diff --git a/cli/login.go b/cli/login.go
index 7fd6a74866..ded67a016c 100644
--- a/cli/login.go
+++ b/cli/login.go
@@ -356,6 +356,20 @@ func (r *RootCmd) login() *serpent.Command {
 				return nil
 			}
 
+			// If CODER_SESSION_TOKEN is set in the environment, abort login.
+			// The env var takes precedence over a token stored on disk, so
+			// even if we complete login and write a new token to the session
+			// file, subsequent CLI commands would still use the environment
+			// variable value.
+			if inv.Environ.Get(envSessionToken) != "" {
+				return xerrors.Errorf(
+					"%s is set. This environment variable takes precedence over any session token stored on disk.\n\n"+
+						"To log in, unset the environment variable and re-run this command:\n\n"+
+						"\tunset %s",
+					envSessionToken, envSessionToken,
+				)
+			}
+
 			sessionToken, _ := inv.ParsedFlags().GetString(varToken)
 			if sessionToken == "" {
 				authURL := *serverURL
diff --git a/cli/login_test.go b/cli/login_test.go
index 5d1af88265..b03354ac5a 100644
--- a/cli/login_test.go
+++ b/cli/login_test.go
@@ -516,6 +516,18 @@ func TestLogin(t *testing.T) {
 		require.NotEqual(t, client.SessionToken(), sessionFile)
 	})
 
+	t.Run("SessionTokenEnvVar", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, nil)
+		coderdtest.CreateFirstUser(t, client)
+		root, _ := clitest.New(t, "login", client.URL.String())
+		root.Environ.Set("CODER_SESSION_TOKEN", "invalid-token")
+		err := root.Run()
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "CODER_SESSION_TOKEN is set")
+		require.Contains(t, err.Error(), "unset CODER_SESSION_TOKEN")
+	})
+
 	t.Run("KeepOrganizationContext", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, nil)