diff --git a/.golangci.toml b/.golangci.toml
index d2125c2..b19c4ee 100644
--- a/.golangci.toml
+++ b/.golangci.toml
@@ -97,7 +97,7 @@ linters = ["govet"]
 
 [[linters.exclusions.rules]]
 path    = "_test\\.go"
-linters = ["errchkjson", "gocognit", "godoclint", "gosec"]
+linters = ["errchkjson", "gocognit", "godoclint", "gosec", "lll"]
 
 [formatters]
 enable = ["gofumpt", "goimports"]
diff --git a/README.md b/README.md
index c876714..b52f766 100644
--- a/README.md
+++ b/README.md
@@ -54,6 +54,7 @@ The daemon runs `restic` in a short-lived worker container named `volkeep-worker
 | `VOLKEEP_HOST`           | required        | Identifier for `restic snapshots --host` |
 | `RESTIC_REPOSITORY`      | required        | Restic URI, or `volume:<name>` (local)   |
 | `RESTIC_PASSWORD`        | required        | Restic repo password                     |
+| `RESTIC_*`               | —               | Forwarded to workers (tuning)            |
 | `AWS_*`                  | —               | Forwarded to workers (S3 backends)       |
 | `RCLONE_*`               | —               | Forwarded to workers (rclone backends)   |
 | `VOLKEEP_RETENTION_DAYS` | `5`             | Daily snapshots to keep                  |
diff --git a/internal/restic/restic.go b/internal/restic/restic.go
index de41c9c..a5058c6 100644
--- a/internal/restic/restic.go
+++ b/internal/restic/restic.go
@@ -13,15 +13,21 @@ const (
 	ExitRepoMissing = 10
 )
 
-// WorkerEnv returns the env forwarded to every worker:
-// repo credentials plus the AWS_* and RCLONE_* entries from environ.
+// WorkerEnv returns the env forwarded to every worker: the resolved repo
+// credentials plus the RESTIC_*, AWS_*, and RCLONE_* entries from environ.
 func WorkerEnv(repository, password string, environ []string) []string {
 	env := []string{
 		"RESTIC_REPOSITORY=" + repository,
 		"RESTIC_PASSWORD=" + password,
 	}
 	for _, kv := range environ {
-		if strings.HasPrefix(kv, "AWS_") || strings.HasPrefix(kv, "RCLONE_") {
+		if strings.HasPrefix(kv, "RESTIC_REPOSITORY=") ||
+			strings.HasPrefix(kv, "RESTIC_PASSWORD=") {
+			continue
+		}
+		if strings.HasPrefix(kv, "RESTIC_") ||
+			strings.HasPrefix(kv, "AWS_") ||
+			strings.HasPrefix(kv, "RCLONE_") {
 			env = append(env, kv)
 		}
 	}
diff --git a/internal/restic/restic_test.go b/internal/restic/restic_test.go
index e2a28f1..c5f3999 100644
--- a/internal/restic/restic_test.go
+++ b/internal/restic/restic_test.go
@@ -9,13 +9,22 @@ import (
 func TestWorkerEnv(t *testing.T) {
 	t.Parallel()
 
-	environ := []string{"PATH=/bin", "AWS_ACCESS_KEY_ID=id", "HOME=/root", "RCLONE_CONFIG_R_TYPE=s3"}
+	environ := []string{
+		"PATH=/bin",
+		"AWS_ACCESS_KEY_ID=id",
+		"HOME=/root",
+		"RCLONE_CONFIG_R_TYPE=s3",
+		"RESTIC_COMPRESSION=max",
+		"RESTIC_REPOSITORY=volume:stale",
+		"RESTIC_PASSWORD=stale",
+	}
 	assert.Equal(t, []string{
 		"RESTIC_REPOSITORY=s3:h/b",
 		"RESTIC_PASSWORD=pw",
 		"AWS_ACCESS_KEY_ID=id",
 		"RCLONE_CONFIG_R_TYPE=s3",
-	}, WorkerEnv("s3:h/b", "pw", environ))
+		"RESTIC_COMPRESSION=max",
+	}, WorkerEnv("s3:h/b", "pw", environ), "resolved credentials supersede the daemon's copies")
 
 	assert.Equal(t, []string{
 		"RESTIC_REPOSITORY=/repo",