diff --git a/.changeset/drop-dead-environment-flag.md b/.changeset/drop-dead-environment-flag.md
new file mode 100644
index 000000000..cae219962
--- /dev/null
+++ b/.changeset/drop-dead-environment-flag.md
@@ -0,0 +1,5 @@
+---
+"@zitadel/cli": minor
+---
+
+**Breaking:** remove `--environment` (`-e`) from `plan`, `apply` and the resource commands (`users`, `teams`, `sessions`, `events`, `grants`, `idps`, `projects`, `schemas`, `environments`, `releases`, `flow-definitions`, `branding`). It only accepted `development`, `preview` or `production`, which are not the platform's environment names, and it never reached the platform: its one effect was to read a server URL from `environments.<name>.server` in `zitadel.json`, which nothing writes. Passing it now fails as an unknown flag; drop it from scripts. `--server`, `ZITADEL_API_BASE` and the top-level `server` in `zitadel.json` still choose the server. `--environment` now means one thing: a real environment on the platform, as the `variables` commands use it.
diff --git a/apps/cli/README.md b/apps/cli/README.md
index bd6433fb3..905a3a6ff 100644
--- a/apps/cli/README.md
+++ b/apps/cli/README.md
@@ -179,21 +179,18 @@ Validate and upload repo config to the platform.
 ```
 USAGE
   $ zitadel apply [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry]
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -272,27 +269,23 @@ Get one branding revision by id.
 ```
 USAGE
   $ zitadel branding get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  branding revision id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Fields to show, comma-separated dot-paths.
-                              Defaults to the resource's own; `--json` is
-                              unaffected.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
+                         the resource's own; `--json` is unaffected.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -314,25 +307,22 @@ List branding.
 USAGE
   $ zitadel branding list [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>] [--plain]
-    [-e development|preview|production]
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Columns to show, comma-separated dot-paths (e.g.
-                              id,attributes.email). Defaults to the resource's
-                              own columns; `--json` is unaffected.
-      --plain                 Tab-separated rows with no header, for piping.
-                              Implied when stdout is not a terminal.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --fields=<value>   Columns to show, comma-separated dot-paths (e.g.
+                         id,attributes.email). Defaults to the resource's own
+                         columns; `--json` is unaffected.
+      --plain            Tab-separated rows with no header, for piping. Implied
+                         when stdout is not a terminal.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -485,27 +475,23 @@ Get one environment by id.
 ```
 USAGE
   $ zitadel environments get NAME [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   NAME  environment name
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Fields to show, comma-separated dot-paths.
-                              Defaults to the resource's own; `--json` is
-                              unaffected.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
+                         the resource's own; `--json` is unaffected.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -527,29 +513,26 @@ List environments.
 USAGE
   $ zitadel environments list [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain] [-e
-    development|preview|production]
+    --page-token <value>] [--fields <value>] [--plain]
 
 FLAGS
-  -a, --all                   Fetch every page instead of one.
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Columns to show, comma-separated dot-paths (e.g.
-                              id,attributes.email). Defaults to the resource's
-                              own columns; `--json` is unaffected.
-      --limit=<value>         Page size (server default 20, max 100).
-      --page-token=<value>    Continue from a previous page's next_page_token.
-      --plain                 Tab-separated rows with no header, for piping.
-                              Implied when stdout is not a terminal.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -a, --all                 Fetch every page instead of one.
+  -c, --cwd=<value>         Project directory to operate on.
+  -n, --non-interactive     Disable prompts. Required when scripting or running
+                            as an agent.
+  -s, --server=<value>      Override the resolved server URL.
+      --debug               Debug logging.
+      --dry-run             Preview without mutating files or the platform.
+      --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
+                            id,attributes.email). Defaults to the resource's own
+                            columns; `--json` is unaffected.
+      --limit=<value>       Page size (server default 20, max 100).
+      --page-token=<value>  Continue from a previous page's next_page_token.
+      --plain               Tab-separated rows with no header, for piping.
+                            Implied when stdout is not a terminal.
+      --[no-]telemetry      Send anonymous usage analytics. Disable with
+                            --no-telemetry.
+      --verbose             Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -570,27 +553,23 @@ Get one event by id.
 ```
 USAGE
   $ zitadel events get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  event id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Fields to show, comma-separated dot-paths.
-                              Defaults to the resource's own; `--json` is
-                              unaffected.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
+                         the resource's own; `--json` is unaffected.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -613,7 +592,7 @@ USAGE
   $ zitadel events list [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
-    [--sort <value>] [-e development|preview|production]
+    [--sort <value>]
 
 FLAGS
   -a, --all
@@ -622,10 +601,6 @@ FLAGS
   -c, --cwd=<value>
       Project directory to operate on.
 
-  -e, --environment=<option>
-      Target environment (default: development).
-      <options: development|preview|production>
-
   -n, --non-interactive
       Disable prompts. Required when scripting or running as an agent.
 
@@ -690,27 +665,23 @@ Get one flow definition by id.
 ```
 USAGE
   $ zitadel flow-definitions get FLOW [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   FLOW  flow name (newest revision) or revision id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Fields to show, comma-separated dot-paths.
-                              Defaults to the resource's own; `--json` is
-                              unaffected.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
+                         the resource's own; `--json` is unaffected.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -732,33 +703,29 @@ List flow-definitions.
 USAGE
   $ zitadel flow-definitions list [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain] [--filter <value>...] [-e
-    development|preview|production]
+    --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
 
 FLAGS
-  -a, --all                   Fetch every page instead of one.
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Columns to show, comma-separated dot-paths (e.g.
-                              id,attributes.email). Defaults to the resource's
-                              own columns; `--json` is unaffected.
-      --filter=<value>...     Filter as field=operation:value (operation
-                              defaults to equals). Fields: name (equals),
-                              purpose (equals), revisions (equals; values
-                              all|latest).
-      --limit=<value>         Page size (server default 20, max 100).
-      --page-token=<value>    Continue from a previous page's next_page_token.
-      --plain                 Tab-separated rows with no header, for piping.
-                              Implied when stdout is not a terminal.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -a, --all                 Fetch every page instead of one.
+  -c, --cwd=<value>         Project directory to operate on.
+  -n, --non-interactive     Disable prompts. Required when scripting or running
+                            as an agent.
+  -s, --server=<value>      Override the resolved server URL.
+      --debug               Debug logging.
+      --dry-run             Preview without mutating files or the platform.
+      --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
+                            id,attributes.email). Defaults to the resource's own
+                            columns; `--json` is unaffected.
+      --filter=<value>...   Filter as field=operation:value (operation defaults
+                            to equals). Fields: name (equals), purpose (equals),
+                            revisions (equals; values all|latest).
+      --limit=<value>       Page size (server default 20, max 100).
+      --page-token=<value>  Continue from a previous page's next_page_token.
+      --plain               Tab-separated rows with no header, for piping.
+                            Implied when stdout is not a terminal.
+      --[no-]telemetry      Send anonymous usage analytics. Disable with
+                            --no-telemetry.
+      --verbose             Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -783,21 +750,18 @@ USAGE
   $ zitadel grants create [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--principal-type user|team]
     [--principal-id <value>] [--relation viewer|editor|admin] [--expires-at
-    <value>] [--data <value> | --file <value>] [-e
-    development|preview|production]
+    <value>] [--data <value> | --file <value>]
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 RAW BODY FLAGS
   --data=<value>  Whole body as a JSON object, instead of the field flags.
@@ -836,26 +800,23 @@ Delete a grant by id.
 ```
 USAGE
   $ zitadel grants delete ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-f] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [-f]
 
 ARGUMENTS
   ID  grant id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -f, --force                 Delete the grant without the confirmation prompt.
-                              Required when non-interactive.
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -f, --force            Delete the grant without the confirmation prompt.
+                         Required when non-interactive.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -874,27 +835,23 @@ Get one grant by id.
 ```
 USAGE
   $ zitadel grants get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  grant id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Fields to show, comma-separated dot-paths.
-                              Defaults to the resource's own; `--json` is
-                              unaffected.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
+                         the resource's own; `--json` is unaffected.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -917,7 +874,7 @@ USAGE
   $ zitadel grants list [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
-    [--sort <value>] [-e development|preview|production]
+    [--sort <value>]
 
 FLAGS
   -a, --all
@@ -926,10 +883,6 @@ FLAGS
   -c, --cwd=<value>
       Project directory to operate on.
 
-  -e, --environment=<option>
-      Target environment (default: development).
-      <options: development|preview|production>
-
   -n, --non-interactive
       Disable prompts. Required when scripting or running as an agent.
 
@@ -1019,20 +972,18 @@ Create an identity provider connection.
 USAGE
   $ zitadel idps create [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--data <value> | --file
-    <value>] [-e development|preview|production]
+    <value>]
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 RAW BODY FLAGS
   --data=<value>  Whole body as a JSON object, instead of the field flags.
@@ -1057,27 +1008,23 @@ Get one identity provider connection by id.
 ```
 USAGE
   $ zitadel idps get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  identity provider connection id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Fields to show, comma-separated dot-paths.
-                              Defaults to the resource's own; `--json` is
-                              unaffected.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
+                         the resource's own; `--json` is unaffected.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1100,7 +1047,7 @@ USAGE
   $ zitadel idps list [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
-    [--sort <value>] [-e development|preview|production]
+    [--sort <value>]
 
 FLAGS
   -a, --all
@@ -1109,10 +1056,6 @@ FLAGS
   -c, --cwd=<value>
       Project directory to operate on.
 
-  -e, --environment=<option>
-      Target environment (default: development).
-      <options: development|preview|production>
-
   -n, --non-interactive
       Disable prompts. Required when scripting or running as an agent.
 
@@ -1204,21 +1147,18 @@ Validate config without mutation and preview the sync diff.
 ```
 USAGE
   $ zitadel plan [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry]
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1234,27 +1174,23 @@ Get one project by id.
 ```
 USAGE
   $ zitadel projects get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  project id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Fields to show, comma-separated dot-paths.
-                              Defaults to the resource's own; `--json` is
-                              unaffected.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
+                         the resource's own; `--json` is unaffected.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1277,34 +1213,32 @@ USAGE
   $ zitadel projects list [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
-    [--sort <value>] [-e development|preview|production]
+    [--sort <value>]
 
 FLAGS
-  -a, --all                   Fetch every page instead of one.
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Columns to show, comma-separated dot-paths (e.g.
-                              id,attributes.email). Defaults to the resource's
-                              own columns; `--json` is unaffected.
-      --filter=<value>...     Filter as field=operation:value (operation
-                              defaults to equals). Fields: created_at (equals|no
-                              t_equals|contains|not_contains|less_than|less_than
-                              _or_equal|greater_than|greater_than_or_equal).
-      --limit=<value>         Page size (server default 20, max 100).
-      --page-token=<value>    Continue from a previous page's next_page_token.
-      --plain                 Tab-separated rows with no header, for piping.
-                              Implied when stdout is not a terminal.
-      --sort=<value>          Sort as field:direction (asc|desc). Fields:
-                              created_at.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -a, --all                 Fetch every page instead of one.
+  -c, --cwd=<value>         Project directory to operate on.
+  -n, --non-interactive     Disable prompts. Required when scripting or running
+                            as an agent.
+  -s, --server=<value>      Override the resolved server URL.
+      --debug               Debug logging.
+      --dry-run             Preview without mutating files or the platform.
+      --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
+                            id,attributes.email). Defaults to the resource's own
+                            columns; `--json` is unaffected.
+      --filter=<value>...   Filter as field=operation:value (operation defaults
+                            to equals). Fields: created_at (equals|not_equals|co
+                            ntains|not_contains|less_than|less_than_or_equal|gre
+                            ater_than|greater_than_or_equal).
+      --limit=<value>       Page size (server default 20, max 100).
+      --page-token=<value>  Continue from a previous page's next_page_token.
+      --plain               Tab-separated rows with no header, for piping.
+                            Implied when stdout is not a terminal.
+      --sort=<value>        Sort as field:direction (asc|desc). Fields:
+                            created_at.
+      --[no-]telemetry      Send anonymous usage analytics. Disable with
+                            --no-telemetry.
+      --verbose             Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1328,23 +1262,21 @@ Update a project by id.
 USAGE
   $ zitadel projects update ID [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--name <value>] [--data
-    <value> | --file <value>] [-e development|preview|production]
+    <value> | --file <value>]
 
 ARGUMENTS
   ID  project id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 RAW BODY FLAGS
   --data=<value>  Whole body as a JSON object, instead of the field flags.
@@ -1372,27 +1304,23 @@ Get one release by id.
 ```
 USAGE
   $ zitadel releases get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  release id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Fields to show, comma-separated dot-paths.
-                              Defaults to the resource's own; `--json` is
-                              unaffected.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
+                         the resource's own; `--json` is unaffected.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1414,29 +1342,26 @@ List releases.
 USAGE
   $ zitadel releases list [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain] [-e
-    development|preview|production]
+    --page-token <value>] [--fields <value>] [--plain]
 
 FLAGS
-  -a, --all                   Fetch every page instead of one.
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Columns to show, comma-separated dot-paths (e.g.
-                              id,attributes.email). Defaults to the resource's
-                              own columns; `--json` is unaffected.
-      --limit=<value>         Page size (server default 20, max 100).
-      --page-token=<value>    Continue from a previous page's next_page_token.
-      --plain                 Tab-separated rows with no header, for piping.
-                              Implied when stdout is not a terminal.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -a, --all                 Fetch every page instead of one.
+  -c, --cwd=<value>         Project directory to operate on.
+  -n, --non-interactive     Disable prompts. Required when scripting or running
+                            as an agent.
+  -s, --server=<value>      Override the resolved server URL.
+      --debug               Debug logging.
+      --dry-run             Preview without mutating files or the platform.
+      --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
+                            id,attributes.email). Defaults to the resource's own
+                            columns; `--json` is unaffected.
+      --limit=<value>       Page size (server default 20, max 100).
+      --page-token=<value>  Continue from a previous page's next_page_token.
+      --plain               Tab-separated rows with no header, for piping.
+                            Implied when stdout is not a terminal.
+      --[no-]telemetry      Send anonymous usage analytics. Disable with
+                            --no-telemetry.
+      --verbose             Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1520,27 +1445,23 @@ Get one schema by id.
 ```
 USAGE
   $ zitadel schemas get SCHEMA [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   SCHEMA  object type (current revision) or revision id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Fields to show, comma-separated dot-paths.
-                              Defaults to the resource's own; `--json` is
-                              unaffected.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
+                         the resource's own; `--json` is unaffected.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1562,33 +1483,29 @@ List schemas.
 USAGE
   $ zitadel schemas list [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain] [--filter <value>...] [-e
-    development|preview|production]
+    --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
 
 FLAGS
-  -a, --all                   Fetch every page instead of one.
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Columns to show, comma-separated dot-paths (e.g.
-                              id,attributes.email). Defaults to the resource's
-                              own columns; `--json` is unaffected.
-      --filter=<value>...     Filter as field=operation:value (operation
-                              defaults to equals). Fields: object_type (equals),
-                              kind (equals), revisions (equals; values
-                              all|latest).
-      --limit=<value>         Page size (server default 20, max 100).
-      --page-token=<value>    Continue from a previous page's next_page_token.
-      --plain                 Tab-separated rows with no header, for piping.
-                              Implied when stdout is not a terminal.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -a, --all                 Fetch every page instead of one.
+  -c, --cwd=<value>         Project directory to operate on.
+  -n, --non-interactive     Disable prompts. Required when scripting or running
+                            as an agent.
+  -s, --server=<value>      Override the resolved server URL.
+      --debug               Debug logging.
+      --dry-run             Preview without mutating files or the platform.
+      --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
+                            id,attributes.email). Defaults to the resource's own
+                            columns; `--json` is unaffected.
+      --filter=<value>...   Filter as field=operation:value (operation defaults
+                            to equals). Fields: object_type (equals), kind
+                            (equals), revisions (equals; values all|latest).
+      --limit=<value>       Page size (server default 20, max 100).
+      --page-token=<value>  Continue from a previous page's next_page_token.
+      --plain               Tab-separated rows with no header, for piping.
+                            Implied when stdout is not a terminal.
+      --[no-]telemetry      Send anonymous usage analytics. Disable with
+                            --no-telemetry.
+      --verbose             Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1628,27 +1545,23 @@ Get one session by id.
 ```
 USAGE
   $ zitadel sessions get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  session id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Fields to show, comma-separated dot-paths.
-                              Defaults to the resource's own; `--json` is
-                              unaffected.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
+                         the resource's own; `--json` is unaffected.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1671,7 +1584,7 @@ USAGE
   $ zitadel sessions list [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
-    [--sort <value>] [-e development|preview|production]
+    [--sort <value>]
 
 FLAGS
   -a, --all
@@ -1680,10 +1593,6 @@ FLAGS
   -c, --cwd=<value>
       Project directory to operate on.
 
-  -e, --environment=<option>
-      Target environment (default: development).
-      <options: development|preview|production>
-
   -n, --non-interactive
       Disable prompts. Required when scripting or running as an agent.
 
@@ -1750,26 +1659,23 @@ Revoke a session by id.
 ```
 USAGE
   $ zitadel sessions revoke ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-f] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [-f]
 
 ARGUMENTS
   ID  session id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -f, --force                 Revoke the session without the confirmation
-                              prompt. Required when non-interactive.
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -f, --force            Revoke the session without the confirmation prompt.
+                         Required when non-interactive.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1964,20 +1870,18 @@ Create a team.
 USAGE
   $ zitadel teams create [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--name <value>] [--data
-    <value> | --file <value>] [-e development|preview|production]
+    <value> | --file <value>]
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 RAW BODY FLAGS
   --data=<value>  Whole body as a JSON object, instead of the field flags.
@@ -2007,26 +1911,23 @@ Deactivate a team by id.
 ```
 USAGE
   $ zitadel teams deactivate ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-f] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [-f]
 
 ARGUMENTS
   ID  team id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -f, --force                 Deactivate the team without the confirmation
-                              prompt. Required when non-interactive.
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -f, --force            Deactivate the team without the confirmation prompt.
+                         Required when non-interactive.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2045,27 +1946,23 @@ Get one team by id.
 ```
 USAGE
   $ zitadel teams get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  team id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Fields to show, comma-separated dot-paths.
-                              Defaults to the resource's own; `--json` is
-                              unaffected.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
+                         the resource's own; `--json` is unaffected.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2088,7 +1985,7 @@ USAGE
   $ zitadel teams list [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
-    [--sort <value>] [-e development|preview|production]
+    [--sort <value>]
 
 FLAGS
   -a, --all
@@ -2097,10 +1994,6 @@ FLAGS
   -c, --cwd=<value>
       Project directory to operate on.
 
-  -e, --environment=<option>
-      Target environment (default: development).
-      <options: development|preview|production>
-
   -n, --non-interactive
       Disable prompts. Required when scripting or running as an agent.
 
@@ -2166,23 +2059,21 @@ Update a team by id.
 USAGE
   $ zitadel teams update ID [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--name <value>] [--data
-    <value> | --file <value>] [-e development|preview|production]
+    <value> | --file <value>]
 
 ARGUMENTS
   ID  team id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 RAW BODY FLAGS
   --data=<value>  Whole body as a JSON object, instead of the field flags.
@@ -2243,21 +2134,18 @@ Create an user.
 USAGE
   $ zitadel users create [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--schema <value>]
-    [--attributes <value>...] [--data <value> | --file <value>] [-e
-    development|preview|production]
+    [--attributes <value>...] [--data <value> | --file <value>]
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 REQUIRED FIELD FLAGS
   --attributes=<value>...  (required) Repeatable attributes entry: key=value for
@@ -2291,26 +2179,23 @@ Delete an user by id.
 ```
 USAGE
   $ zitadel users delete ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-f] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [-f]
 
 ARGUMENTS
   ID  user id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -f, --force                 Delete the user without the confirmation prompt.
-                              Required when non-interactive.
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -f, --force            Delete the user without the confirmation prompt.
+                         Required when non-interactive.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2329,27 +2214,23 @@ Get one user by id.
 ```
 USAGE
   $ zitadel users get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>] [-e
-    development|preview|production]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  user id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --fields=<value>        Fields to show, comma-separated dot-paths.
-                              Defaults to the resource's own; `--json` is
-                              unaffected.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
+                         the resource's own; `--json` is unaffected.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2372,7 +2253,7 @@ USAGE
   $ zitadel users list [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
-    [--sort <value>] [-e development|preview|production]
+    [--sort <value>]
 
 FLAGS
   -a, --all
@@ -2381,10 +2262,6 @@ FLAGS
   -c, --cwd=<value>
       Project directory to operate on.
 
-  -e, --environment=<option>
-      Target environment (default: development).
-      <options: development|preview|production>
-
   -n, --non-interactive
       Disable prompts. Required when scripting or running as an agent.
 
@@ -2456,24 +2333,21 @@ Update an user by id.
 USAGE
   $ zitadel users update ID [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [--verbose] [--debug] [--telemetry] [--schema <value>]
-    [--attributes <value>...] [--data <value> | --file <value>] [-e
-    development|preview|production]
+    [--attributes <value>...] [--data <value> | --file <value>]
 
 ARGUMENTS
   ID  user id
 
 FLAGS
-  -c, --cwd=<value>           Project directory to operate on.
-  -e, --environment=<option>  Target environment (default: development).
-                              <options: development|preview|production>
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
-  -s, --server=<value>        Override the resolved server URL.
-      --debug                 Debug logging.
-      --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
-      --verbose               Verbose logging.
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+      --verbose          Verbose logging.
 
 OPTIONAL FIELD FLAGS
   --attributes=<value>...  Repeatable attributes entry: key=value for a string,
diff --git a/apps/cli/SKILLS.md b/apps/cli/SKILLS.md
index 6ab4ec58e..0a4f9d1da 100644
--- a/apps/cli/SKILLS.md
+++ b/apps/cli/SKILLS.md
@@ -347,6 +347,10 @@ docker --image <ref>` remains the explicit image override for debugging.
 
 - `plan` — validate config and preview the sync diff without mutating anything.
 - `apply` — validate and upload repo config to the platform.
+- `plan`, `apply` and the resource commands take no `--environment`: they
+  work on the project's resources and do not select an environment.
+  `variables` is the only command group that addresses an environment; putting
+  config onto an environment is `deploy`'s job (ADR 035).
 - `plan` and `apply --dry-run` also emit `data.warnings`: non-blocking
   findings as `{path, rule, message}`, the same text the human plan prints as
   `# warning:` lines and `apply` prints through stderr. They never fail a run.
diff --git a/apps/cli/src/commands/apply.ts b/apps/cli/src/commands/apply.ts
index 6e2232bb2..9101468eb 100644
--- a/apps/cli/src/commands/apply.ts
+++ b/apps/cli/src/commands/apply.ts
@@ -1,10 +1,8 @@
-import { Flags } from "@oclif/core";
 import { consola } from "consola";
 
 import { createZitadelClient } from "@zitadel/api/client";
 
 import { BaseCommand, CommandGroups, type JsonEnvelope } from "../lib/oclif";
-import { environmentSchema } from "../lib/environment";
 import {
   buildSyncPlan,
   collectPlanWarnings,
@@ -30,14 +28,6 @@ export default class Apply extends BaseCommand {
   static override description = "Validate and upload repo config to the platform.";
   static override group = CommandGroups.configuration;
   static override groupOrder = 2;
-  static override flags = {
-    environment: Flags.string({
-      char: "e",
-      description: "Target environment (default: development).",
-      options: [...environmentSchema.options],
-    }),
-  };
-
   async run(): Promise<JsonEnvelope> {
     const { flags } = await this.parse(Apply);
     await this.toMeta(flags);
diff --git a/apps/cli/src/commands/plan.ts b/apps/cli/src/commands/plan.ts
index 3da4a58b9..375804733 100644
--- a/apps/cli/src/commands/plan.ts
+++ b/apps/cli/src/commands/plan.ts
@@ -1,10 +1,8 @@
-import { Flags } from "@oclif/core";
 import { consola } from "consola";
 
 import { createZitadelClient } from "@zitadel/api/client";
 
 import { BaseCommand, CommandGroups, type JsonEnvelope } from "../lib/oclif";
-import { environmentSchema } from "../lib/environment";
 import {
   buildSyncPlan,
   collectPlanWarnings,
@@ -27,14 +25,6 @@ export default class Plan extends BaseCommand {
   static override description = "Validate config without mutation and preview the sync diff.";
   static override group = CommandGroups.configuration;
   static override groupOrder = 1;
-  static override flags = {
-    environment: Flags.string({
-      char: "e",
-      description: "Target environment (default: development).",
-      options: [...environmentSchema.options],
-    }),
-  };
-
   async run(): Promise<JsonEnvelope> {
     const { flags } = await this.parse(Plan);
     await this.toMeta(flags);
diff --git a/apps/cli/src/commands/resources.ts b/apps/cli/src/commands/resources.ts
index 2b2390eb5..bc211a6e4 100644
--- a/apps/cli/src/commands/resources.ts
+++ b/apps/cli/src/commands/resources.ts
@@ -1,4 +1,3 @@
-import { Flags } from "@oclif/core";
 import { createZitadelClient, type ZitadelClient } from "@zitadel/api/client";
 import {
   CreateGrantBody,
@@ -62,7 +61,6 @@ import type {
 } from "@zitadel/api/generated/model";
 import { consola } from "consola";
 
-import { environmentSchema } from "../lib/environment";
 import { CommandGroups } from "../lib/oclif/groups";
 import { ZitadelError } from "../lib/errors";
 import { buildResourceCommands, type ResourceRegistry } from "../lib/oclif/crud";
@@ -557,13 +555,6 @@ export const RESOURCES = {
  */
 export const RESOURCE_COMMANDS = buildResourceCommands<Platform>(RESOURCES, {
   operations: FILTER_OPERATIONS,
-  flags: {
-    environment: Flags.string({
-      char: "e",
-      description: "Target environment (default: development).",
-      options: [...environmentSchema.options],
-    }),
-  },
   connect: async ({ cwd, source }) => {
     const secret = await readZitadelSecret(cwd);
     // Which project and server a verb is about is worth stating to a human, and
diff --git a/apps/cli/src/lib/environment.ts b/apps/cli/src/lib/environment.ts
index 26b96651a..2e2871c76 100644
--- a/apps/cli/src/lib/environment.ts
+++ b/apps/cli/src/lib/environment.ts
@@ -1,22 +1,7 @@
-import { z } from "zod";
-
 import type { ZitadelClient } from "@zitadel/api/client";
 
 import { ZitadelError } from "./errors";
 
-/**
- * CLI-side deployment environment. Not an API model — it gates which
- * `zitadel.json` environment block and server the commands target.
- * Project request/response shapes live in `@zitadel/api`
- * (generated from the OpenAPI spec).
- *
- * This is the older of the CLI's two meanings of "environment", used by
- * `plan`, `apply` and the resource commands to pick a server. It does not match
- * the platform's environments, which are open DNS-style names seeded as `dev`,
- * `staging` and `prod`; {@link assertEnvironmentName} is the grammar for those.
- */
-export const environmentSchema = z.enum(["development", "preview", "production"]);
-
 /**
  * The platform's environment-name grammar, from `environment-name.yaml`: a
  * lowercase DNS-style label. Checked before any request so a malformed name
diff --git a/apps/cli/src/lib/oclif/base.ts b/apps/cli/src/lib/oclif/base.ts
index 508168c9e..f7d0af040 100644
--- a/apps/cli/src/lib/oclif/base.ts
+++ b/apps/cli/src/lib/oclif/base.ts
@@ -124,11 +124,10 @@ export abstract class BaseCommand extends Command {
   ): Promise<GlobalOptions> {
     const cwd = resolveCwd(typeof flags.cwd === "string" ? flags.cwd : undefined);
     const serverFlag = typeof flags.server === "string" ? flags.server : undefined;
-    const environment = typeof flags.environment === "string" ? flags.environment : "development";
     const source =
       options.resolveServer === false
         ? { value: options.source ?? "", origin: "default" as const }
-        : await resolveServer({ cwd, env: process.env, serverFlag, environment });
+        : await resolveServer({ cwd, env: process.env, serverFlag });
     const json = this.jsonEnabled();
     const isTTY = Boolean(process.stdout.isTTY && process.stdin.isTTY);
     const verbose = Boolean(flags.verbose);
diff --git a/apps/cli/src/lib/oclif/crud/fields.ts b/apps/cli/src/lib/oclif/crud/fields.ts
index d616f4cff..4caba2fe4 100644
--- a/apps/cli/src/lib/oclif/crud/fields.ts
+++ b/apps/cli/src/lib/oclif/crud/fields.ts
@@ -36,7 +36,7 @@ export type BodyField = Readonly<{
 }>;
 
 /** Flags the write commands own; a body field of the same name stays raw-body only. */
-const RESERVED = new Set(["data", "file", "json", "cwd", "server", "force", "environment", "help"]);
+const RESERVED = new Set(["data", "file", "json", "cwd", "server", "force", "help"]);
 
 const kebab = (name: string): string => name.replaceAll("_", "-");
 
diff --git a/apps/cli/src/lib/oclif/crud/types.ts b/apps/cli/src/lib/oclif/crud/types.ts
index a667c8438..a0f617582 100644
--- a/apps/cli/src/lib/oclif/crud/types.ts
+++ b/apps/cli/src/lib/oclif/crud/types.ts
@@ -219,7 +219,7 @@ export type ResourceCommandOptions<Ctx> = Readonly<{
   connect: (meta: GlobalOptions) => Promise<Ctx>;
   /** Filter operations the query endpoints accept (`equals`, `contains`, …). */
   operations: readonly string[];
-  /** Extra flags added to every generated command (e.g. an environment selector). */
+  /** Extra flags added to every generated command. */
   flags?: Interfaces.FlagInput;
   /** Wire vocabulary; each property falls back to {@link DEFAULT_WIRE}. */
   wire?: Partial<WireConventions>;
diff --git a/apps/cli/src/lib/oclif/environment-command.ts b/apps/cli/src/lib/oclif/environment-command.ts
index 493140a65..03cf939bb 100644
--- a/apps/cli/src/lib/oclif/environment-command.ts
+++ b/apps/cli/src/lib/oclif/environment-command.ts
@@ -52,13 +52,10 @@ export abstract class EnvironmentCommand extends BaseCommand {
   private projectLevel = false;
 
   /**
-   * Validate the owner flags, then build the invocation context without them.
+   * Validate the owner flags, then build the invocation context.
    *
-   * `--environment` names an owner on the one instance the CLI talks to; it is
-   * not a `zitadel.json` block. `BaseCommand.toMeta` passes a
-   * `flags.environment` to the server resolver, where a matching
-   * `environments.<name>.server` would redirect the request, so it is withheld
-   * and the server resolves as it does for a command with no such flag.
+   * `--environment` names an owner on the one instance the CLI talks to; it
+   * plays no part in choosing that instance.
    */
   protected override async toMeta(
     flags: Record<string, unknown>,
@@ -69,7 +66,7 @@ export abstract class EnvironmentCommand extends BaseCommand {
       this.requestedEnvironment = flags.environment;
     }
     this.projectLevel = flags["project-level"] === true;
-    return super.toMeta({ ...flags, environment: undefined }, options);
+    return super.toMeta(flags, options);
   }
 
   /**
diff --git a/apps/cli/src/lib/server.ts b/apps/cli/src/lib/server.ts
index 2dfb23f4d..361d28f09 100644
--- a/apps/cli/src/lib/server.ts
+++ b/apps/cli/src/lib/server.ts
@@ -3,7 +3,7 @@ import { join } from "node:path";
 
 import { ZitadelError } from "./errors";
 import { resolveLocalServer } from "./local-server/runtime";
-import { isObject, parseJsonObject } from "./json";
+import { parseJsonObject } from "./json";
 
 /**
  * Server URL used when nothing else resolves. Also surfaced in hints and
@@ -19,26 +19,24 @@ export const DEFAULT_SERVER = "https://api.zitadel.cloud";
  */
 export type ResolvedServer = {
   value: string;
-  origin: "flag" | "env" | "config-env" | "config-top" | "default" | "local";
+  origin: "flag" | "env" | "config-top" | "default" | "local";
 };
 
 /**
  * Inputs to {@link resolveServer}. Passed explicitly (cwd, env) rather
  * than read from globals so resolution is pure and testable. `serverFlag`
- * and `environment` come from the parsed CLI invocation.
+ * comes from the parsed CLI invocation.
  */
 export type ResolveServerInput = {
   cwd: string;
   env: NodeJS.ProcessEnv;
   serverFlag?: string;
-  environment?: string;
 };
 
 /**
  * Resolves which server the CLI should target, applying a fixed
  * precedence: explicit `--server` flag, then `ZITADEL_API_BASE`, then the
- * selected environment block in `zitadel.json`, then the config's
- * top-level `server`, falling back to {@link DEFAULT_SERVER}. Every
+ * `server` in `zitadel.json`, falling back to {@link DEFAULT_SERVER}. Every
  * candidate is validated to a normalised origin; an invalid URL throws a
  * `ZitadelError` rather than silently falling through.
  */
@@ -52,14 +50,8 @@ export async function resolveServer(input: ResolveServerInput): Promise<Resolved
   }
 
   const config = await readConfig(input.cwd);
-  if (config) {
-    const envBranch = readEnvServer(config, input.environment);
-    if (envBranch) {
-      return validate(input.cwd, { value: envBranch, origin: "config-env" });
-    }
-    if (typeof config.server === "string") {
-      return validate(input.cwd, { value: config.server, origin: "config-top" });
-    }
+  if (typeof config?.server === "string") {
+    return validate(input.cwd, { value: config.server, origin: "config-top" });
   }
 
   return { value: DEFAULT_SERVER, origin: "default" };
@@ -105,21 +97,3 @@ async function readConfig(cwd: string): Promise<Record<string, unknown> | undefi
     throw error;
   }
 }
-
-function readEnvServer(
-  config: Record<string, unknown>,
-  environment: string | undefined,
-): string | undefined {
-  if (!environment) {
-    return undefined;
-  }
-  const envs = config.environments;
-  if (!isObject(envs)) {
-    return undefined;
-  }
-  const branch = envs[environment];
-  if (!isObject(branch)) {
-    return undefined;
-  }
-  return typeof branch.server === "string" ? branch.server : undefined;
-}
diff --git a/apps/cli/tests/unit/commands/apply.test.ts b/apps/cli/tests/unit/commands/apply.test.ts
index 3e40753bd..87e6222ca 100644
--- a/apps/cli/tests/unit/commands/apply.test.ts
+++ b/apps/cli/tests/unit/commands/apply.test.ts
@@ -87,6 +87,26 @@ describe("apply command pre-flight", () => {
     expect(json.code).toBe("E_VALIDATION");
     expect(json.message).toContain("Missing environment variables");
   });
+
+  it.each(["-e", "--environment"])("refuses %s, which addresses no environment", async (flag) => {
+    const cwd = await makeCwd({});
+
+    const res = await runCliForTest([
+      "apply",
+      flag,
+      "prod",
+      "--cwd",
+      cwd,
+      "--json",
+      "--server",
+      "https://api.zitadel.cloud",
+    ]);
+
+    expect(res.exitCode).toBe(3);
+    const json = parseJson(res.stdout) as { code: string; message: string };
+    expect(json.code).toBe("E_VALIDATION");
+    expect(json.message).toContain("Nonexistent flag");
+  });
 });
 
 const VALID_USER_SCHEMA = {
diff --git a/apps/cli/tests/unit/commands/plan.test.ts b/apps/cli/tests/unit/commands/plan.test.ts
index a635f4266..7e9667176 100644
--- a/apps/cli/tests/unit/commands/plan.test.ts
+++ b/apps/cli/tests/unit/commands/plan.test.ts
@@ -132,4 +132,24 @@ describe("plan command", () => {
     expect(json.status).toBe("error");
     expect(json.code).toBe("E_VALIDATION");
   });
+
+  it.each(["-e", "--environment"])("refuses %s, which addresses no environment", async (flag) => {
+    const cwd = await makeProject();
+
+    const res = await runCliForTest([
+      "plan",
+      flag,
+      "prod",
+      "--cwd",
+      cwd,
+      "--json",
+      "--server",
+      "https://api.zitadel.cloud",
+    ]);
+
+    expect(res.exitCode).toBe(3);
+    const json = parseJson(res.stdout) as { code: string; message: string };
+    expect(json.code).toBe("E_VALIDATION");
+    expect(json.message).toContain("Nonexistent flag");
+  });
 });
diff --git a/apps/cli/tests/unit/commands/resources.test.ts b/apps/cli/tests/unit/commands/resources.test.ts
index 6b09c7314..7a60d478c 100644
--- a/apps/cli/tests/unit/commands/resources.test.ts
+++ b/apps/cli/tests/unit/commands/resources.test.ts
@@ -72,6 +72,28 @@ describe("resource registry", () => {
     }
   });
 
+  it("gives no generated command an --environment flag, since none addresses one", () => {
+    const generated = Object.entries(COMMANDS).filter(([id]) => id.split(":")[0] in RESOURCES);
+    expect(generated.length).toBeGreaterThan(0);
+    for (const [id, command] of generated) {
+      const flags = { ...command.baseFlags, ...command.flags };
+      expect(Object.keys(flags), id).not.toContain("environment");
+      expect(
+        Object.values(flags).map((flag) => flag.char),
+        id,
+      ).not.toContain("e");
+    }
+  });
+
+  it("refuses -e on a generated command before any request", async () => {
+    const cwd = await makeProject();
+    const res = await run(cwd, ["users", "list", "-e", "prod"]);
+    expect(res.exitCode).toBe(3);
+    const json = parseJson(res.stdout) as { code: string; message: string };
+    expect(json.code).toBe("E_VALIDATION");
+    expect(json.message).toContain("Nonexistent flag");
+  });
+
   it("advertises only filter and sort fields the generated query schemas accept", () => {
     // Only a spec carrying `body` is sent as a structured query, and that body
     // is the authority on which fields exist. A GET list has no such schema,
diff --git a/apps/cli/tests/unit/lib/environment.test.ts b/apps/cli/tests/unit/lib/environment.test.ts
index 34a2b4647..2124ac09d 100644
--- a/apps/cli/tests/unit/lib/environment.test.ts
+++ b/apps/cli/tests/unit/lib/environment.test.ts
@@ -4,32 +4,10 @@ import type { ZitadelClient } from "@zitadel/api/client";
 
 import {
   assertEnvironmentName,
-  environmentSchema,
   listEnvironmentNames,
   ownerLabel,
 } from "../../../src/lib/environment";
 
-describe("environmentSchema", () => {
-  it.each(["development", "preview", "production"])("parses the valid environment %s", (value) => {
-    expect(environmentSchema.parse(value)).toBe(value);
-  });
-
-  it("rejects an unknown environment string", () => {
-    const result = environmentSchema.safeParse("staging");
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects a non-string value", () => {
-    const result = environmentSchema.safeParse(42);
-    expect(result.success).toBe(false);
-  });
-
-  it("rejects an empty string", () => {
-    const result = environmentSchema.safeParse("");
-    expect(result.success).toBe(false);
-  });
-});
-
 describe("assertEnvironmentName", () => {
   it.each(["dev", "prod", "staging", "staging-eu", "a".repeat(63)])(
     "accepts the platform-legal name %s",
diff --git a/apps/cli/tests/unit/lib/server.test.ts b/apps/cli/tests/unit/lib/server.test.ts
index 1e72ba12d..e96d349f0 100644
--- a/apps/cli/tests/unit/lib/server.test.ts
+++ b/apps/cli/tests/unit/lib/server.test.ts
@@ -39,7 +39,6 @@ describe("resolveServer", () => {
       cwd: dir,
       env: { ZITADEL_API_BASE: "https://env.example.com" },
       serverFlag: "https://flag.example.com",
-      environment: "production",
     });
     expect(resolved).toEqual({ value: "https://flag.example.com", origin: "flag" });
   });
@@ -53,51 +52,25 @@ describe("resolveServer", () => {
     expect(resolved).toEqual({ value: "https://env.example.com", origin: "env" });
   });
 
-  it("reads the selected environment block from zitadel.json", async () => {
-    await writeConfig({
-      server: "https://top.example.com",
-      environments: {
-        production: { server: "https://prod.example.com" },
-      },
-    });
-    const resolved = await resolveServer({ cwd: dir, env: {}, environment: "production" });
-    expect(resolved).toEqual({ value: "https://prod.example.com", origin: "config-env" });
-  });
-
-  it("falls through to the top-level server when the env block is absent", async () => {
-    await writeConfig({
-      server: "https://top.example.com",
-      environments: { preview: { server: "https://preview.example.com" } },
-    });
-    const resolved = await resolveServer({ cwd: dir, env: {}, environment: "production" });
-    expect(resolved).toEqual({ value: "https://top.example.com", origin: "config-top" });
-  });
-
-  it("uses the top-level server when no environment is provided", async () => {
+  it("uses the top-level server from zitadel.json", async () => {
     await writeConfig({ server: "https://top.example.com" });
     const resolved = await resolveServer({ cwd: dir, env: {} });
     expect(resolved).toEqual({ value: "https://top.example.com", origin: "config-top" });
   });
 
-  it("falls back to DEFAULT_SERVER when the config has no server fields", async () => {
-    await writeConfig({ environments: { production: { other: "value" } } });
-    const resolved = await resolveServer({ cwd: dir, env: {}, environment: "production" });
-    expect(resolved).toEqual({ value: DEFAULT_SERVER, origin: "default" });
-  });
-
-  it("ignores a non-string environment server and falls through to top-level", async () => {
+  it("ignores a per-environment server block in zitadel.json", async () => {
     await writeConfig({
       server: "https://top.example.com",
-      environments: { production: { server: 123 } },
+      environments: { production: { server: "https://prod.example.com" } },
     });
-    const resolved = await resolveServer({ cwd: dir, env: {}, environment: "production" });
+    const resolved = await resolveServer({ cwd: dir, env: {} });
     expect(resolved).toEqual({ value: "https://top.example.com", origin: "config-top" });
   });
 
-  it("ignores an array-valued environments field", async () => {
-    await writeConfig({ server: "https://top.example.com", environments: ["nope"] });
-    const resolved = await resolveServer({ cwd: dir, env: {}, environment: "production" });
-    expect(resolved).toEqual({ value: "https://top.example.com", origin: "config-top" });
+  it("falls back to DEFAULT_SERVER when the config has no server field", async () => {
+    await writeConfig({ environments: { production: { server: "https://prod.example.com" } } });
+    const resolved = await resolveServer({ cwd: dir, env: {} });
+    expect(resolved).toEqual({ value: DEFAULT_SERVER, origin: "default" });
   });
 
   it("normalises a resolved URL down to its origin", async () => {