diff --git a/crates/zizmor/src/config.rs b/crates/zizmor/src/config.rs
index df2632df3..32f5b4deb 100644
--- a/crates/zizmor/src/config.rs
+++ b/crates/zizmor/src/config.rs
@@ -87,7 +87,12 @@ impl Config {
             return Ok(Self::default());
         }
 
-        let config = match &app.config {
+        let app_config = app
+            .config
+            .as_ref()
+            .filter(|config| !config.as_str().is_empty());
+
+        let config = match app_config {
             Some(path) => serde_yaml::from_str(&fs::read_to_string(path)?)?,
             None => {
                 // If the user didn't pass a config path explicitly with
diff --git a/crates/zizmor/tests/integration/common.rs b/crates/zizmor/tests/integration/common.rs
index bc8c6e85f..a69999347 100644
--- a/crates/zizmor/tests/integration/common.rs
+++ b/crates/zizmor/tests/integration/common.rs
@@ -104,6 +104,10 @@ impl Zizmor {
         self
     }
 
+    pub fn has_config_set_from_env(&self) -> bool {
+        self.cmd.get_envs().any(|(key, _)| key == "ZIZMOR_CONFIG")
+    }
+
     pub fn run(mut self) -> Result<String> {
         if self.offline {
             self.cmd.arg("--offline");
@@ -115,7 +119,7 @@ impl Zizmor {
 
         if let Some(config) = self.config {
             self.cmd.arg("--config").arg(config);
-        } else {
+        } else if !self.has_config_set_from_env() {
             self.cmd.arg("--no-config");
         }
 
diff --git a/crates/zizmor/tests/integration/e2e.rs b/crates/zizmor/tests/integration/e2e.rs
index 795f1c117..3ec48d758 100644
--- a/crates/zizmor/tests/integration/e2e.rs
+++ b/crates/zizmor/tests/integration/e2e.rs
@@ -211,6 +211,26 @@ fn invalid_config_file() -> Result<()> {
     Ok(())
 }
 
+#[test]
+fn empty_config_env_var() -> Result<()> {
+    zizmor()
+        .setenv("ZIZMOR_CONFIG", "")
+        .input(input_under_test("e2e-menagerie"))
+        .run()?;
+
+    Ok(())
+}
+
+#[test]
+fn empty_config_arg() -> Result<()> {
+    zizmor()
+        .config("")
+        .input(input_under_test("e2e-menagerie"))
+        .run()?;
+
+    Ok(())
+}
+
 #[test]
 fn invalid_inputs() -> Result<()> {
     for workflow_tc in [