diff --git a/pkg/csplugin/broker.go b/pkg/csplugin/broker.go
index 81bd5e1ca..716368a92 100644
--- a/pkg/csplugin/broker.go
+++ b/pkg/csplugin/broker.go
@@ -12,16 +12,18 @@ import (
 	"time"
 
 	"github.com/Masterminds/sprig/v3"
-	"github.com/crowdsecurity/crowdsec/pkg/csconfig"
-	"github.com/crowdsecurity/crowdsec/pkg/models"
-	"github.com/crowdsecurity/crowdsec/pkg/protobufs"
-	"github.com/crowdsecurity/crowdsec/pkg/types"
 	"github.com/google/uuid"
 	plugin "github.com/hashicorp/go-plugin"
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
 	"gopkg.in/tomb.v2"
 	"gopkg.in/yaml.v2"
+
+	"github.com/crowdsecurity/crowdsec/pkg/csconfig"
+	"github.com/crowdsecurity/crowdsec/pkg/csstring"
+	"github.com/crowdsecurity/crowdsec/pkg/models"
+	"github.com/crowdsecurity/crowdsec/pkg/protobufs"
+	"github.com/crowdsecurity/crowdsec/pkg/types"
 )
 
 var pluginMutex sync.Mutex
@@ -254,7 +256,7 @@ func (pb *PluginBroker) loadPlugins(path string) error {
 			if err != nil {
 				return err
 			}
-			data = []byte(os.ExpandEnv(string(data)))
+			data = []byte(csstring.StrictExpand(string(data), os.LookupEnv))
 			_, err = pluginClient.Configure(context.Background(), &protobufs.Config{Config: data})
 			if err != nil {
 				return errors.Wrapf(err, "while configuring %s", pc.Name)