diff --git a/selective-vpn-api/app/traffic_appkey.go b/selective-vpn-api/app/traffic_appkey.go
index 8e0ca3b..00fb997 100644
--- a/selective-vpn-api/app/traffic_appkey.go
+++ b/selective-vpn-api/app/traffic_appkey.go
@@ -77,6 +77,25 @@ func canonicalizeAppKey(appKey string, command string) string {
 				return "desktop:" + id
 			}
 		}
+	case "env":
+		// env VAR=1 /usr/bin/app ...
+		// EN: Skip env flags and VAR=VAL assignments and re-canonicalize for the real command.
+		// RU: Пропускаем флаги env и VAR=VAL и канонизируем по реальной команде.
+		for i := 1; i < len(clean); i++ {
+			tok := strings.TrimSpace(clean[i])
+			if tok == "" {
+				continue
+			}
+			if strings.HasPrefix(tok, "-") {
+				continue
+			}
+			// VAR=VAL assignment
+			if strings.Contains(tok, "=") {
+				continue
+			}
+			return canonicalizeAppKey(tok, strings.Join(clean[i:], " "))
+		}
+		return "env"
 	}
 
 	// If it looks like a path, canonicalize to basename.