diff --git a/pressure-vessel/environ.c b/pressure-vessel/environ.c
index 041727b97b19061161700eb4f9adb315ff3412dd..f83b3386d10bd6411d4ef2d5e26203f198d2a0f8 100644
--- a/pressure-vessel/environ.c
+++ b/pressure-vessel/environ.c
@@ -1,6 +1,6 @@
 /*
  * Copyright © 2014-2018 Red Hat, Inc
- * Copyright © 2020 Collabora Ltd.
+ * Copyright © 2020-2021 Collabora Ltd.
  * SPDX-License-Identifier: LGPL-2.1-or-later
  *
  * This program is free software; you can redistribute it and/or
@@ -29,27 +29,16 @@
  * - Forced to be unset
  * - Inherited from the execution environment of bwrap(1)
  *
- * together with a *locked* flag. The locked flag indicates that if the
- * container is running pressure-vessel-launcher(1), then the variable
- * cannot be overridden by pressure-vessel-launch(1).
- *
- * In particular, the locked flag can be combined with any value, and
- * a variable can also be locked to the inherited value.
- *
  * We represent this as follows:
  *
  * - Set to a value: values[VAR] = VAL
  * - Forced to be unset: values[VAR] = NULL
  * - Inherited from the execution environment of bwrap(1): VAR not in `values`
- *
- * Variables that are locked are also added to `locked`.
  */
 struct _PvEnviron
 {
   /* (element-type filename filename) */
   GHashTable *values;
-  /* (element-type filename ignored) */
-  GHashTable *locked;
 };
 
 PvEnviron *
@@ -59,8 +48,6 @@ pv_environ_new (void)
 
   self->values = g_hash_table_new_full (g_str_hash, g_str_equal,
                                         g_free, g_free);
-  self->locked = g_hash_table_new_full (g_str_hash, g_str_equal,
-                                        g_free, NULL);
   return g_steal_pointer (&self);
 }
 
@@ -70,59 +57,35 @@ pv_environ_free (PvEnviron *self)
   g_return_if_fail (self != NULL);
 
   g_clear_pointer (&self->values, g_hash_table_unref);
-  g_clear_pointer (&self->locked, g_hash_table_unref);
   g_slice_free (PvEnviron, self);
 }
 
 /*
- * Lock @var to be set to @val, which may be %NULL to unset it.
- * It cannot be overridden by a subsequent pressure-vessel-launch
- * invocation.
+ * Set @var to @val, which may be %NULL to unset it.
  */
 void
-pv_environ_lock_env (PvEnviron *self,
-                     const char *var,
-                     const char *val)
+pv_environ_setenv (PvEnviron *self,
+                   const char *var,
+                   const char *val)
 {
   g_return_if_fail (self != NULL);
   g_return_if_fail (var != NULL);
-  /* val may be NULL, to lock it to be unset */
+  /* val may be NULL, to unset it */
 
   g_hash_table_replace (self->values, g_strdup (var), g_strdup (val));
-  g_hash_table_add (self->locked, g_strdup (var));
 }
 
 /*
- * Lock @var to whatever value it happens to have inherited, in a way
- * that cannot be overridden by a subsequent pressure-vessel-launch
- * invocation.
+ * Set @var to whatever value it happens to have inherited.
  */
 void
-pv_environ_lock_inherit_env (PvEnviron *self,
-                             const char *var)
+pv_environ_inherit_env (PvEnviron *self,
+                        const char *var)
 {
   g_return_if_fail (self != NULL);
   g_return_if_fail (var != NULL);
 
   g_hash_table_remove (self->values, var);
-  g_hash_table_add (self->locked, g_strdup (var));
-}
-
-/*
- * Set @var to @val, in a way that can be overridden by a subsequent
- * pressure-vessel-launch invocation.
- */
-void
-pv_environ_set_env_overridable (PvEnviron *self,
-                                const char *var,
-                                const char *val)
-{
-  g_return_if_fail (self != NULL);
-  g_return_if_fail (var != NULL);
-  /* val may be NULL, to lock it to be unset */
-
-  g_hash_table_replace (self->values, g_strdup (var), g_strdup (val));
-  g_hash_table_remove (self->locked, var);
 }
 
 static int
@@ -134,7 +97,7 @@ generic_strcmp (gconstpointer a,
 
 /*
  * Returns: (transfer container): The variables that are set or forced
- *  to be unset, but not the variables that are locked to be inherited
+ *  to be unset, but not the variables that are inherited
  */
 GList *
 pv_environ_get_vars (PvEnviron *self)
@@ -144,32 +107,9 @@ pv_environ_get_vars (PvEnviron *self)
   return g_list_sort (g_hash_table_get_keys (self->values), generic_strcmp);
 }
 
-/*
- * Returns: (transfer container): The variables that are locked in some way
- */
-GList *
-pv_environ_get_locked (PvEnviron *self)
-{
-  g_return_val_if_fail (self != NULL, NULL);
-
-  return g_list_sort (g_hash_table_get_keys (self->locked), generic_strcmp);
-}
-
-/*
- * Returns: %TRUE if @var is locked
- */
-gboolean
-pv_environ_is_locked (PvEnviron *self,
-                      const char *var)
-{
-  g_return_val_if_fail (self != NULL, FALSE);
-
-  return g_hash_table_contains (self->locked, var);
-}
-
 /*
  * Returns: (nullable): The value of @var, or %NULL if @var is either
- *  locked-to-be-unset, locked-to-be-inherited or unspecified
+ *  unset or inherited
  */
 const char *
 pv_environ_getenv (PvEnviron *self,
diff --git a/pressure-vessel/environ.h b/pressure-vessel/environ.h
index f2f118ca3fc66ac3577b34cef929c2882dd8cca2..89521622463103d324324a4ddfe0dbc110cc576b 100644
--- a/pressure-vessel/environ.h
+++ b/pressure-vessel/environ.h
@@ -28,20 +28,14 @@ typedef struct _PvEnviron PvEnviron;
 PvEnviron *pv_environ_new (void);
 void pv_environ_free (PvEnviron *self);
 
-void pv_environ_lock_env (PvEnviron *self,
-                          const char *var,
-                          const char *val);
-void pv_environ_lock_inherit_env (PvEnviron *self,
-                                  const char *var);
-void pv_environ_set_env_overridable (PvEnviron *self,
-                                     const char *var,
-                                     const char *val);
+void pv_environ_setenv (PvEnviron *self,
+                        const char *var,
+                        const char *val);
+void pv_environ_inherit_env (PvEnviron *self,
+                             const char *var);
 
 GList *pv_environ_get_vars (PvEnviron *self);
-GList *pv_environ_get_locked (PvEnviron *self);
 const char *pv_environ_getenv (PvEnviron *self,
                                const char *var);
-gboolean pv_environ_is_locked (PvEnviron *self,
-                               const char *var);
 
 G_DEFINE_AUTOPTR_CLEANUP_FUNC (PvEnviron, pv_environ_free)
diff --git a/pressure-vessel/launcher.1.md b/pressure-vessel/launcher.1.md
index 7c9650126a0200d44ae7ca2e2e5a14dd92467a68..52ba49652a096979bc29e78b936be01abe038f9c 100644
--- a/pressure-vessel/launcher.1.md
+++ b/pressure-vessel/launcher.1.md
@@ -63,13 +63,6 @@ D-Bus session bus, and executes arbitrary commands as subprocesses.
     This fd will be closed (reach end-of-file) when the server is ready.
     The default is standard output, equivalent to **--info-fd=1**.
 
-**--lock-env-from-fd** *FD*
-:   List of environment variables, separated with the null character
-    '\0', that will be locked to their initial value (whether that
-    is inherited or unset). If **pressure-vessel-launch**(1) asks
-    to unset these variables or change their values, that request
-    will be ignored.
-
 **--replace**
 :   When used with **--bus-name**, allow other
     **pressure-vessel-launcher** processes to take over the bus name,
@@ -83,7 +76,7 @@ D-Bus session bus, and executes arbitrary commands as subprocesses.
 
 `PWD`
 :   Set to the current working directory for each command executed
-    inside the container, overriding **--lock-env-from-fd**.
+    inside the container.
 
 `PRESSURE_VESSEL_LOG_INFO` (boolean)
 :   If set to `1`, increase the log verbosity up to the info level.
diff --git a/pressure-vessel/launcher.c b/pressure-vessel/launcher.c
index e95a7cedd1b730460101bc140c18c4969587c538..ea080400f6361b06144a4f4dff5d6758c2f15251 100644
--- a/pressure-vessel/launcher.c
+++ b/pressure-vessel/launcher.c
@@ -52,7 +52,6 @@
 
 static PvPortalListener *global_listener;
 
-static GHashTable *lock_env_hash = NULL;
 static GHashTable *client_pid_data_hash = NULL;
 static GMainLoop *main_loop;
 static PvLauncher1 *launcher;
@@ -326,22 +325,9 @@ handle_launch (PvLauncher1           *object,
 
   if (arg_flags & PV_LAUNCH_FLAGS_CLEAR_ENV)
     {
-      GHashTableIter iter;
-      const gchar *env_var;
-      const gchar *env_val;
-      gpointer k;
       char *empty[] = { NULL };
-      env = g_strdupv (empty);
 
-      /* Do not clear the variables that were locked */
-      g_hash_table_iter_init (&iter, lock_env_hash);
-      while (g_hash_table_iter_next (&iter, &k, NULL))
-        {
-          env_var = k;
-          env_val = g_getenv (env_var);
-          if (env_val != NULL)
-            env = g_environ_setenv (env, env_var, env_val, TRUE);
-        }
+      env = g_strdupv (empty);
     }
   else
     {
@@ -355,20 +341,10 @@ handle_launch (PvLauncher1           *object,
       const char *val = NULL;
       g_variant_get_child (arg_envs, i, "{&s&s}", &var, &val);
 
-      /* Ignore PWD: we special-case that later, and the debug message
-       * if it is locked would be confusing */
+      /* Ignore PWD: we special-case that later */
       if (g_strcmp0 (var, "PWD") == 0)
         continue;
 
-      if (g_hash_table_contains (lock_env_hash, var))
-        {
-          const gchar *locked_val = g_environ_getenv (env, var);
-          if (g_strcmp0 (val, locked_val) != 0)
-            g_info ("Ignoring request to set %s=\"%s\" because it was locked to \"%s\"",
-                    var, val, locked_val ? locked_val : "<unset>");
-          continue;
-        }
-
       env = g_environ_setenv (env, var, val, TRUE);
     }
 
@@ -380,15 +356,6 @@ handle_launch (PvLauncher1           *object,
       if (g_strcmp0 (unset_env[i], "PWD") == 0)
         continue;
 
-      if (g_hash_table_contains (lock_env_hash, unset_env[i]))
-        {
-          const gchar *locked_val = g_environ_getenv (env, unset_env[i]);
-          if (locked_val != NULL)
-             g_info ("Ignoring request to unset %s because it was locked to \"%s\"",
-                     unset_env[i], locked_val);
-          continue;
-        }
-
       g_debug ("Unsetting the environment variable %s...", unset_env[i]);
       env = g_environ_unsetenv (env, unset_env[i]);
     }
@@ -820,7 +787,6 @@ set_up_exit_on_readable (int fd,
 static gchar *opt_bus_name = NULL;
 static gint opt_exit_on_readable_fd = -1;
 static gint opt_info_fd = -1;
-static gint opt_lock_env_fd = -1;
 static gboolean opt_replace = FALSE;
 static gchar *opt_socket = NULL;
 static gchar *opt_socket_directory = NULL;
@@ -843,11 +809,6 @@ static GOptionEntry options[] =
     "Indicate readiness and print details of how to connect on this "
     "file descriptor instead of stdout.",
     "FD" },
-  { "lock-env-from-fd", '\0',
-    G_OPTION_FLAG_NONE, G_OPTION_ARG_INT, &opt_lock_env_fd,
-    "List of environment variables, separated with the null character "
-    "'\\0', that will be locked to their initial value. ",
-    "FD" },
   { "replace", '\0',
     G_OPTION_FLAG_NONE, G_OPTION_ARG_NONE, &opt_replace,
     "Replace a previous instance with the same bus name. "
@@ -929,29 +890,6 @@ main (int argc,
       goto out;
     }
 
-  lock_env_hash = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, NULL);
-
-  if (opt_lock_env_fd >= 0)
-    {
-      g_autofree char *elem = NULL;
-      size_t len = 0;
-      g_autoptr(FILE) lock_env_file = fdopen (opt_lock_env_fd, "r");
-
-      if (lock_env_file == NULL)
-        {
-          glnx_null_throw_errno_prefix (error,
-                                        "Unable to read the given lock env fd %d",
-                                        opt_lock_env_fd);
-          ret = EX_OSERR;
-          goto out;
-        }
-
-      while (getdelim (&elem, &len, '\0', lock_env_file) > 0)
-        {
-          g_hash_table_add (lock_env_hash, g_strdup (elem));
-        }
-    }
-
   if (opt_exit_on_readable_fd >= 0)
     {
       if (!set_up_exit_on_readable (opt_exit_on_readable_fd,
@@ -1054,7 +992,6 @@ out:
   g_free (opt_socket);
   g_free (opt_socket_directory);
   g_clear_object (&global_listener);
-  g_hash_table_destroy (lock_env_hash);
 
   if (local_error == NULL)
     ret = 0;
diff --git a/pressure-vessel/runtime.c b/pressure-vessel/runtime.c
index a4b8b027ba09268cdabc9e558c61700126903967..f033e7d318aebdc259c271d5a8513f1d375bc3f3 100644
--- a/pressure-vessel/runtime.c
+++ b/pressure-vessel/runtime.c
@@ -2578,7 +2578,7 @@ bind_runtime_base (PvRuntime *self,
                           "--symlink", "../run", "/var/run",
                           NULL);
 
-  pv_environ_lock_env (container_env, "XDG_RUNTIME_DIR", xrd);
+  pv_environ_setenv (container_env, "XDG_RUNTIME_DIR", xrd);
 
   if (self->provider != NULL
       && (g_strcmp0 (self->provider->path_in_host_ns, "/") != 0
@@ -5233,23 +5233,23 @@ pv_runtime_use_provider_graphics_stack (PvRuntime *self,
     }
 
   if (dri_path->len != 0)
-    pv_environ_lock_env (container_env, "LIBGL_DRIVERS_PATH", dri_path->str);
+    pv_environ_setenv (container_env, "LIBGL_DRIVERS_PATH", dri_path->str);
   else
-    pv_environ_lock_env (container_env, "LIBGL_DRIVERS_PATH", NULL);
+    pv_environ_setenv (container_env, "LIBGL_DRIVERS_PATH", NULL);
 
   if (egl_path->len != 0)
-    pv_environ_lock_env (container_env, "__EGL_VENDOR_LIBRARY_FILENAMES",
-                         egl_path->str);
+    pv_environ_setenv (container_env, "__EGL_VENDOR_LIBRARY_FILENAMES",
+                       egl_path->str);
   else
-    pv_environ_lock_env (container_env, "__EGL_VENDOR_LIBRARY_FILENAMES",
-                         NULL);
+    pv_environ_setenv (container_env, "__EGL_VENDOR_LIBRARY_FILENAMES",
+                       NULL);
 
-  pv_environ_lock_env (container_env, "__EGL_VENDOR_LIBRARY_DIRS", NULL);
+  pv_environ_setenv (container_env, "__EGL_VENDOR_LIBRARY_DIRS", NULL);
 
   if (vulkan_path->len != 0)
-    pv_environ_lock_env (container_env, "VK_ICD_FILENAMES", vulkan_path->str);
+    pv_environ_setenv (container_env, "VK_ICD_FILENAMES", vulkan_path->str);
   else
-    pv_environ_lock_env (container_env, "VK_ICD_FILENAMES", NULL);
+    pv_environ_setenv (container_env, "VK_ICD_FILENAMES", NULL);
 
   if (self->flags & PV_RUNTIME_FLAGS_IMPORT_VULKAN_LAYERS)
     {
@@ -5273,17 +5273,17 @@ pv_runtime_use_provider_graphics_stack (PvRuntime *self,
 
           prepended_data_dirs = g_strdup_printf ("%s:%s", override_share, xdg_data_dirs);
 
-          pv_environ_lock_env (container_env, "XDG_DATA_DIRS",
-                               prepended_data_dirs);
+          pv_environ_setenv (container_env, "XDG_DATA_DIRS",
+                             prepended_data_dirs);
         }
-      pv_environ_lock_env (container_env, "VK_LAYER_PATH", NULL);
+      pv_environ_setenv (container_env, "VK_LAYER_PATH", NULL);
     }
 
   if (va_api_path->len != 0)
-    pv_environ_lock_env (container_env, "LIBVA_DRIVERS_PATH",
-                         va_api_path->str);
+    pv_environ_setenv (container_env, "LIBVA_DRIVERS_PATH",
+                       va_api_path->str);
   else
-    pv_environ_lock_env (container_env, "LIBVA_DRIVERS_PATH", NULL);
+    pv_environ_setenv (container_env, "LIBVA_DRIVERS_PATH", NULL);
 
   /* We binded the VDPAU drivers in "%{libdir}/vdpau".
    * Unfortunately VDPAU_DRIVER_PATH can hold just a single path, so we can't
@@ -5294,7 +5294,7 @@ pv_runtime_use_provider_graphics_stack (PvRuntime *self,
   g_autofree gchar *vdpau_val = g_strdup_printf ("%s/lib/platform-${PLATFORM}/vdpau",
                                                  self->overrides_in_container);
 
-  pv_environ_lock_env (container_env, "VDPAU_DRIVER_PATH", vdpau_val);
+  pv_environ_setenv (container_env, "VDPAU_DRIVER_PATH", vdpau_val);
   return TRUE;
 }
 
@@ -5438,7 +5438,7 @@ pv_runtime_bind (PvRuntime *self,
        * We do not do this for games developed against soldier, because
        * backwards compatibility is not a concern for game developers who
        * have specifically opted-in to using the newer runtime. */
-      pv_environ_lock_env (container_env, "STEAM_RUNTIME", "/");
+      pv_environ_setenv (container_env, "STEAM_RUNTIME", "/");
 
       /* Scout is configured without Wayland support. For this reason, if
        * the Wayland driver was forced via SDL_VIDEODRIVER, we expect that
@@ -5446,7 +5446,7 @@ pv_runtime_bind (PvRuntime *self,
        * unset SDL_VIDEODRIVER, so that the default x11 gets chosen instead */
       sdl_videodriver = g_environ_getenv (self->original_environ, "SDL_VIDEODRIVER");
       if (g_strcmp0 (sdl_videodriver, "wayland") == 0)
-        pv_environ_lock_env (container_env, "SDL_VIDEODRIVER", NULL);
+        pv_environ_setenv (container_env, "SDL_VIDEODRIVER", NULL);
     }
 
   pv_runtime_set_search_paths (self, container_env);
@@ -5500,12 +5500,12 @@ pv_runtime_set_search_paths (PvRuntime *self,
                                     NULL);
 
   if (g_file_test (terminfo_path, G_FILE_TEST_IS_DIR))
-    pv_environ_lock_env (container_env, "TERMINFO_DIRS", "/lib/terminfo");
+    pv_environ_setenv (container_env, "TERMINFO_DIRS", "/lib/terminfo");
 
   /* The PATH from outside the container doesn't really make sense inside the
    * container: in principle the layout could be totally different. */
-  pv_environ_lock_env (container_env, "PATH", "/usr/bin:/bin");
-  pv_environ_lock_env (container_env, "LD_LIBRARY_PATH", ld_library_path->str);
+  pv_environ_setenv (container_env, "PATH", "/usr/bin:/bin");
+  pv_environ_setenv (container_env, "LD_LIBRARY_PATH", ld_library_path->str);
 }
 
 gboolean
diff --git a/pressure-vessel/wrap-pipewire.c b/pressure-vessel/wrap-pipewire.c
index 910788860eda692fed76eef6cf5a17547ff2fc99..988a228bb4129b36736d51df7175eae8b90b3207 100644
--- a/pressure-vessel/wrap-pipewire.c
+++ b/pressure-vessel/wrap-pipewire.c
@@ -77,7 +77,7 @@ pv_wrap_add_pipewire_args (FlatpakBwrap *sharing_bwrap,
   const char *member;
 
   /* Make Pipewire look in the container's XDG_RUNTIME_DIR */
-  pv_environ_lock_env (container_env, "PIPEWIRE_RUNTIME_DIR", NULL);
+  pv_environ_setenv (container_env, "PIPEWIRE_RUNTIME_DIR", NULL);
 
   if (g_file_test (DEFAULT_SYSTEM_RUNTIME_DIR, G_FILE_TEST_IS_DIR))
     flatpak_bwrap_add_args (sharing_bwrap,
@@ -124,7 +124,7 @@ pv_wrap_add_pipewire_args (FlatpakBwrap *sharing_bwrap,
           g_autofree gchar *container_socket =
             g_strdup_printf ("/run/user/%d/pv-pipewire", getuid ());
 
-          pv_environ_lock_env (container_env, "PIPEWIRE_REMOTE", "pv-pipewire");
+          pv_environ_setenv (container_env, "PIPEWIRE_REMOTE", "pv-pipewire");
           flatpak_bwrap_add_args (sharing_bwrap,
                                   "--ro-bind",
                                     host_socket,
@@ -133,7 +133,7 @@ pv_wrap_add_pipewire_args (FlatpakBwrap *sharing_bwrap,
         }
       else
         {
-          pv_environ_lock_env (container_env, "PIPEWIRE_REMOTE", NULL);
+          pv_environ_setenv (container_env, "PIPEWIRE_REMOTE", NULL);
         }
     }
 }
diff --git a/pressure-vessel/wrap-setup.c b/pressure-vessel/wrap-setup.c
index a8a19a4bda88590e1c1458c99c8baa6f90347ed4..98f48ab05f1bf9b5594395db2b360a720bd4f57e 100644
--- a/pressure-vessel/wrap-setup.c
+++ b/pressure-vessel/wrap-setup.c
@@ -49,13 +49,13 @@ pv_wrap_share_sockets (FlatpakBwrap *bwrap,
   g_return_if_fail (container_env != NULL);
 
   /* If these are set by flatpak_run_add_x11_args(), etc., we'll
-   * change them from locked-and-unset to locked-and-set later.
+   * change them from unset to set later.
    * Every variable that is unset with flatpak_bwrap_unset_env() in
    * the functions we borrow from Flatpak (below) should be listed
    * here. */
-  pv_environ_lock_env (container_env, "DISPLAY", NULL);
-  pv_environ_lock_env (container_env, "PULSE_SERVER", NULL);
-  pv_environ_lock_env (container_env, "XAUTHORITY", NULL);
+  pv_environ_setenv (container_env, "DISPLAY", NULL);
+  pv_environ_setenv (container_env, "PULSE_SERVER", NULL);
+  pv_environ_setenv (container_env, "XAUTHORITY", NULL);
 
   flatpak_run_add_font_path_args (sharing_bwrap);
 
@@ -121,13 +121,13 @@ pv_wrap_share_sockets (FlatpakBwrap *bwrap,
 
       /* If this warning is reached, we might need to add this
        * variable to the block of
-       * pv_environ_lock_env (container_env, ., NULL) calls above */
+       * pv_environ_setenv (container_env, ., NULL) calls above */
       if (j >= G_N_ELEMENTS (known_vars))
         g_warning ("Extra environment variable %s set during container "
                    "setup but not in known_vars; check logic",
                    var);
 
-      pv_environ_lock_env (container_env, var, val);
+      pv_environ_setenv (container_env, var, val);
     }
 
   g_warn_if_fail (g_strv_length (sharing_bwrap->envp) == 0);
diff --git a/pressure-vessel/wrap.c b/pressure-vessel/wrap.c
index 4e2b8a18a514291cd5cabcdf51eb78c9cd3ad8ac..2bcb3d5df2f3bad20ea463d2358241e7c0864acc 100644
--- a/pressure-vessel/wrap.c
+++ b/pressure-vessel/wrap.c
@@ -357,7 +357,7 @@ bind_and_propagate_from_environ (FlatpakExports *exports,
     {
       g_autofree gchar *joined = g_strjoinv (":", values);
 
-      pv_environ_lock_env (container_env, variable, joined);
+      pv_environ_setenv (container_env, variable, joined);
     }
 }
 
@@ -420,9 +420,9 @@ use_tmpfs_home (FlatpakExports *exports,
                           "--symlink", tmp, "/var/tmp",
                           NULL);
 
-  pv_environ_lock_env (container_env, "XDG_CACHE_HOME", cache);
-  pv_environ_lock_env (container_env, "XDG_CONFIG_HOME", config);
-  pv_environ_lock_env (container_env, "XDG_DATA_HOME", data);
+  pv_environ_setenv (container_env, "XDG_CACHE_HOME", cache);
+  pv_environ_setenv (container_env, "XDG_CONFIG_HOME", config);
+  pv_environ_setenv (container_env, "XDG_DATA_HOME", data);
 
   return expose_steam (exports, FLATPAK_FILESYSTEM_MODE_READ_ONLY, FALSE,
                        real_home, NULL, error);
@@ -502,9 +502,9 @@ use_fake_home (FlatpakExports *exports,
                           "--bind", tmp, "/var/tmp",
                           NULL);
 
-  pv_environ_lock_env (container_env, "XDG_CACHE_HOME", cache);
-  pv_environ_lock_env (container_env, "XDG_CONFIG_HOME", config);
-  pv_environ_lock_env (container_env, "XDG_DATA_HOME", data);
+  pv_environ_setenv (container_env, "XDG_CACHE_HOME", cache);
+  pv_environ_setenv (container_env, "XDG_CONFIG_HOME", config);
+  pv_environ_setenv (container_env, "XDG_DATA_HOME", data);
 
   flatpak_exports_add_path_expose (exports,
                                    FLATPAK_FILESYSTEM_MODE_READ_WRITE,
@@ -1337,9 +1337,6 @@ main (int argc,
   g_autofree gchar *tools_dir = NULL;
   g_autoptr(PvRuntime) runtime = NULL;
   g_autoptr(FILE) original_stdout = NULL;
-  g_autoptr(GString) lock_env = g_string_new ("");
-  g_auto(GLnxTmpfile) lock_env_tmpf  = { 0, };
-  g_autofree char *lock_env_fd = NULL;
   g_autoptr(GArray) pass_fds_through_adverb = g_array_new (FALSE, FALSE, sizeof (int));
 
   setlocale (LC_ALL, "");
@@ -2184,8 +2181,8 @@ main (int argc,
                           g_autofree gchar *adjusted_blockedlist = NULL;
                           adjusted_blockedlist = g_build_filename ("/run/parent",
                                                                    blockedlist, NULL);
-                          pv_environ_lock_env (container_env, "SHARED_LIBRARY_GUARD_CONFIG",
-                                               adjusted_blockedlist);
+                          pv_environ_setenv (container_env, "SHARED_LIBRARY_GUARD_CONFIG",
+                                             adjusted_blockedlist);
                         }
                     }
                 }
@@ -2259,9 +2256,9 @@ main (int argc,
       else
         {
           if (adjusted->len != 0)
-            pv_environ_lock_env (container_env, variable, adjusted->str);
+            pv_environ_setenv (container_env, variable, adjusted->str);
           else
-            pv_environ_lock_env (container_env, variable, NULL);
+            pv_environ_setenv (container_env, variable, NULL);
         }
     }
 
@@ -2334,16 +2331,16 @@ main (int argc,
   else
     {
       for (i = 0; i < G_N_ELEMENTS (known_required_env); i++)
-        pv_environ_lock_env (container_env,
-                             known_required_env[i].name,
-                             g_getenv (known_required_env[i].name));
+        pv_environ_setenv (container_env,
+                           known_required_env[i].name,
+                           g_getenv (known_required_env[i].name));
 
       flatpak_bwrap_add_args (flatpak_subsandbox,
                               "--directory", cwd_p,
                               NULL);
     }
 
-  pv_environ_lock_env (container_env, "PWD", NULL);
+  pv_environ_setenv (container_env, "PWD", NULL);
 
   /* Put Steam Runtime environment variables back, if /usr is mounted
    * from the host. */
@@ -2369,7 +2366,7 @@ main (int argc,
 
               *equals = '\0';
 
-              pv_environ_lock_env (container_env, opt_env_if_host[i],
+              pv_environ_setenv (container_env, opt_env_if_host[i],
                                    equals + 1);
 
               *equals = '=';
@@ -2428,12 +2425,12 @@ main (int argc,
       const GList *iter;
 
       /* Let these inherit from the sub-sandbox environment */
-      pv_environ_lock_inherit_env (container_env, "FLATPAK_ID");
-      pv_environ_lock_inherit_env (container_env, "FLATPAK_SANDBOX_DIR");
-      pv_environ_lock_inherit_env (container_env, "DBUS_SESSION_BUS_ADDRESS");
-      pv_environ_lock_inherit_env (container_env, "DBUS_SYSTEM_BUS_ADDRESS");
-      pv_environ_lock_inherit_env (container_env, "DISPLAY");
-      pv_environ_lock_inherit_env (container_env, "XDG_RUNTIME_DIR");
+      pv_environ_inherit_env (container_env, "FLATPAK_ID");
+      pv_environ_inherit_env (container_env, "FLATPAK_SANDBOX_DIR");
+      pv_environ_inherit_env (container_env, "DBUS_SESSION_BUS_ADDRESS");
+      pv_environ_inherit_env (container_env, "DBUS_SYSTEM_BUS_ADDRESS");
+      pv_environ_inherit_env (container_env, "DISPLAY");
+      pv_environ_inherit_env (container_env, "XDG_RUNTIME_DIR");
 
       /* The bwrap envp will be completely ignored when calling
        * pv-launch, and in fact putting them in its environment
@@ -2476,21 +2473,6 @@ main (int argc,
 
   final_argv = flatpak_bwrap_new (original_environ);
 
-  /* Lock variables where appropriate */
-    {
-      g_autoptr(GList) vars = pv_environ_get_locked (container_env);
-      const GList *iter;
-
-      for (iter = vars; iter != NULL; iter = iter->next)
-        {
-          const char *var = iter->data;
-
-          g_debug ("Locking environment variable: %s", var);
-          g_string_append (lock_env, var);
-          g_string_append_c (lock_env, '\0');
-        }
-    }
-
   /* Populate final_argv->envp, overwriting its copy of original_environ.
    * We skip this if we are in a Flatpak environment, because in that case
    * we already used `--setenv` for all the variables that we care about and
@@ -2531,16 +2513,6 @@ main (int argc,
    * if we try. */
   g_clear_pointer (&container_env, pv_environ_free);
 
-  if (opt_launcher)
-    {
-      if (!flatpak_buffer_to_sealed_memfd_or_tmpfile (&lock_env_tmpf, "lock-env",
-                                                      lock_env->str, lock_env->len,
-                                                      error))
-        goto out;
-
-      lock_env_fd = g_strdup_printf ("%d", lock_env_tmpf.fd);
-    }
-
   if (bwrap != NULL)
     {
       /* Tell the application that it's running under a container manager
@@ -2645,9 +2617,6 @@ main (int argc,
           flatpak_bwrap_add_arg_printf (adverb_argv, "--pass-fd=%d", fd);
         }
 
-      if (lock_env_fd != NULL)
-        flatpak_bwrap_add_arg_printf (adverb_argv, "--pass-fd=%s", lock_env_fd);
-
       switch (opt_shell)
         {
           case PV_SHELL_AFTER:
@@ -2715,13 +2684,6 @@ main (int argc,
       if (opt_verbose)
         flatpak_bwrap_add_arg (launcher_argv, "--verbose");
 
-      g_debug ("Adding locked environment variables...");
-      g_assert (lock_env_fd != NULL);
-      g_assert (lock_env_tmpf.fd >= 0);
-      flatpak_bwrap_add_fd (launcher_argv, glnx_steal_fd (&lock_env_tmpf.fd));
-      flatpak_bwrap_add_args (launcher_argv,
-                              "--lock-env-from-fd", lock_env_fd, NULL);
-
       /* In --launcher mode, arguments after the "--" separator are
        * passed to the launcher */
       flatpak_bwrap_append_argsv (launcher_argv, &argv[1], argc - 1);