Next 16.2 won't load .env variables in Vercel at runtime

[mordechaim]

Link to the code that reproduces this issue

https://github.com/mordechaim/missing-env-repro

To Reproduce

Local version, working:

1. Start the application locally (either dev or build/start)
2. Observe both static, dynamic and cached contexts all have the correct value for MY_DOTENV

Deployed on Vercel:

1. Open the Vercel deployed version at: https://missing-env-repro.vercel.app
2. The static value is briefly shown the correct value (observable in the network tab page response) and quickly swapped out to undefined
3. The dynamic value is undefined all along
4. The cached value correctly shows the variable

Current vs. Expected behavior

Since updating to Next 16.2 the runtime doesn't have access to variables defined in a committed .env file. During build time they all resolve correctly.

Variables set via the Vercel environment variables UI are properly set.

Provide environment information

Operating System:
  Platform: win32
  Arch: x64
  Version: Windows 11 Pro
  Available memory (MB): 32189
  Available CPU cores: 14
Binaries:
  Node: 25.0.0
  npm: 11.6.2
  Yarn: N/A
  pnpm: N/A
Relevant Packages:
  next: 16.2.1-canary.13 // Latest available version is detected (16.2.1-canary.13).
  eslint-config-next: N/A
  react: 19.2.4
  react-dom: 19.2.4
  typescript: 5.9.3
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Module Resolution, Runtime

Which stage(s) are affected? (Select all that apply)

Vercel (Deployed)

Additional context

I used cacheComponents to demonstrate the difference between build-time and dynamic access; but the same behavior is observed when using fully static (correctly set) and fully dynamic (missing) pages.

There's a hydration error printed to the browser console, as the static value is swapped out at runtime to undefined.
The cached value is showing the value at build time, and since I added "use cache", the value isn't swapped out during hydration.

[finessor06]

Hey mate — if you’re still stuck, I can help you debug this. Just head over to my debugging‑service repo and open an Issue. All the steps are in the README, so you’ll know exactly what to include. Thank you.

[eps1lon]

We explicitly changed that behavior when we introduced the new adapters because it's a security concern: you're exposing runtime secrets in code. We'll discuss further if we want to stick with that in 16.x or defer to 17.x

[mordechaim]

.env is committed, and not really secret.

On the other hand, Vercel environments do pass on to the runtime. There obviously must be a way to pass secrets to the runtime, otherwise we can't connect to any external services that require API keys.

---

Edit .env can have secrets if it $REFERENCES a Vercel secret.