diff --git a/cmd/root.go b/cmd/root.go
index 5359703b..9348ae95 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -17,14 +17,12 @@ import (
 	"golang.org/x/exp/slices"
 	"golang.org/x/sync/errgroup"
 
+	"github.com/crowdsecurity/crowdsec/pkg/models"
 	csbouncer "github.com/crowdsecurity/go-cs-bouncer"
 	"github.com/crowdsecurity/go-cs-lib/csdaemon"
 	"github.com/crowdsecurity/go-cs-lib/csstring"
 	"github.com/crowdsecurity/go-cs-lib/version"
 
-
-	"github.com/crowdsecurity/crowdsec/pkg/models"
-
 	"github.com/crowdsecurity/cs-firewall-bouncer/pkg/backend"
 	"github.com/crowdsecurity/cs-firewall-bouncer/pkg/cfg"
 	"github.com/crowdsecurity/cs-firewall-bouncer/pkg/metrics"
diff --git a/test/bouncer/test_yaml_local.py b/test/bouncer/test_yaml_local.py
index 3cab695b..3c28b667 100644
--- a/test/bouncer/test_yaml_local.py
+++ b/test/bouncer/test_yaml_local.py
@@ -1,3 +1,5 @@
+import os
+
 
 def test_yaml_local(bouncer, fw_cfg_factory):
     cfg = fw_cfg_factory()
@@ -21,3 +23,18 @@ def test_yaml_local(bouncer, fw_cfg_factory):
         ])
         fw.proc.wait(timeout=0.2)
         assert not fw.proc.is_running()
+
+    # variable expansion
+
+    config_local = {
+        'mode': '$BOUNCER_MODE'
+    }
+
+    os.environ['BOUNCER_MODE'] = 'fromenv'
+
+    with bouncer(cfg, config_local=config_local) as fw:
+        fw.wait_for_lines_fnmatch([
+            "*firewall 'fromenv' is not supported*",
+        ])
+        fw.proc.wait(timeout=0.2)
+        assert not fw.proc.is_running()