diff --git a/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/application-check.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/application-check.mdx
index f4c1fbe2380..e1911cb44d4 100644
--- a/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/application-check.mdx
+++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/application-check.mdx
@@ -33,10 +33,12 @@ The Application Check device posture attribute checks that a specific applicatio
    2. **Operating system**: Select your operating system.
    3. **Application path**: Enter the file path for the executable that will be running (for example, `C:\Program Files\myfolder\myfile.exe`).
 
+		<Render file="posture/env-vars-in-file-paths" product="cloudflare-one" />
+
    :::note
    - Be sure to enter the binary file path, not the application launch path. When checking for an application on macOS, a common mistake is to enter `/Applications/ApplicationName.app`. This will not work as `ApplicationName.app` is a folder. The executable file that will be running is located within the folder, for example `ApplicationName.app/Contents/MacOS/ApplicationName`.
-   - Some applications change their file path after an update. Ensure that the application is always in a stable location, or use an environment variable to identify a specific folder. For example, Windows provides [recognized environment variables](https://learn.microsoft.com/en-us/windows/deployment/usmt/usmt-recognized-environment-variables) that you can reference in your file path (`%PROGRAMFILES%\myfolder\myfile.exe`).
-     :::
+   - Some applications change their file path after an update. Ensure that the application is always in a stable location or use environment variables.
+	 :::
 
 5. **Signing certificate thumbprint (recommended)**: Enter the [thumbprint of the publishing certificate](#determine-the-signing-thumbprint) used to sign the binary. Adding this information will enable the check to ensure that the application was signed by the expected software developer.
 6. **SHA-256 (optional)**: Enter the [SHA-256 value](#determine-the-sha-256-value) of the binary. This is used to ensure the integrity of the binary file on the device.
diff --git a/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/file-check.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/file-check.mdx
index dedfd613808..0759a17a720 100644
--- a/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/file-check.mdx
+++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/file-check.mdx
@@ -32,6 +32,8 @@ The File Check device posture attribute checks for the presence of a file on a d
    1. **Name**: Enter a unique name for this device posture check.
    2. **Operating system**: Select your operating system.
    3. **File Path**: Enter a file path (for example, `c:\my folder\myfile.exe`).
+
+		<Render file="posture/env-vars-in-file-paths" product="cloudflare-one" />
    4. **Signing certificate thumbprint (recommended)**: Enter the [thumbprint](/cloudflare-one/reusable-components/posture-checks/client-checks/application-check/#determine-the-signing-thumbprint) of the publishing certificate used to sign the file. Adding this information will enable the check to ensure that the file was signed by the expected software developer.
    5. **SHA-256 (optional)**: Enter the [SHA-256 value](/cloudflare-one/reusable-components/posture-checks/client-checks/application-check/#determine-the-sha-256-value) of the file. This is used to ensure the integrity of the file on the device.
 
diff --git a/src/content/partials/cloudflare-one/posture/env-vars-in-file-paths.mdx b/src/content/partials/cloudflare-one/posture/env-vars-in-file-paths.mdx
new file mode 100644
index 00000000000..4842622a12b
--- /dev/null
+++ b/src/content/partials/cloudflare-one/posture/env-vars-in-file-paths.mdx
@@ -0,0 +1,14 @@
+---
+{}
+---
+
+import { Details } from "~/components";
+
+<Details header="Environment variables" open={true}>
+
+File paths can include environment variables to account for differences across devices. Environment variables are resolved in the context of the Cloudflare One Client daemon, not the logged-in user. Only variables available to the daemon process at runtime will work.
+
+- **Windows**: Use `%VAR%` syntax. For example, `%PROGRAMFILES%\myfolder\myfile.exe`.
+- **macOS/Linux**: Use `${VAR}` syntax. For example, `${RUNTIME_DIRECTORY}/myfolder/myfile`.
+
+</Details>