', (t) =>
         },
       };
 
-      const token = jwt.sign(claims, credentials.private_key, { algorithm: 'RS256' });
+      const token = jwt.sign(claims, issuer.private_key, { algorithm: 'RS256' });
       return `https://pay.google.com/gp/v/save/${token}`;
     },
   }),
diff --git a/packages/api/src/modules/ticketing/resolvers/mutation.upsert-registration.ts b/packages/api/src/modules/ticketing/resolvers/mutation.upsert-registration.ts
index cc344b6ef..62cb111bb 100644
--- a/packages/api/src/modules/ticketing/resolvers/mutation.upsert-registration.ts
+++ b/packages/api/src/modules/ticketing/resolvers/mutation.upsert-registration.ts
@@ -1,11 +1,11 @@
-import { builder, log, prisma, publish, sendMail } from '#lib';
+import { builder, ENV, log, prisma, publish, sendMail } from '#lib';
 import { PaymentMethodEnum } from '#modules/payments';
+import { canSeeTicket, placesLeft, RegistrationType } from '#modules/ticketing';
 import { getUserWithContributesTo, userCanAccessEvent, userCanManageEvent } from '#permissions';
 import { PrismaClientKnownRequestError } from '@churros/db/prisma/runtime/library';
 import { isFuture, isPast } from 'date-fns';
 import { GraphQLError } from 'graphql';
 import * as qrcode from 'qrcode';
-import { RegistrationType, canSeeTicket, placesLeft } from '../index.js';
 
 // TODO remove, not used by @churros/app anymore
 builder.mutationField('upsertRegistration', (t) =>
@@ -286,10 +286,7 @@ builder.mutationField('upsertRegistration', (t) =>
             beneficiary: beneficiary ?? null,
             bookingCode: pseudoID,
             eventTitle: ticket.event.title,
-            bookingLink: new URL(
-              `/bookings/${pseudoID}`,
-              process.env.PUBLIC_FRONTEND_ORIGIN,
-            ).toString(),
+            bookingLink: new URL(`/bookings/${pseudoID}`, ENV.PUBLIC_FRONTEND_ORIGIN).toString(),
           },
           {
             attachments: {
diff --git a/packages/api/src/modules/users/resolvers/mutation.create-password-reset.ts b/packages/api/src/modules/users/resolvers/mutation.create-password-reset.ts
index 207f0562f..8d4cf9e12 100644
--- a/packages/api/src/modules/users/resolvers/mutation.create-password-reset.ts
+++ b/packages/api/src/modules/users/resolvers/mutation.create-password-reset.ts
@@ -1,7 +1,6 @@
-import { builder, log, prisma, sendMail } from '#lib';
-import { emailLoginPrismaClauses } from '#modules/users/utils';
+import { builder, ENV, log, prisma, sendMail } from '#lib';
+import { emailLoginPrismaClauses, PASSWORD_RESET_EXPIRES_AFTER } from '#modules/users/utils';
 import { addSeconds } from 'date-fns';
-import { PASSWORD_RESET_EXPIRES_AFTER } from '../utils/password-resets.js';
 
 // TODO rename to request-password-reset
 builder.mutationField('createPasswordReset', (t) =>
@@ -34,7 +33,7 @@ builder.mutationField('createPasswordReset', (t) =>
 
       const url = new URL(
         `login/reset/${result.id.split(':', 2)[1]!.toUpperCase()}`,
-        process.env.PUBLIC_FRONTEND_ORIGIN,
+        ENV.PUBLIC_FRONTEND_ORIGIN,
       );
 
       await sendMail(
diff --git a/packages/api/src/modules/users/resolvers/mutation.login.ts b/packages/api/src/modules/users/resolvers/mutation.login.ts
index 3e7510095..11bd7c628 100644
--- a/packages/api/src/modules/users/resolvers/mutation.login.ts
+++ b/packages/api/src/modules/users/resolvers/mutation.login.ts
@@ -97,49 +97,33 @@ export async function login(
       },
     });
 
-    if (userCandidate) {
-      // Potential security risk, disabled for now
-      // if (!userCandidate.emailValidated) {
-      //   await log('login', 'fail', {
-      //     uidOrEmail,
-      //     err: "user's email is not validated yet",
-      //     userCandidate,
-      //   });
-
-      //   throw new Error(
-      //     `Ton adresse email n'est pas encore validée. Vérifie ta boîte mail (${userCandidate.email}), tu a du recevoir un mail de ${process.env.PUBLIC_SUPPORT_EMAIL}.`,
-      //   );
-      // }
-
-      // eslint-disable-next-line unicorn/no-lonely-if
-      if (await verifyPassword(userCandidate.churrosPassword, password)) {
-        if (needsManualValidation(userCandidate)) {
-          await log('login', 'fail-awaiting-validation', {
-            uidOrEmail,
-            err: 'user is awaiting validation',
-            userCandidate,
-          });
+    if (userCandidate && (await verifyPassword(userCandidate.churrosPassword, password))) {
+      if (needsManualValidation(userCandidate)) {
+        await log('login', 'fail-awaiting-validation', {
+          uidOrEmail,
+          err: 'user is awaiting validation',
+          userCandidate,
+        });
 
-          throw new AwaitingValidationError();
-        } else {
-          await log('login', 'fail-stuck-in-limbo', {
-            uidOrEmail,
-            err: 'user does not need manual validation but no user was created from the userCandidate',
-            userCandidate,
-          });
+        throw new AwaitingValidationError();
+      } else {
+        await log('login', 'fail-stuck-in-limbo', {
+          uidOrEmail,
+          err: 'user does not need manual validation but no user was created from the userCandidate',
+          userCandidate,
+        });
 
-          await notify(await prisma.user.findMany({ where: { admin: true } }), {
-            title: `${userCandidate.email} est bloqué dans une étape intermédiaire`,
-            body: "Il a un userCandidate mais pas de user, alors qu'aucune validation manuelle n'est nécéssaire.",
-            data: {
-              channel: NotificationChannel.Other,
-              goto: `/signups/edit/${userCandidate.email}`,
-              group: undefined,
-            },
-          });
+        await notify(await prisma.user.findMany({ where: { admin: true } }), {
+          title: `${userCandidate.email} est bloqué dans une étape intermédiaire`,
+          body: "Il a un userCandidate mais pas de user, alors qu'aucune validation manuelle n'est nécéssaire.",
+          data: {
+            channel: NotificationChannel.Other,
+            goto: `/signups/edit/${userCandidate.email}`,
+            group: undefined,
+          },
+        });
 
-          throw new GraphQLError("Ton compte n'est pas encore prêt. Réessaie plus tard.");
-        }
+        throw new GraphQLError("Ton compte n'est pas encore prêt. Réessaie plus tard.");
       }
     }
 
diff --git a/packages/api/src/modules/users/resolvers/mutation.register-google-credential.ts b/packages/api/src/modules/users/resolvers/mutation.register-google-credential.ts
index fd63a11d3..df0923da8 100644
--- a/packages/api/src/modules/users/resolvers/mutation.register-google-credential.ts
+++ b/packages/api/src/modules/users/resolvers/mutation.register-google-credential.ts
@@ -1,4 +1,4 @@
-import { builder, log, prisma } from '#lib';
+import { builder, ENV, log, prisma } from '#lib';
 import * as Google from 'google-auth-library';
 import { GraphQLError } from 'graphql';
 
@@ -14,12 +14,9 @@ builder.mutationField('registerGoogleCredential', (t) =>
       if (!user) throw new GraphQLError('User not found');
 
       const client = new Google.OAuth2Client({
-        clientId: process.env.PUBLIC_GOOGLE_CLIENT_ID,
-        clientSecret: process.env.GOOGLE_CLIENT_SECRET,
-        redirectUri: new URL(
-          '/connect/google/callback',
-          process.env.PUBLIC_FRONTEND_ORIGIN,
-        ).toString(),
+        clientId: ENV.PUBLIC_GOOGLE_CLIENT_ID,
+        clientSecret: ENV.GOOGLE_CLIENT_SECRET,
+        redirectUri: new URL('/connect/google/callback', ENV.PUBLIC_FRONTEND_ORIGIN).toString(),
       });
       const { tokens } = await client.getToken(code.toString()).catch((error_) => {
         console.error(error_);
diff --git a/packages/api/src/modules/users/resolvers/mutation.start-signup.ts b/packages/api/src/modules/users/resolvers/mutation.start-signup.ts
index c1e58dd7c..55ddb70da 100644
--- a/packages/api/src/modules/users/resolvers/mutation.start-signup.ts
+++ b/packages/api/src/modules/users/resolvers/mutation.start-signup.ts
@@ -1,4 +1,4 @@
-import { builder, ensureGlobalId, log, prisma, sendMail } from '#lib';
+import { builder, ensureGlobalId, ENV, log, prisma, sendMail } from '#lib';
 import { Email, UIDScalar, URLScalar } from '#modules/global';
 import { UserCandidateType } from '#modules/users/types';
 import { createUid, hashPassword } from '#modules/users/utils';
@@ -79,11 +79,11 @@ builder.mutationField('startSignup', (t) =>
       if (
         !user?.admin &&
         !user?.adminOfStudentAssociations.length &&
-        process.env.PUBLIC_DEACTIVATE_SIGNUPS === 'true' &&
+        ENV.PUBLIC_DEACTIVATE_SIGNUPS === 'true' &&
         !quickSignupCode
       ) {
         throw new GraphQLError(
-          process.env.PUBLIC_DEACTIVATE_SIGNUPS_MESSAGE || 'Les inscriptions sont désactivées.',
+          ENV.PUBLIC_DEACTIVATE_SIGNUPS_MESSAGE || 'Les inscriptions sont désactivées.',
         );
       }
 
diff --git a/packages/api/src/modules/users/resolvers/mutation.update-user.ts b/packages/api/src/modules/users/resolvers/mutation.update-user.ts
index 36e721c07..926056d1d 100644
--- a/packages/api/src/modules/users/resolvers/mutation.update-user.ts
+++ b/packages/api/src/modules/users/resolvers/mutation.update-user.ts
@@ -1,9 +1,9 @@
-import { builder, log, objectValuesFlat, prisma, purgeSessionsUser } from '#lib';
+import { builder, ENV, log, objectValuesFlat, prisma, purgeSessionsUser } from '#lib';
 import { DateTimeScalar, UIDScalar } from '#modules/global';
+import { requestEmailChange, UserType } from '#modules/users';
 import { userIsAdminOf } from '#permissions';
 import { GraphQLError } from 'graphql';
 import { phone as parsePhoneNumber } from 'phone';
-import { UserType, requestEmailChange } from '../index.js';
 
 /** Updates a user. */
 builder.mutationField('updateUser', (t) =>
@@ -135,7 +135,7 @@ builder.mutationField('updateUser', (t) =>
           {},
           email,
           targetUser.id,
-          new URL('/validate-email/[token]', process.env.PUBLIC_FRONTEND_ORIGIN),
+          new URL('/validate-email/[token]', ENV.PUBLIC_FRONTEND_ORIGIN),
         );
       }
 
diff --git a/packages/api/src/modules/users/utils/passwords.ts b/packages/api/src/modules/users/utils/passwords.ts
index 749e0ca45..779237557 100644
--- a/packages/api/src/modules/users/utils/passwords.ts
+++ b/packages/api/src/modules/users/utils/passwords.ts
@@ -1,3 +1,4 @@
+import { ENV } from '#lib';
 import * as argon2 from 'argon2';
 
 export async function verifyPassword(hash: string, password: string): Promise<boolean> {
@@ -11,6 +12,7 @@ export async function hashPassword(password: string): Promise<string> {
 }
 
 export async function verifyMasterKey(password: string): Promise<boolean> {
-  if (!process.env.MASTER_PASSWORD_HASH) return false;
-  return verifyPassword(process.env.MASTER_PASSWORD_HASH, password);
+  const masterHash = ENV.MASTER_PASSWORD_HASH;
+  if (!masterHash) return false;
+  return verifyPassword(masterHash, password);
 }
diff --git a/packages/api/src/modules/users/utils/registration.ts b/packages/api/src/modules/users/utils/registration.ts
index 7c711db63..edb4450a0 100644
--- a/packages/api/src/modules/users/utils/registration.ts
+++ b/packages/api/src/modules/users/utils/registration.ts
@@ -1,4 +1,4 @@
-import { log, prisma, sendMail } from '#lib';
+import { ENV, log, prisma, sendMail } from '#lib';
 import {
   CredentialType,
   type Major,
@@ -87,7 +87,7 @@ export const saveUser = async (
   await sendMail(
     'welcome',
     email,
-    { url: new URL('/welcome/', process.env.PUBLIC_FRONTEND_ORIGIN).toString() },
+    { url: new URL('/welcome/', ENV.PUBLIC_FRONTEND_ORIGIN).toString() },
     {},
   );
 
diff --git a/packages/api/src/server/auth/logout.ts b/packages/api/src/server/auth/logout.ts
index a5377be3c..aeadb84b4 100644
--- a/packages/api/src/server/auth/logout.ts
+++ b/packages/api/src/server/auth/logout.ts
@@ -1,3 +1,4 @@
+import { ENV } from '#lib';
 import { api } from '../express.js';
 import { AUTHED_VIA_COOKIE_NAME } from './constants.js';
 
@@ -6,7 +7,7 @@ api.get('/auth/logout', (req, res, next) => {
     if (error) return next(error);
 
     res.cookie(AUTHED_VIA_COOKIE_NAME, '', { httpOnly: false, secure: false });
-    res.redirect(process.env.PUBLIC_OAUTH_LOGOUT_URL);
+    res.redirect(ENV.PUBLIC_OAUTH_LOGOUT_URL ?? ENV.PUBLIC_FRONTEND_ORIGIN);
   });
 });
 
diff --git a/packages/api/src/server/auth/oauth2.ts b/packages/api/src/server/auth/oauth2.ts
index 187aa0953..87e030900 100644
--- a/packages/api/src/server/auth/oauth2.ts
+++ b/packages/api/src/server/auth/oauth2.ts
@@ -1,4 +1,4 @@
-import { getSessionUser, prisma } from '#lib';
+import { ENV, getSessionUser, prisma } from '#lib';
 import { nanoid } from 'nanoid';
 import passport from 'passport';
 import OAuth2Strategy, { type VerifyCallback } from 'passport-oauth2';
@@ -7,12 +7,13 @@ import { AUTHED_VIA_COOKIE_NAME, AuthedViaCookie } from './constants.js';
 
 const oauth2Strategy = new OAuth2Strategy(
   {
-    authorizationURL: process.env.PUBLIC_OAUTH_AUTHORIZE_URL,
-    tokenURL: process.env.PUBLIC_OAUTH_TOKEN_URL,
-    clientID: process.env.PUBLIC_OAUTH_CLIENT_ID,
-    clientSecret: process.env.OAUTH_CLIENT_SECRET,
+    // TODO: _actually_ support not configuring PUBLIC_OAUTH_*
+    authorizationURL: ENV.PUBLIC_OAUTH_AUTHORIZE_URL ?? '',
+    tokenURL: ENV.PUBLIC_OAUTH_TOKEN_URL ?? '',
+    clientID: ENV.PUBLIC_OAUTH_CLIENT_ID ?? '',
+    clientSecret: ENV.OAUTH_CLIENT_SECRET ?? '',
     callbackURL: '/auth/oauth2/callback',
-    scope: process.env.PUBLIC_OAUTH_SCOPES.split(','),
+    scope: ENV.PUBLIC_OAUTH_SCOPES ?? [],
   },
   async function (
     _accessToken: string,
@@ -21,7 +22,13 @@ const oauth2Strategy = new OAuth2Strategy(
     cb: VerifyCallback,
   ) {
     try {
-      const userSession = await getSessionUser(profile[process.env.OAUTH_UID_KEY] as string);
+      const uidKey = ENV.OAUTH_UID_KEY;
+      if (!uidKey) {
+        cb('OAUTH_UID_KEY is not set', false);
+        return;
+      }
+
+      const userSession = await getSessionUser(profile[uidKey] as string);
 
       if (!userSession) {
         cb('This account is not linked to any user', false);
@@ -39,8 +46,13 @@ oauth2Strategy.userProfile = async function (
   accessToken: string,
   done: (error: unknown, profile: unknown) => void,
 ) {
+  const userinfoUrl = ENV.PUBLIC_OAUTH_USER_INFO_URL;
+  if (!userinfoUrl) {
+    done('PUBLIC_OAUTH_USER_INFO_URL is not set', {});
+    return;
+  }
   try {
-    const res = await fetch(process.env.PUBLIC_OAUTH_USER_INFO_URL, {
+    const res = await fetch(userinfoUrl, {
       headers: {
         Authorization: `Bearer ${accessToken}`,
       },
@@ -65,7 +77,7 @@ api.get('/auth/oauth2', (req, res, next) => {
     // @ts-expect-error undocumented option
     callbackURL: new URL(
       `/auth/oauth2/callback?${forwardSearchParams(searchParams, ['from', 'native'])}`,
-      process.env.PUBLIC_API_URL,
+      ENV.PUBLIC_API_URL,
     ).toString(),
   })(req, res, next);
 });
@@ -105,10 +117,10 @@ api.get(
     let redirectURL: string;
     if (searchParams.get('native') === '1') {
       // Native app logins get redirected to the app via a custom URL scheme whose name is the package ID
-      redirectURL = `${process.env.PUBLIC_APP_PACKAGE_ID}://login/done?${outputParams}`;
+      redirectURL = `${ENV.PUBLIC_APP_PACKAGE_ID}://login/done?${outputParams}`;
     } else {
       // Web logins get redirected to the frontend
-      redirectURL = new URL('/login/done', process.env.PUBLIC_FRONTEND_ORIGIN).toString();
+      redirectURL = new URL('/login/done', ENV.PUBLIC_FRONTEND_ORIGIN).toString();
     }
 
     res.redirect(redirectURL);
diff --git a/packages/api/src/server/auth/session.ts b/packages/api/src/server/auth/session.ts
index 1d443639a..3fa1075fc 100644
--- a/packages/api/src/server/auth/session.ts
+++ b/packages/api/src/server/auth/session.ts
@@ -1,4 +1,4 @@
-import { daysToSeconds, getSessionUser, redisClient } from '#lib';
+import { daysToSeconds, ENV, getSessionUser, redisClient } from '#lib';
 import { type User } from '@churros/db/prisma';
 import RedisStore from 'connect-redis';
 import session from 'express-session';
@@ -30,7 +30,7 @@ const redisStore = new RedisStore({
 
 export default session({
   store: redisStore,
-  secret: process.env.SESSION_SECRET,
+  secret: ENV.SESSION_SECRET,
   resave: false,
   saveUninitialized: false,
   cookie: {
diff --git a/packages/api/src/server/booking-pdf.ts b/packages/api/src/server/booking-pdf.ts
index 85d28a496..d606db75b 100644
--- a/packages/api/src/server/booking-pdf.ts
+++ b/packages/api/src/server/booking-pdf.ts
@@ -1,4 +1,4 @@
-import { prisma } from '#lib';
+import { ENV, prisma } from '#lib';
 import type { Prisma } from '@churros/db/prisma';
 import pdfMakePrinter from 'pdfmake';
 import type { TFontDictionary } from 'pdfmake/interfaces';
@@ -97,7 +97,7 @@ export function generatePDF(
                     text: registration.id.replace(/^r:/, '').toUpperCase() + '\n',
                     link: new URL(
                       `/bookings/${registration.id}`,
-                      process.env.PUBLIC_FRONTEND_ORIGIN,
+                      ENV.PUBLIC_FRONTEND_ORIGIN,
                     ).toString(),
                     style: {
                       font: 'SpaceMono',
diff --git a/packages/api/src/server/express.ts b/packages/api/src/server/express.ts
index bf9fadd0e..df6ef73bf 100644
--- a/packages/api/src/server/express.ts
+++ b/packages/api/src/server/express.ts
@@ -1,5 +1,5 @@
 /* eslint-disable unicorn/prefer-module */
-import { context } from '#lib';
+import { context, ENV } from '#lib';
 import { checkHealth } from '#modules/health-checks/utils';
 import cors from 'cors';
 import { minutesToMilliseconds } from 'date-fns';
@@ -40,7 +40,7 @@ api.use(
 
 export async function startApiServer() {
   // load passport strategies
-  if (process.env.PUBLIC_OAUTH_ENABLED.trim() === '1') {
+  if (ENV.PUBLIC_OAUTH_ENABLED.trim() === '1') {
     import('./auth/oauth2.js');
     import('./auth/logout.js');
   }
diff --git a/packages/api/src/server/graphql.ts b/packages/api/src/server/graphql.ts
index 70d442aec..6d954ff19 100644
--- a/packages/api/src/server/graphql.ts
+++ b/packages/api/src/server/graphql.ts
@@ -1,11 +1,11 @@
-import { context, customErrorMap, inDevelopment } from '#lib';
+import { context, customErrorMap, ENV, inDevelopment } from '#lib';
 import { Prisma } from '@churros/db/prisma';
 import { ForbiddenError } from '@pothos/plugin-scope-auth';
 import { createFetch } from '@whatwg-node/fetch';
 import { useTrimInputs } from 'envelop-trim-inputs';
 import { GraphQLError } from 'graphql';
 import { createYoga } from 'graphql-yoga';
-import { ZodError, z } from 'zod';
+import { z, ZodError } from 'zod';
 import { schema } from '../schema.js';
 import { api } from './express.js';
 
@@ -109,7 +109,7 @@ api.get('/', (req, res) => {
 <body>
   <h1>Churros API</h1>
   <p>Bienvenue ${user?.firstName ?? ''} sur l'API de Churros.</p>
-  <p><strong><a href="${new URL(process.env.PUBLIC_FRONTEND_ORIGIN).toString()}">
+  <p><strong><a href="${new URL(ENV.PUBLIC_FRONTEND_ORIGIN).toString()}">
     Retourner à l'accueil</a></strong></p>
   <p><a href="/graphql">GraphiQL (pour les développeurs et les curieux)</a></p>
   <p><a href="https://git.inpt.fr/inp-net/churros">Code source</a></p>
diff --git a/packages/app/schema.graphql b/packages/app/schema.graphql
index 2c6ebe3cf..6ddf6ad49 100644
--- a/packages/app/schema.graphql
+++ b/packages/app/schema.graphql
@@ -1236,6 +1236,37 @@ type FamilyTree {
   users: [User!]!
 }
 
+type FeaturesHealthCheck @graphinx(module: "health-checks") {
+  """
+  Whether Apple Wallet integration is configured
+  """
+  appleWallet: Boolean!
+  """
+  Whether the GitLab API is configured
+  """
+  gitlab: Boolean!
+  """
+  Whether Google APIs are configured
+  """
+  googleAPIs: Boolean!
+  """
+  Whether Google Wallet integration is configured
+  """
+  googleWallet: Boolean!
+  """
+  Whether Mailman automation is configured
+  """
+  mailman: Boolean!
+  """
+  Whether OAuth login is configured
+  """
+  oauth: Boolean!
+  """
+  Whether the Prometheus pushgateway is configured
+  """
+  prometheus: Boolean!
+}
+
 scalar File
 
 """
@@ -1865,6 +1896,7 @@ Results of a health self-check
 """
 type HealthCheck {
   database: DatabaseHealthCheck!
+  features: FeaturesHealthCheck!
   ldap: LdapHealthCheck!
   mail: MailHealthCheck!
   redis: RedisHealthCheck!
@@ -1924,9 +1956,9 @@ type LdapHealthCheck @graphinx(module: "health-checks") {
   """
   internal: Boolean!
   """
-  Whether the LDAP school client is ready
+  Whether the LDAP school client is ready. Null when no LDAP_SCHOOL has been configured.
   """
-  school: Boolean!
+  school: Boolean
 }
 
 """
@@ -2008,9 +2040,9 @@ type LydiaAccount implements Node {
 
 type MailHealthCheck @graphinx(module: "health-checks") {
   """
-  Whether the SMTP client is ready
+  Whether the SMTP client is ready. Null if no SMTP_URL is configured.
   """
-  smtp: Boolean!
+  smtp: Boolean
 }
 
 """
diff --git a/scripts/sync-with-example-dotenv.ts b/scripts/sync-with-example-dotenv.ts
index 27f8f8986..1b4bce5ec 100644
--- a/scripts/sync-with-example-dotenv.ts
+++ b/scripts/sync-with-example-dotenv.ts
@@ -48,10 +48,13 @@ if (keysNotInExample.length > 0) {
   console.info('Adding the following to .env.example:');
   console.info(quoteblock(dotenv.serialize(toAddToExample).trim()));
   fs.writeFileSync(examplePath, dotenv.serialize({ ...example, ...toAddToExample }));
-  console.info(bold('Remember to also update packages/api/src/global.d.ts, add the following:'));
+  console.info(bold('Remember to also update packages/api/src/env.ts, add the following:'));
   console.info(
     Object.entries(toAddToExample)
-      .map(([key, { description }]) => `/** ${description} */\n${key}: string;`)
+      .map(
+        ([key, { description }]) =>
+          `${key}: z.string()/* refine the schema here if relevant */.describe('${description}'),`,
+      )
       .join('\n'),
   );
 }
diff --git a/yarn.lock b/yarn.lock
index ac5a81a3f..828372974 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -845,6 +845,7 @@ __metadata:
     "@types/jsonwebtoken": "npm:^9.0.7"
     "@types/ldapjs": "npm:^3.0.6"
     "@types/lodash.countby": "npm:^4.6.9"
+    "@types/lodash.get": "npm:^4"
     "@types/lodash.omit": "npm:^4.5.9"
     "@types/lodash.range": "npm:^3.2.9"
     "@types/mjml": "npm:^4.7.4"
@@ -869,6 +870,7 @@ __metadata:
     argon2: "npm:^0.41.1"
     barrelsby: "npm:^2.8.1"
     bunyan: "npm:^1.8.15"
+    chalk: "npm:^5.3.0"
     cli: "npm:^1.0.1"
     cli-progress: "npm:^3.12.0"
     colord: "npm:^2.9.3"
@@ -911,6 +913,7 @@ __metadata:
     linkify-plugin-mention: "npm:^4.1.3"
     linkifyjs: "npm:^4.1.3"
     lodash.countby: "npm:^4.6.0"
+    lodash.get: "npm:^4.4.2"
     lodash.groupby: "npm:^4.6.0"
     lodash.omit: "npm:^4.5.0"
     lodash.range: "npm:^3.2.0"
@@ -5899,6 +5902,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/lodash.get@npm:^4":
+  version: 4.4.9
+  resolution: "@types/lodash.get@npm:4.4.9"
+  dependencies:
+    "@types/lodash": "npm:*"
+  checksum: 10c0/934ae4f02831afdb9216cb5fcb702f8f4e0b45e13f2d10ed9c7ce7e891800e5dea726b513c98b8370d6292d42ad7745c622ae75733676746b711bea95b6259d5
+  languageName: node
+  linkType: hard
+
 "@types/lodash.groupby@npm:^4.6.9":
   version: 4.6.9
   resolution: "@types/lodash.groupby@npm:4.6.9"
@@ -14735,6 +14747,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"lodash.get@npm:^4.4.2":
+  version: 4.4.2
+  resolution: "lodash.get@npm:4.4.2"
+  checksum: 10c0/48f40d471a1654397ed41685495acb31498d5ed696185ac8973daef424a749ca0c7871bf7b665d5c14f5cc479394479e0307e781f61d5573831769593411be6e
+  languageName: node
+  linkType: hard
+
 "lodash.groupby@npm:^4.6.0":
   version: 4.6.0
   resolution: "lodash.groupby@npm:4.6.0"