diff --git a/command/ca/certificate.go b/command/ca/certificate.go
index 74ea4db9..184db5c6 100644
--- a/command/ca/certificate.go
+++ b/command/ca/certificate.go
@@ -184,7 +184,7 @@ multiple SANs. The '--san' flag and the '--token' flag are mutually exclusive.`,
 			},
 			flags.TemplateSet,
 			flags.TemplateSetFile,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Token,
diff --git a/command/ca/provisioner/add.go b/command/ca/provisioner/add.go
index a6b081a7..5d6f2fb3 100644
--- a/command/ca/provisioner/add.go
+++ b/command/ca/provisioner/add.go
@@ -208,7 +208,7 @@ SCEP
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
-			flags.CaConfig,
+			flags.CaConfig(),
 		},
 		Description: `**step ca provisioner add** adds a provisioner to the CA configuration.
 
diff --git a/command/ca/provisioner/remove.go b/command/ca/provisioner/remove.go
index f4d0855e..aa0a570b 100644
--- a/command/ca/provisioner/remove.go
+++ b/command/ca/provisioner/remove.go
@@ -26,7 +26,7 @@ func removeCommand() cli.Command {
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
-			flags.CaConfig,
+			flags.CaConfig(),
 		},
 		Description: `**step ca provisioner remove** removes a provisioner from the CA configuration.
 
diff --git a/command/ca/provisioner/update.go b/command/ca/provisioner/update.go
index 98f6cabe..549be02f 100644
--- a/command/ca/provisioner/update.go
+++ b/command/ca/provisioner/update.go
@@ -212,7 +212,7 @@ SCEP
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
-			flags.CaConfig,
+			flags.CaConfig(),
 		},
 		Description: `**step ca provisioner update** updates a provisioner in the CA configuration.
 
diff --git a/command/ca/provisioner/webhook/add.go b/command/ca/provisioner/webhook/add.go
index d6dda214..7aa8457d 100644
--- a/command/ca/provisioner/webhook/add.go
+++ b/command/ca/provisioner/webhook/add.go
@@ -41,7 +41,7 @@ func addCommand() cli.Command {
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
-			flags.CaConfig,
+			flags.CaConfig(),
 		},
 		Description: `**step ca provisioner webhook add** adds a webhook to a provisioner.
 
diff --git a/command/ca/provisioner/webhook/remove.go b/command/ca/provisioner/webhook/remove.go
index 26b03780..c4eac11b 100644
--- a/command/ca/provisioner/webhook/remove.go
+++ b/command/ca/provisioner/webhook/remove.go
@@ -26,7 +26,7 @@ func removeCommand() cli.Command {
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
-			flags.CaConfig,
+			flags.CaConfig(),
 		},
 		Description: `**step ca provisioner webhook remove** removes a webhook from a provisioner.
 
diff --git a/command/ca/provisioner/webhook/update.go b/command/ca/provisioner/webhook/update.go
index abcbbdac..88df6168 100644
--- a/command/ca/provisioner/webhook/update.go
+++ b/command/ca/provisioner/webhook/update.go
@@ -44,7 +44,7 @@ func updateCommand() cli.Command {
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
-			flags.CaConfig,
+			flags.CaConfig(),
 		},
 		Description: `**step ca provisioner webhook update** updates a webhook attached to a provisioner.
 
diff --git a/command/ca/rekey.go b/command/ca/rekey.go
index aa80dcac..90f6ed27 100644
--- a/command/ca/rekey.go
+++ b/command/ca/rekey.go
@@ -226,7 +226,7 @@ Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".`,
 			flags.PasswordFile,
 			flags.Root,
 			flags.CaURL,
-			flags.CaConfig,
+			flags.CaConfig(),
 		},
 	}
 }
diff --git a/command/ca/renew.go b/command/ca/renew.go
index b26b6be8..49fcb4e6 100644
--- a/command/ca/renew.go
+++ b/command/ca/renew.go
@@ -168,7 +168,7 @@ $ step ca renew --offline internal.crt internal.key
 				Usage: `Use mTLS to renew a certificate. Use --mtls=false to force the token
 authorization flow instead.`,
 			},
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.Force,
 			flags.Offline,
 			flags.PasswordFile,
diff --git a/command/ca/revoke.go b/command/ca/revoke.go
index 2d5415ee..2f4aa7fc 100644
--- a/command/ca/revoke.go
+++ b/command/ca/revoke.go
@@ -198,7 +198,7 @@ attribute certificate have been compromised (reasonCode=10).
 `,
 			},
 			flags.Token,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.Offline,
 			flags.CaURL,
 			flags.Root,
diff --git a/command/ca/sign.go b/command/ca/sign.go
index 5129aa89..b646de1b 100644
--- a/command/ca/sign.go
+++ b/command/ca/sign.go
@@ -139,7 +139,7 @@ $ step ca sign foo.csr foo.crt \
 			acmeContactFlag,
 			acmeHTTPListenFlag,
 			flags.K8sSATokenPathFlag,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
diff --git a/command/ca/token.go b/command/ca/token.go
index e074171c..a6e33f44 100644
--- a/command/ca/token.go
+++ b/command/ca/token.go
@@ -207,7 +207,7 @@ extra names. Use the '--principal' flag multiple times to configure
 multiple principals.`,
 			},
 			sshHostFlag,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.Force,
 			cli.StringFlag{
 				Name: "not-before",
diff --git a/command/ssh/certificate.go b/command/ssh/certificate.go
index ebccd787..73aeff4a 100644
--- a/command/ssh/certificate.go
+++ b/command/ssh/certificate.go
@@ -210,7 +210,7 @@ $  step ssh certificate --kty OKP --curve Ed25519 mariano@work id_ed25519
 				Usage: "Set minimum required length for password used to encrypt private key. The default value is '0'. Values <=0 are interpreted as if no minimum value is set.",
 				Value: 0,
 			},
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
diff --git a/command/ssh/checkHost.go b/command/ssh/checkHost.go
index 7a7ad45d..ad9fa1ad 100644
--- a/command/ssh/checkHost.go
+++ b/command/ssh/checkHost.go
@@ -49,7 +49,7 @@ $ step ssh check-host internal.smallstep.com
 				Name:  "verbose, v",
 				Usage: `Return "true" or "false" in the terminal.`,
 			},
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.Offline,
 			flags.CaURL,
 			flags.Root,
diff --git a/command/ssh/config.go b/command/ssh/config.go
index 451cd2ef..d1ffaeb0 100644
--- a/command/ssh/config.go
+++ b/command/ssh/config.go
@@ -94,7 +94,7 @@ times to set multiple variables.`,
 			flags.Console,
 			flags.DryRun,
 			flags.Force,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Offline,
diff --git a/command/ssh/hosts.go b/command/ssh/hosts.go
index 7440cfcb..f1743582 100644
--- a/command/ssh/hosts.go
+++ b/command/ssh/hosts.go
@@ -39,7 +39,7 @@ $ step ssh hosts
 			flags.TemplateSetFile,
 			flags.Console,
 			flags.Offline,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
diff --git a/command/ssh/login.go b/command/ssh/login.go
index 8eda7acd..b5b12648 100644
--- a/command/ssh/login.go
+++ b/command/ssh/login.go
@@ -98,7 +98,7 @@ $  step ssh certificate --kty OKP --curve Ed25519 mariano@work id_ed25519
 			flags.Console,
 			flags.Force,
 			flags.Offline,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
diff --git a/command/ssh/logout.go b/command/ssh/logout.go
index 1726fc40..89e36301 100644
--- a/command/ssh/logout.go
+++ b/command/ssh/logout.go
@@ -67,7 +67,7 @@ $ step ssh logout --all
 			},
 			flags.Identity,
 			flags.Offline,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
diff --git a/command/ssh/proxycommand.go b/command/ssh/proxycommand.go
index 0a0293b3..d7cb3510 100644
--- a/command/ssh/proxycommand.go
+++ b/command/ssh/proxycommand.go
@@ -59,7 +59,7 @@ This command will add the user to the ssh-agent if necessary.
 			flags.TemplateSetFile,
 			flags.Console,
 			flags.Offline,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
diff --git a/command/ssh/rekey.go b/command/ssh/rekey.go
index a384f9a4..2b7a799d 100644
--- a/command/ssh/rekey.go
+++ b/command/ssh/rekey.go
@@ -69,7 +69,7 @@ $ step ssh rekey --out id2_ecdsa id_ecdsa-cert.pub id_ecdsa
 			flags.SSHPOPCert,
 			flags.SSHPOPKey,
 			flags.Offline,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
diff --git a/command/ssh/renew.go b/command/ssh/renew.go
index 1498b038..721bde5a 100644
--- a/command/ssh/renew.go
+++ b/command/ssh/renew.go
@@ -65,7 +65,7 @@ $ step ssh renew -out new-id_ecdsa-cer.pub id_ecdsa-cert.pub id_ecdsa
 			flags.SSHPOPKey,
 			flags.Force,
 			flags.Offline,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
diff --git a/command/ssh/revoke.go b/command/ssh/revoke.go
index 5944abb2..04ca63f0 100644
--- a/command/ssh/revoke.go
+++ b/command/ssh/revoke.go
@@ -113,7 +113,7 @@ attribute certificate have been compromised (reasonCode=10).
 `,
 			},
 			flags.Offline,
-			flags.CaConfig,
+			flags.CaConfig(),
 			flags.CaURL,
 			flags.Root,
 			flags.Context,
diff --git a/flags/flags.go b/flags/flags.go
index d185e624..93979858 100644
--- a/flags/flags.go
+++ b/flags/flags.go
@@ -287,13 +287,11 @@ uses the configuration, certificates, and keys created with **step ca init**,
 but can accept a different configuration file using **--ca-config** flag.`,
 	}
 
-	// CaConfig is a cli.Flag used to pass the CA configuration file.
-	CaConfig = cli.StringFlag{
-		Name: "ca-config",
-		Usage: `The certificate authority configuration <file>. Defaults to
-$(step path)/config/ca.json`,
-		Value: filepath.Join(step.Path(), "config", "ca.json"),
-	}
+	// CaConfig is now a function (see the CaConfig func below). Defining it as a
+	// package var made its default value call step.Path() at package
+	// initialization, which caches the step configuration path from $HOME before
+	// a program has a chance to set STEPPATH (e.g. an SSH/PAM session hook where
+	// PAM exports the target user's HOME). Resolving it lazily fixes that.
 
 	// AdminCert is a cli.Flag used to pass the x5c header certificate for a JWT.
 	AdminCert = cli.StringFlag{
@@ -728,3 +726,17 @@ func FirstStringOf(ctx *cli.Context, flags ...string) (string, string) {
 
 	return "", name
 }
+
+// CaConfig returns the --ca-config flag. It is a function rather than a package
+// var so its default value, which calls step.Path(), is resolved when the
+// command is constructed instead of at package initialization. As a var,
+// importing this package would call step.Path() at load time and cache the
+// step configuration path from $HOME before a program could set STEPPATH.
+func CaConfig() cli.Flag {
+	return cli.StringFlag{
+		Name: "ca-config",
+		Usage: `The certificate authority configuration <file>. Defaults to
+$(step path)/config/ca.json`,
+		Value: filepath.Join(step.Path(), "config", "ca.json"),
+	}
+}