diff --git a/modules/aws_ecs/locals.tf b/modules/aws_ecs/locals.tf
index a58c2bb..987368b 100644
--- a/modules/aws_ecs/locals.tf
+++ b/modules/aws_ecs/locals.tf
@@ -24,7 +24,6 @@ locals {
   ecs_telemetry_fluentbit_image = var.ecs_telemetry_fluentbit_image != "" ? var.ecs_telemetry_fluentbit_image : format("%s:%s", "tryretool/retool-aws-for-fluent-bit", split(":", var.ecs_retool_image)[1])
 
   environment_variables = concat(
-    var.additional_env_vars, # add additional environment variables
     local.base_environment_variables,
     local.temporal_mtls_config,
     var.code_executor_enabled ? [
@@ -109,7 +108,8 @@ locals {
         "name" : "WORKFLOW_TEMPORAL_TLS_ENABLED",
         "value" : tostring(var.temporal_cluster_config.tls_enabled)
       }
-    ]
+    ],
+    var.additional_env_vars, # add additional environment variables after defaults so they can override when necessary
   )
 
   task_log_configuration = (
diff --git a/modules/aws_ecs_ec2/locals.tf b/modules/aws_ecs_ec2/locals.tf
index 7a14150..7f637a6 100644
--- a/modules/aws_ecs_ec2/locals.tf
+++ b/modules/aws_ecs_ec2/locals.tf
@@ -1,6 +1,5 @@
 locals {
   environment_variables = concat(
-    var.additional_env_vars, # add additional environment variables
     [
       {
         name  = "NODE_ENV"
@@ -50,6 +49,7 @@ locals {
         "name": "DEPLOYMENT_TEMPLATE_TYPE"
         "value": "aws-ecs-ec2-terraform-deprecated"
       }
-    ]
+    ],
+    var.additional_env_vars, # add additional environment variables if provided so they can override defaults
   )
 }