diff --git a/mod_ood_proxy/lib/ood/nginx_stage.lua b/mod_ood_proxy/lib/ood/nginx_stage.lua
index c836d2621e..0613d842a3 100644
--- a/mod_ood_proxy/lib/ood/nginx_stage.lua
+++ b/mod_ood_proxy/lib/ood/nginx_stage.lua
@@ -15,7 +15,8 @@ function pun(r, bin, user, app_init_url, exports, pre_hook_root_cmd, allowed_hos
   if pre_hook_root_cmd then
     local env_table = exports_to_table(r, exports)
     if allowed_hosts then
-      env_table["OOD_ALLOWED_HOSTS"] = allowed_hosts
+      -- capture2e_with_env will prefix OOD_
+      env_table["ALLOWED_HOSTS"] = allowed_hosts
     end
     cmd = cmd .. " -P '" .. r:escape(pre_hook_root_cmd) .. "'"
     err = capture2e_with_env(cmd, env_table)
diff --git a/nginx_stage/lib/nginx_stage.rb b/nginx_stage/lib/nginx_stage.rb
index 6547607020..2c2051c209 100644
--- a/nginx_stage/lib/nginx_stage.rb
+++ b/nginx_stage/lib/nginx_stage.rb
@@ -145,6 +145,8 @@ def self.clean_nginx_env(user:)
       "RAILS_LOG_TO_STDOUT" => "true",
       # name change here because only OOD_* from apache is allowed through sudo rules
       "ALLOWED_HOSTS" => ENV['OOD_ALLOWED_HOSTS'],
+      # set the duplicate to keep clean_nginx_env impepodent
+      "OOD_ALLOWED_HOSTS" => ENV['OOD_ALLOWED_HOSTS'],
     }.merge(pun_custom_env).merge(preserve_env_declarations.map { |k| [ k, ENV[k] ] }.to_h))
   end