diff --git a/Library/Homebrew/dev-cmd/bump.rb b/Library/Homebrew/dev-cmd/bump.rb
index 72635110c7..009865c85d 100644
--- a/Library/Homebrew/dev-cmd/bump.rb
+++ b/Library/Homebrew/dev-cmd/bump.rb
@@ -61,9 +61,7 @@ module Homebrew
 
     unless Utils::Curl.curl_supports_tls13?
       begin
-        unless Pathname.new(ENV["HOMEBREW_BREWED_CURL_PATH"]).exist?
-          ensure_formula_installed!("curl", reason: "Repology queries")
-        end
+        ensure_formula_installed!("curl", reason: "Repology queries") unless HOMEBREW_BREWED_CURL_PATH.exist?
       rescue FormulaUnavailableError
         opoo "A newer `curl` is required for Repology queries."
       end
diff --git a/Library/Homebrew/development_tools.rb b/Library/Homebrew/development_tools.rb
index 382ed7eb83..003dbfa6eb 100644
--- a/Library/Homebrew/development_tools.rb
+++ b/Library/Homebrew/development_tools.rb
@@ -118,7 +118,7 @@ class DevelopmentTools
     sig { returns(T::Hash[String, T.nilable(String)]) }
     def build_system_info
       {
-        "os"         => ENV["HOMEBREW_SYSTEM"],
+        "os"         => HOMEBREW_SYSTEM,
         "os_version" => OS_VERSION,
         "cpu_family" => Hardware::CPU.family.to_s,
       }
diff --git a/Library/Homebrew/global.rb b/Library/Homebrew/global.rb
index 7ba25e07cd..2c0ac5d08a 100644
--- a/Library/Homebrew/global.rb
+++ b/Library/Homebrew/global.rb
@@ -34,25 +34,28 @@ ActiveSupport::Inflector.inflections(:en) do |inflect|
   inflect.irregular "it", "they"
 end
 
-HOMEBREW_BOTTLE_DEFAULT_DOMAIN = ENV["HOMEBREW_BOTTLE_DEFAULT_DOMAIN"]
-HOMEBREW_BREW_DEFAULT_GIT_REMOTE = ENV["HOMEBREW_BREW_DEFAULT_GIT_REMOTE"]
-HOMEBREW_CORE_DEFAULT_GIT_REMOTE = ENV["HOMEBREW_CORE_DEFAULT_GIT_REMOTE"]
-HOMEBREW_DEFAULT_CACHE = ENV["HOMEBREW_DEFAULT_CACHE"]
-HOMEBREW_DEFAULT_LOGS = ENV["HOMEBREW_DEFAULT_LOGS"]
-HOMEBREW_DEFAULT_TEMP = ENV["HOMEBREW_DEFAULT_TEMP"]
-HOMEBREW_REQUIRED_RUBY_VERSION = ENV["HOMEBREW_REQUIRED_RUBY_VERSION"]
+HOMEBREW_BOTTLE_DEFAULT_DOMAIN = ENV.fetch("HOMEBREW_BOTTLE_DEFAULT_DOMAIN").freeze
+HOMEBREW_BREW_DEFAULT_GIT_REMOTE = ENV.fetch("HOMEBREW_BREW_DEFAULT_GIT_REMOTE").freeze
+HOMEBREW_CORE_DEFAULT_GIT_REMOTE = ENV.fetch("HOMEBREW_CORE_DEFAULT_GIT_REMOTE").freeze
+HOMEBREW_DEFAULT_CACHE = ENV.fetch("HOMEBREW_DEFAULT_CACHE").freeze
+HOMEBREW_DEFAULT_LOGS = ENV.fetch("HOMEBREW_DEFAULT_LOGS").freeze
+HOMEBREW_DEFAULT_TEMP = ENV.fetch("HOMEBREW_DEFAULT_TEMP").freeze
+HOMEBREW_REQUIRED_RUBY_VERSION = ENV.fetch("HOMEBREW_REQUIRED_RUBY_VERSION").freeze
 
-HOMEBREW_PRODUCT = ENV["HOMEBREW_PRODUCT"]
-HOMEBREW_VERSION = ENV["HOMEBREW_VERSION"]
+HOMEBREW_PRODUCT = ENV.fetch("HOMEBREW_PRODUCT").freeze
+HOMEBREW_VERSION = ENV.fetch("HOMEBREW_VERSION").freeze
 HOMEBREW_WWW = "https://brew.sh"
+HOMEBREW_SYSTEM = ENV.fetch("HOMEBREW_SYSTEM").freeze
+HOMEBREW_PROCESSOR = ENV.fetch("HOMEBREW_PROCESSOR").freeze
 
-HOMEBREW_USER_AGENT_CURL = ENV["HOMEBREW_USER_AGENT_CURL"]
+HOMEBREW_BREWED_CURL_PATH = Pathname(ENV.fetch("HOMEBREW_BREWED_CURL_PATH")).freeze
+HOMEBREW_USER_AGENT_CURL = ENV.fetch("HOMEBREW_USER_AGENT_CURL").freeze
 HOMEBREW_USER_AGENT_RUBY =
-  "#{ENV["HOMEBREW_USER_AGENT"]} ruby/#{RUBY_VERSION}-p#{RUBY_PATCHLEVEL}"
+  "#{ENV.fetch("HOMEBREW_USER_AGENT")} ruby/#{RUBY_VERSION}-p#{RUBY_PATCHLEVEL}"
 HOMEBREW_USER_AGENT_FAKE_SAFARI =
   "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/602.4.8 " \
   "(KHTML, like Gecko) Version/10.0.3 Safari/602.4.8"
-HOMEBREW_GITHUB_PACKAGES_AUTH = ENV["HOMEBREW_GITHUB_PACKAGES_AUTH"]
+HOMEBREW_GITHUB_PACKAGES_AUTH = ENV.fetch("HOMEBREW_GITHUB_PACKAGES_AUTH").freeze
 
 HOMEBREW_DEFAULT_PREFIX = "/usr/local"
 HOMEBREW_DEFAULT_REPOSITORY = "#{HOMEBREW_DEFAULT_PREFIX}/Homebrew"
diff --git a/Library/Homebrew/os.rb b/Library/Homebrew/os.rb
index 94bc9276d8..52945a402a 100644
--- a/Library/Homebrew/os.rb
+++ b/Library/Homebrew/os.rb
@@ -43,7 +43,7 @@ module OS
     @kernel_name ||= Utils.safe_popen_read("uname", "-s").chomp
   end
 
-  ::OS_VERSION = ENV["HOMEBREW_OS_VERSION"]
+  ::OS_VERSION = ENV.fetch("HOMEBREW_OS_VERSION").freeze
 
   CI_GLIBC_VERSION = "2.23"
   CI_OS_VERSION = "Ubuntu 16.04"
@@ -54,8 +54,8 @@ module OS
     if !OS::Mac.version.prerelease? &&
        !OS::Mac.version.outdated_release? &&
        ARGV.none? { |v| v.start_with?("--cc=") } &&
-       (ENV["HOMEBREW_PREFIX"] == HOMEBREW_DEFAULT_PREFIX ||
-       (ENV["HOMEBREW_PREFIX"] == HOMEBREW_MACOS_ARM_DEFAULT_PREFIX && Hardware::CPU.arm?))
+       (HOMEBREW_PREFIX == HOMEBREW_DEFAULT_PREFIX ||
+       (HOMEBREW_PREFIX == HOMEBREW_MACOS_ARM_DEFAULT_PREFIX && Hardware::CPU.arm?))
       ISSUES_URL = "https://docs.brew.sh/Troubleshooting"
     end
     PATH_OPEN = "/usr/bin/open"
diff --git a/Library/Homebrew/os/mac.rb b/Library/Homebrew/os/mac.rb
index 7edd8e6701..bb75f0de9c 100644
--- a/Library/Homebrew/os/mac.rb
+++ b/Library/Homebrew/os/mac.rb
@@ -21,6 +21,9 @@ module OS
 
     raise "Loaded OS::Mac on generic OS!" if ENV["HOMEBREW_TEST_GENERIC_OS"]
 
+    VERSION = ENV.fetch("HOMEBREW_MACOS_VERSION").chomp.freeze
+    private_constant :VERSION
+
     # This can be compared to numerics, strings, or symbols
     # using the standard Ruby Comparable methods.
     sig { returns(Version) }
@@ -35,7 +38,7 @@ module OS
       @full_version ||= if ENV["HOMEBREW_FAKE_EL_CAPITAN"] # for Portable Ruby building
         Version.new("10.11.6")
       else
-        Version.new((ENV["HOMEBREW_MACOS_VERSION"]).chomp)
+        Version.new(VERSION)
       end
     end
 
diff --git a/Library/Homebrew/sorbet/rbi/hidden-definitions/hidden.rbi b/Library/Homebrew/sorbet/rbi/hidden-definitions/hidden.rbi
index 49856ecc08..cf5be780ff 100644
--- a/Library/Homebrew/sorbet/rbi/hidden-definitions/hidden.rbi
+++ b/Library/Homebrew/sorbet/rbi/hidden-definitions/hidden.rbi
@@ -3538,6 +3538,7 @@ class Object
   FORMULA_COMPONENT_PRECEDENCE_LIST = ::T.let(nil, ::T.untyped)
   HOMEBREW_BOTTLES_EXTNAME_REGEX = ::T.let(nil, ::T.untyped)
   HOMEBREW_BOTTLE_DEFAULT_DOMAIN = ::T.let(nil, ::T.untyped)
+  HOMEBREW_BREWED_CURL_PATH = ::T.let(nil, ::T.untyped)
   HOMEBREW_BREW_DEFAULT_GIT_REMOTE = ::T.let(nil, ::T.untyped)
   HOMEBREW_BREW_FILE = ::T.let(nil, ::T.untyped)
   HOMEBREW_CACHE = ::T.let(nil, ::T.untyped)
@@ -3564,6 +3565,7 @@ class Object
   HOMEBREW_OFFICIAL_REPO_PREFIXES_REGEX = ::T.let(nil, ::T.untyped)
   HOMEBREW_PINNED_KEGS = ::T.let(nil, ::T.untyped)
   HOMEBREW_PREFIX = ::T.let(nil, ::T.untyped)
+  HOMEBREW_PROCESSOR = ::T.let(nil, ::T.untyped)
   HOMEBREW_PRODUCT = ::T.let(nil, ::T.untyped)
   HOMEBREW_PULL_API_REGEX = ::T.let(nil, ::T.untyped)
   HOMEBREW_PULL_OR_COMMIT_URL_REGEX = ::T.let(nil, ::T.untyped)
@@ -3571,6 +3573,7 @@ class Object
   HOMEBREW_REQUIRED_RUBY_VERSION = ::T.let(nil, ::T.untyped)
   HOMEBREW_RUBY_EXEC_ARGS = ::T.let(nil, ::T.untyped)
   HOMEBREW_SHIMS_PATH = ::T.let(nil, ::T.untyped)
+  HOMEBREW_SYSTEM = ::T.let(nil, ::T.untyped)
   HOMEBREW_TAP_CASK_REGEX = ::T.let(nil, ::T.untyped)
   HOMEBREW_TAP_DIR_REGEX = ::T.let(nil, ::T.untyped)
   HOMEBREW_TAP_FORMULA_REGEX = ::T.let(nil, ::T.untyped)
diff --git a/Library/Homebrew/test/spec_helper.rb b/Library/Homebrew/test/spec_helper.rb
index 254af085a9..5426ab469b 100644
--- a/Library/Homebrew/test/spec_helper.rb
+++ b/Library/Homebrew/test/spec_helper.rb
@@ -170,7 +170,7 @@ RSpec.configure do |config|
   end
 
   config.before(:each, :needs_homebrew_curl) do
-    ENV["HOMEBREW_CURL"] = ENV["HOMEBREW_BREWED_CURL_PATH"]
+    ENV["HOMEBREW_CURL"] = HOMEBREW_BREWED_CURL_PATH
     skip "A `curl` with TLS 1.3 support is required." unless curl_supports_tls13?
   rescue FormulaUnavailableError
     skip "No `curl` formula is available."
diff --git a/Library/Homebrew/utils/bottles.rb b/Library/Homebrew/utils/bottles.rb
index 6f8332a83c..72767645cd 100644
--- a/Library/Homebrew/utils/bottles.rb
+++ b/Library/Homebrew/utils/bottles.rb
@@ -15,8 +15,8 @@ module Utils
       def tag(symbol = nil)
         return Tag.from_symbol(symbol) if symbol.present?
 
-        @tag ||= Tag.new(system: T.must(ENV["HOMEBREW_SYSTEM"]).downcase.to_sym,
-                         arch:   T.must(ENV["HOMEBREW_PROCESSOR"]).downcase.to_sym)
+        @tag ||= Tag.new(system: HOMEBREW_SYSTEM.downcase.to_sym,
+                         arch:   HOMEBREW_PROCESSOR.downcase.to_sym)
       end
 
       def built_as?(f)
diff --git a/Library/Homebrew/utils/curl.rb b/Library/Homebrew/utils/curl.rb
index b07cfa2dac..6d49e01abe 100644
--- a/Library/Homebrew/utils/curl.rb
+++ b/Library/Homebrew/utils/curl.rb
@@ -33,7 +33,7 @@ module Utils
     module_function
 
     def curl_executable(use_homebrew_curl: false)
-      return Pathname.new(ENV["HOMEBREW_BREWED_CURL_PATH"]) if use_homebrew_curl
+      return HOMEBREW_BREWED_CURL_PATH if use_homebrew_curl
 
       @curl_executable ||= HOMEBREW_SHIMS_PATH/"shared/curl"
     end