diff --git a/stand/lua/config.lua b/stand/lua/config.lua
index dac55158dd47..bfa7e3edff85 100644
--- a/stand/lua/config.lua
+++ b/stand/lua/config.lua
@@ -61,6 +61,17 @@ local QVALREPL = QVALEXPR:gsub('%%', '%%%%')
 local WORDEXPR = "([%w]+)"
 local WORDREPL = WORDEXPR:gsub('%%', '%%%%')
 
+-- Entries that should never make it into the environment; each one should have
+-- a documented reason for its existence, and these should all be implementation
+-- details of the config module.
+local loader_env_restricted_table = {
+	-- loader_conf_files should be considered write-only, and consumers
+	-- should not rely on any particular value; it's a loader implementation
+	-- detail.  Moreover, it's not a particularly useful variable to have in
+	-- the kenv.  Save the overhead, let it get fetched other ways.
+	loader_conf_files = true,
+}
+
 local function restoreEnv()
 	-- Examine changed environment variables
 	for k, v in pairs(env_changed) do
@@ -88,14 +99,31 @@ local function restoreEnv()
 	env_restore = {}
 end
 
+-- XXX This getEnv/setEnv should likely be exported at some point.  We can save
+-- the call back into loader.getenv for any variable that's been set or
+-- overridden by any loader.conf using this implementation with little overhead
+-- since we're already tracking the values.
+local function getEnv(key)
+	if loader_env_restricted_table[key] ~= nil or
+	    env_changed[key] ~= nil then
+		return env_changed[key]
+	end
+
+	return loader.getenv(key)
+end
+
 local function setEnv(key, value)
+	env_changed[key] = value
+
+	if loader_env_restricted_table[key] ~= nil then
+		return 0
+	end
+
 	-- Track the original value for this if we haven't already
 	if env_restore[key] == nil then
 		env_restore[key] = {value = loader.getenv(key)}
 	end
 
-	env_changed[key] = value
-
 	return loader.setenv(key, value)
 end
 
@@ -465,7 +493,7 @@ function config.readConfFiles(files, loaded_files)
 		-- The caller may not have passed in loader_conf_files; we could
 		-- have instead gotten some other string of files.  We don't
 		-- want to trigger any redundant re-read/loads based on this.
-		local prefiles = loader.getenv("loader_conf_files")
+		local prefiles = getEnv("loader_conf_files")
 		for name in files:gmatch("([%w%p]+)%s*") do
 			if loaded_files[name] ~= nil then
 				goto continue
@@ -480,7 +508,7 @@ function config.readConfFiles(files, loaded_files)
 			end
 
 			loaded_files[name] = true
-			local newfiles = loader.getenv("loader_conf_files")
+			local newfiles = getEnv("loader_conf_files")
 			if prefiles ~= newfiles then
 				-- Recurse; process the new files immediately.
 				-- If we come back and it turns out we've
@@ -607,7 +635,7 @@ function config.load(file, reloading)
 	end
 
 	local loaded_files = {file = true}
-	config.readConfFiles(loader.getenv("loader_conf_files"), loaded_files)
+	config.readConfFiles(getEnv("loader_conf_files"), loaded_files)
 
 	checkNextboot()