diff --git a/cmd/dex/config.go b/cmd/dex/config.go
index 3d07f2ff..2d71a936 100644
--- a/cmd/dex/config.go
+++ b/cmd/dex/config.go
@@ -103,7 +103,11 @@ func (p *password) UnmarshalJSON(b []byte) error {
 		data.Hash = os.Getenv(data.HashFromEnv)
 	}
 	if len(data.Hash) == 0 {
-		return fmt.Errorf("no password hash provided")
+		if len(data.HashFromEnv) > 0 {
+			data.Hash = os.Getenv(data.HashFromEnv)
+		} else {
+			return fmt.Errorf("no password hash provided")
+		}
 	}
 
 	// If this value is a valid bcrypt, use it.
diff --git a/cmd/dex/config_test.go b/cmd/dex/config_test.go
index 12c7b218..f17f62b4 100644
--- a/cmd/dex/config_test.go
+++ b/cmd/dex/config_test.go
@@ -4,6 +4,8 @@ import (
 	"os"
 	"testing"
 
+	"github.com/dexidp/dex/server"
+
 	"github.com/ghodss/yaml"
 	"github.com/kylelemons/godebug/pretty"