diff --git a/setup/config/config.go b/setup/config/config.go
index dedb5b031..545f462f7 100644
--- a/setup/config/config.go
+++ b/setup/config/config.go
@@ -589,9 +589,9 @@ func (config *Dendrite) replaceWithEnvVariables() {
 	// If env variable is set, get the value from the env
 	// variable and replace it in each supported field.
 
-	err := godotenv.Load(".env")
+	err := godotenv.Load()
 	if err != nil {
-		logrus.Errorln("error loading .env file", err)
+		logrus.Warningln(err)
 	}
 
 	config.Global.ServerName = gomatrixserverlib.ServerName(
@@ -616,7 +616,7 @@ func (config *Dendrite) replaceWithEnvVariables() {
 			replaceWithEnvVariables(config.ClientAPI.PublicKeyAuthentication.Ethereum.ConfigEnableAuthz)
 
 		logrus.Infof(
-			"Supported Ethereum chain_id=%v, network_url=%v, enable_authz=%v",
+			"Loaded config for Ethereum chain_id=%v, network_url=%v, enable_authz=%v",
 			config.ClientAPI.PublicKeyAuthentication.Ethereum.ConfigChainID,
 			config.ClientAPI.PublicKeyAuthentication.Ethereum.NetworkUrl,
 			config.ClientAPI.PublicKeyAuthentication.Ethereum.ConfigEnableAuthz,
diff --git a/setup/config/config_publickey.go b/setup/config/config_publickey.go
index 6d73717da..909f538a0 100644
--- a/setup/config/config_publickey.go
+++ b/setup/config/config_publickey.go
@@ -25,9 +25,9 @@ type EthereumAuthConfig struct {
 	Version           uint   `yaml:"version"`
 	NetworkUrl        string `yaml:"network_url"`  // Blockchain network provider URL
 	ConfigChainID     string `yaml:"chain_id"`     // Blockchain chain ID. Env variable can replace this property.
-	ConfigEnableAuthz string `yaml:"enable_authz"` // Enable / disable authorization during development. Will be removed when feature is done.
+	ConfigEnableAuthz string `yaml:"enable_authz"` // Enable / disable authorization during development. todo: remove this flag when feature is done.
 	chainID           int
-	enableAuthz       bool
+	enableAuthz       bool // todo: remove this flag when feature is done.
 }
 
 func (c *EthereumAuthConfig) GetChainID() int {
diff --git a/setup/flags.go b/setup/flags.go
index a9dac61a1..61c042dfc 100644
--- a/setup/flags.go
+++ b/setup/flags.go
@@ -18,6 +18,7 @@ import (
 	"flag"
 	"fmt"
 	"os"
+	"strconv"
 
 	"github.com/matrix-org/dendrite/internal"
 	"github.com/matrix-org/dendrite/setup/config"
@@ -28,6 +29,7 @@ var (
 	configPath                            = flag.String("config", "dendrite.yaml", "The path to the config file. For more information, see the config file in this repository.")
 	version                               = flag.Bool("version", false, "Shows the current version and exits immediately.")
 	enableRegistrationWithoutVerification = flag.Bool("really-enable-open-registration", false, "This allows open registration without secondary verification (reCAPTCHA). This is NOT RECOMMENDED and will SIGNIFICANTLY increase the risk that your server will be used to send spam or conduct attacks, which may result in your server being banned from rooms.")
+	enableAuthorizationChecks             = flag.Bool("enable-authz", false, "Enables authorization checks (aka space/channel gating).")
 )
 
 // ParseFlags parses the commandline flags and uses them to create a config.
@@ -53,5 +55,10 @@ func ParseFlags(monolith bool) *config.Dendrite {
 		cfg.ClientAPI.OpenRegistrationWithoutVerificationEnabled = true
 	}
 
+	// cmdline --enable-authz flag. env overrides it so that deployment scripts can set it.
+	// todo: remove this flag when feature is done.
+	cfg.ClientAPI.PublicKeyAuthentication.Ethereum.ConfigEnableAuthz = strconv.FormatBool(*enableAuthorizationChecks)
+	logrus.Info("enable-authz flag is set to ", *enableAuthorizationChecks)
+
 	return cfg
 }