diff --git a/.github/workflows/salus.yaml b/.github/workflows/salus.yaml
index 195966cb..c836f77f 100644
--- a/.github/workflows/salus.yaml
+++ b/.github/workflows/salus.yaml
@@ -25,7 +25,7 @@ jobs:
     - uses: actions/checkout@v2
     - name: Salus Scan
       id: salus_scan
-      uses: federacy/scan-action@0.1.4
+      uses: federacy/scan-action@0.1.5
       env:
         SALUS_CONFIGURATION: "file://salus-config.yaml"
       with:
diff --git a/pkg/cmd/analytics.go b/pkg/cmd/analytics.go
index 84a130cb..a6e31ac2 100644
--- a/pkg/cmd/analytics.go
+++ b/pkg/cmd/analytics.go
@@ -19,15 +19,17 @@ import (
 	"fmt"
 
 	"github.com/DopplerHQ/cli/pkg/configuration"
+	"github.com/DopplerHQ/cli/pkg/models"
 	"github.com/DopplerHQ/cli/pkg/printer"
 	"github.com/DopplerHQ/cli/pkg/utils"
 	"github.com/spf13/cobra"
 )
 
 var analyticsCmd = &cobra.Command{
-	Use:   "analytics",
-	Short: "Manage anonymous analytics",
-	Args:  cobra.NoArgs,
+	Use:    "analytics",
+	Short:  "Manage anonymous analytics",
+	Hidden: true,
+	Args:   cobra.NoArgs,
 }
 
 var analyticsStatusCmd = &cobra.Command{
@@ -35,6 +37,8 @@ var analyticsStatusCmd = &cobra.Command{
 	Short: "Check whether anonymous analytics are enabled",
 	Args:  cobra.NoArgs,
 	Run: func(cmd *cobra.Command, args []string) {
+		deprecatedCommand("configure flags get analytics")
+
 		if utils.OutputJSON {
 			printer.JSON(map[string]bool{"enabled": configuration.IsAnalyticsEnabled()})
 		} else {
@@ -52,7 +56,9 @@ var analyticsEnableCmd = &cobra.Command{
 	Short: "Enable anonymous analytics",
 	Args:  cobra.NoArgs,
 	Run: func(cmd *cobra.Command, args []string) {
-		configuration.EnableAnalytics()
+		deprecatedCommand("configure flags enable analytics")
+
+		configuration.SetFlag(models.FlagAnalytics, true)
 
 		if utils.OutputJSON {
 			printer.JSON(map[string]bool{"enabled": true})
@@ -67,7 +73,9 @@ var analyticsDisableCmd = &cobra.Command{
 	Short: "Disable anonymous analytics",
 	Args:  cobra.NoArgs,
 	Run: func(cmd *cobra.Command, args []string) {
-		configuration.DisableAnalytics()
+		deprecatedCommand("configure flags disable analytics")
+
+		configuration.SetFlag(models.FlagAnalytics, false)
 
 		if utils.OutputJSON {
 			printer.JSON(map[string]bool{"enabled": false})
diff --git a/pkg/cmd/configure_flags.go b/pkg/cmd/configure_flags.go
new file mode 100644
index 00000000..ebafb6a1
--- /dev/null
+++ b/pkg/cmd/configure_flags.go
@@ -0,0 +1,151 @@
+/*
+Copyright © 2023 Doppler <support@doppler.com>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+package cmd
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/DopplerHQ/cli/pkg/configuration"
+	"github.com/DopplerHQ/cli/pkg/models"
+	"github.com/DopplerHQ/cli/pkg/printer"
+	"github.com/DopplerHQ/cli/pkg/utils"
+	"github.com/spf13/cobra"
+)
+
+var configureFlagsCmd = &cobra.Command{
+	Use:   "flags",
+	Short: "View current flags",
+	Args:  cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		values := map[string]bool{}
+		flags := models.GetFlags()
+		for _, flag := range flags {
+			value := configuration.GetFlag(flag)
+			values[flag] = value
+		}
+
+		printer.Flags(values, utils.OutputJSON)
+	},
+}
+
+var configureFlagsGetCmd = &cobra.Command{
+	Use:               "get [flag]",
+	Short:             "Get the value of a flag",
+	ValidArgsFunction: FlagsValidArgs,
+	Args:              cobra.ExactArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		plain := utils.GetBoolFlag(cmd, "plain")
+
+		flag := args[0]
+		if !configuration.IsValidFlag(flag) {
+			utils.HandleError(errors.New("invalid flag " + flag))
+		}
+
+		enabled := configuration.GetFlag(flag)
+
+		printer.Flag(flag, enabled, utils.OutputJSON, plain, false)
+	},
+}
+
+var configureFlagsEnableCmd = &cobra.Command{
+	Use:               "enable [flag]",
+	Short:             "Enable a flag",
+	ValidArgsFunction: FlagsValidArgs,
+	Args:              cobra.ExactArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		flag := args[0]
+		if !configuration.IsValidFlag(flag) {
+			utils.HandleError(errors.New("invalid flag " + flag))
+		}
+
+		const value = true
+		configuration.SetFlag(flag, value)
+
+		if !utils.Silent {
+			printer.Flag(flag, value, utils.OutputJSON, false, false)
+		}
+	},
+}
+
+var configureFlagsDisableCmd = &cobra.Command{
+	Use:               "disable [flag]",
+	Short:             "Disable a flag",
+	ValidArgsFunction: FlagsValidArgs,
+	Args:              cobra.ExactArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		flag := args[0]
+		if !configuration.IsValidFlag(flag) {
+			utils.HandleError(errors.New("invalid flag " + flag))
+		}
+
+		const value = false
+		configuration.SetFlag(flag, value)
+
+		if !utils.Silent {
+			printer.Flag(flag, value, utils.OutputJSON, false, false)
+		}
+	},
+}
+
+var configureFlagsResetCmd = &cobra.Command{
+	Use:   "reset [flag]",
+	Short: "Reset a flag to its default",
+	Args:  cobra.ExactArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+
+		flag := args[0]
+		if !configuration.IsValidFlag(flag) {
+			utils.HandleError(errors.New("invalid flag " + flag))
+		}
+
+		yes := utils.GetBoolFlag(cmd, "yes")
+		defaultValue := configuration.GetFlagDefault(flag)
+
+		if !yes {
+			utils.PrintWarning(fmt.Sprintf("This will reset the %s flag to %t", flag, defaultValue))
+			if !utils.ConfirmationPrompt("Continue?", false) {
+				utils.Log("Aborting")
+				return
+			}
+		}
+
+		configuration.SetFlag(flag, defaultValue)
+		printer.Flag(flag, defaultValue, utils.OutputJSON, false, false)
+	},
+}
+
+func FlagsValidArgs(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	persistentValidArgsFunction(cmd)
+
+	return models.GetFlags(), cobra.ShellCompDirectiveNoFileComp
+}
+
+func init() {
+	configureCmd.AddCommand(configureFlagsCmd)
+
+	configureFlagsGetCmd.Flags().Bool("plain", false, "print value without formatting")
+	configureFlagsCmd.AddCommand(configureFlagsGetCmd)
+
+	configureFlagsCmd.AddCommand(configureFlagsEnableCmd)
+
+	configureFlagsCmd.AddCommand(configureFlagsDisableCmd)
+
+	configureFlagsResetCmd.Flags().BoolP("yes", "y", false, "proceed without confirmation")
+	configureFlagsCmd.AddCommand(configureFlagsResetCmd)
+
+	rootCmd.AddCommand(configureFlagsCmd)
+}
diff --git a/pkg/cmd/root.go b/pkg/cmd/root.go
index a8844455..9e651a20 100644
--- a/pkg/cmd/root.go
+++ b/pkg/cmd/root.go
@@ -24,6 +24,7 @@ import (
 	"github.com/DopplerHQ/cli/pkg/controllers"
 	"github.com/DopplerHQ/cli/pkg/global"
 	"github.com/DopplerHQ/cli/pkg/http"
+	"github.com/DopplerHQ/cli/pkg/models"
 	"github.com/DopplerHQ/cli/pkg/printer"
 	"github.com/DopplerHQ/cli/pkg/utils"
 	"github.com/DopplerHQ/cli/pkg/version"
@@ -61,6 +62,21 @@ var rootCmd = &cobra.Command{
 		// tty is required to accept user input, otherwise the update can't be accepted/declined
 		isTTY := isatty.IsTerminal(os.Stdout.Fd())
 
+		// version check
+		if !configuration.GetFlag(models.FlagUpdateCheck) {
+			version.PerformVersionCheck = false
+		}
+		if version.PerformVersionCheck && configuration.CanReadEnv {
+			enable := os.Getenv("DOPPLER_ENABLE_VERSION_CHECK")
+			if enable == "false" {
+				logValueFromEnvironmentNotice("DOPPLER_ENABLE_VERSION_CHECK")
+				version.PerformVersionCheck = false
+			}
+		}
+		if version.PerformVersionCheck {
+			version.PerformVersionCheck = !utils.GetBoolFlagIfChanged(cmd, "no-check-version", !version.PerformVersionCheck)
+		}
+
 		// only run version check if we can print the results
 		// --plain doesn't normally affect logging output, but due to legacy reasons it does here
 		// also don't want to display updates if user doesn't want to be prompted (--no-prompt/--no-interactive)
@@ -84,6 +100,7 @@ func persistentValidArgsFunction(cmd *cobra.Command) {
 	loadFlags(cmd)
 }
 
+// this function runs before the config file has been loaded, so flags will not be honored
 func loadFlags(cmd *cobra.Command) {
 	var err error
 	var normalizedScope string
@@ -99,7 +116,8 @@ func loadFlags(cmd *cobra.Command) {
 	if configuration.CanReadEnv {
 		userConfigDir := os.Getenv("DOPPLER_CONFIG_DIR")
 		if userConfigDir != "" {
-			utils.Log(valueFromEnvironmentNotice("DOPPLER_CONFIG_DIR"))
+			// this warning will always be printed since the config file's flags haven't been loaded yet
+			logValueFromEnvironmentNotice("DOPPLER_CONFIG_DIR")
 			configuration.SetConfigDir(userConfigDir)
 		}
 	}
@@ -121,16 +139,6 @@ func loadFlags(cmd *cobra.Command) {
 
 	// no-file is used by the 'secrets download' command to output secrets to stdout
 	utils.Silent = utils.GetBoolFlagIfChanged(cmd, "no-file", utils.Silent)
-
-	// version check
-	if configuration.CanReadEnv {
-		enable := os.Getenv("DOPPLER_ENABLE_VERSION_CHECK")
-		if enable == "false" {
-			utils.Log(valueFromEnvironmentNotice("DOPPLER_ENABLE_VERSION_CHECK"))
-			version.PerformVersionCheck = false
-		}
-	}
-	version.PerformVersionCheck = !utils.GetBoolFlagIfChanged(cmd, "no-check-version", !version.PerformVersionCheck)
 }
 
 func deprecatedCommand(newCommand string) {
diff --git a/pkg/cmd/run.go b/pkg/cmd/run.go
index 13fed4e6..40c2e0b4 100644
--- a/pkg/cmd/run.go
+++ b/pkg/cmd/run.go
@@ -504,7 +504,7 @@ func getPassphrase(cmd *cobra.Command, flag string, config models.ScopedOptions)
 	if configuration.CanReadEnv {
 		passphrase := os.Getenv("DOPPLER_PASSPHRASE")
 		if passphrase != "" {
-			utils.Log(valueFromEnvironmentNotice("DOPPLER_PASSPHRASE"))
+			logValueFromEnvironmentNotice("DOPPLER_PASSPHRASE")
 			return passphrase
 		}
 	}
diff --git a/pkg/cmd/setup.go b/pkg/cmd/setup.go
index 7429da26..12c9f549 100644
--- a/pkg/cmd/setup.go
+++ b/pkg/cmd/setup.go
@@ -53,7 +53,7 @@ func setup(cmd *cobra.Command, args []string) {
 		case models.FlagSource.String():
 			saveToken = true
 		case models.EnvironmentSource.String():
-			utils.Log(valueFromEnvironmentNotice("DOPPLER_TOKEN"))
+			logValueFromEnvironmentNotice("DOPPLER_TOKEN")
 			saveToken = true
 		}
 	}
@@ -94,7 +94,7 @@ func setup(cmd *cobra.Command, args []string) {
 		case models.FlagSource.String():
 			selectedProject = localConfig.EnclaveProject.Value
 		case models.EnvironmentSource.String():
-			utils.Log(valueFromEnvironmentNotice("DOPPLER_PROJECT"))
+			logValueFromEnvironmentNotice("DOPPLER_PROJECT")
 			selectedProject = localConfig.EnclaveProject.Value
 		default:
 			if useRepoConfig && repo.Project != "" {
@@ -129,7 +129,7 @@ func setup(cmd *cobra.Command, args []string) {
 		case models.FlagSource.String():
 			selectedConfig = localConfig.EnclaveConfig.Value
 		case models.EnvironmentSource.String():
-			utils.Log(valueFromEnvironmentNotice("DOPPLER_CONFIG"))
+			logValueFromEnvironmentNotice("DOPPLER_CONFIG")
 			selectedConfig = localConfig.EnclaveConfig.Value
 		default:
 			if useRepoConfig && repo.Config != "" {
@@ -177,6 +177,46 @@ func setup(cmd *cobra.Command, args []string) {
 			printer.ScopedConfigValues(conf, valuesToPrint, models.ScopedOptionsMap(&conf), utils.OutputJSON, false, false)
 		}
 	}
+
+	if repoConfig.Flags.Analytics != nil {
+		flag := models.FlagAnalytics
+		value := *repoConfig.Flags.Analytics
+
+		if utils.CanLogInfo() {
+			verb := "Enabling"
+			if !value {
+				verb = "Disabling"
+			}
+			utils.Log(fmt.Sprintf("%s %s", verb, flag))
+		}
+		configuration.SetFlag(flag, value)
+	}
+	if repoConfig.Flags.EnvWarning != nil {
+		flag := models.FlagEnvWarning
+		value := *repoConfig.Flags.EnvWarning
+
+		if utils.CanLogInfo() {
+			verb := "Enabling"
+			if !value {
+				verb = "Disabling"
+			}
+			utils.Log(fmt.Sprintf("%s %s", verb, flag))
+		}
+		configuration.SetFlag(flag, value)
+	}
+	if repoConfig.Flags.UpdateCheck != nil {
+		flag := models.FlagUpdateCheck
+		value := *repoConfig.Flags.UpdateCheck
+
+		if utils.CanLogInfo() {
+			verb := "Enabling"
+			if !value {
+				verb = "Disabling"
+			}
+			utils.Log(fmt.Sprintf("%s %s", verb, flag))
+		}
+		configuration.SetFlag(flag, value)
+	}
 }
 
 func selectProject(projects []models.ProjectInfo, prevConfiguredProject string, canPromptUser bool) string {
@@ -246,8 +286,10 @@ func selectConfig(configs []models.ConfigInfo, selectedConfiguredProject bool, p
 	return selectedConfig
 }
 
-func valueFromEnvironmentNotice(name string) string {
-	return fmt.Sprintf("Using %s from the environment. To disable this, use --no-read-env.", name)
+func logValueFromEnvironmentNotice(name string) {
+	if configuration.GetFlag(models.FlagEnvWarning) {
+		utils.Log(fmt.Sprintf("Using %s from the environment. To disable this, use --no-read-env.", name))
+	}
 }
 
 // we're looking for duplicate paths and more than one repo being defined without a path.
diff --git a/pkg/configuration/config.go b/pkg/configuration/config.go
index 48d71796..a5bec098 100644
--- a/pkg/configuration/config.go
+++ b/pkg/configuration/config.go
@@ -403,6 +403,11 @@ func ClearConfig() {
 
 // Write config to filesystem
 func writeConfig(config models.ConfigFile) {
+	// keep both analytics properties up-to-date
+	if config.Flags.Analytics != nil {
+		config.Analytics.Disable = !*config.Flags.Analytics
+	}
+
 	bytes, err := yaml.Marshal(config)
 	if err != nil {
 		utils.HandleError(err)
@@ -481,6 +486,13 @@ func readConfig() (models.ConfigFile, int, int) {
 	}
 
 	config.Scoped = normalizedOptions
+
+	// support legacy analytics property when new property isn't set
+	if config.Flags.Analytics == nil && config.Analytics.Disable {
+		b := false
+		config.Flags.Analytics = &b
+	}
+
 	return config, uid, gid
 }
 
diff --git a/pkg/configuration/flags.go b/pkg/configuration/flags.go
new file mode 100644
index 00000000..53bc87cc
--- /dev/null
+++ b/pkg/configuration/flags.go
@@ -0,0 +1,78 @@
+/*
+Copyright © 2023 Doppler <support@doppler.com>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+package configuration
+
+import (
+	"github.com/DopplerHQ/cli/pkg/models"
+	"github.com/DopplerHQ/cli/pkg/utils"
+)
+
+func GetFlag(flag string) bool {
+	flags := configContents.Flags
+	switch flag {
+	case models.FlagAnalytics:
+		if flags.Analytics != nil {
+			return *flags.Analytics
+		}
+		return GetFlagDefault(models.FlagAnalytics)
+	case models.FlagEnvWarning:
+		if flags.EnvWarning != nil {
+			return *flags.EnvWarning
+		}
+		return GetFlagDefault(models.FlagEnvWarning)
+	case models.FlagUpdateCheck:
+		if flags.UpdateCheck != nil {
+			return *flags.UpdateCheck
+		}
+		return GetFlagDefault(models.FlagUpdateCheck)
+	}
+
+	return false
+}
+
+func SetFlag(flag string, enable bool) {
+	switch flag {
+	case models.FlagAnalytics:
+		configContents.Flags.Analytics = &enable
+	case models.FlagEnvWarning:
+		configContents.Flags.EnvWarning = &enable
+	case models.FlagUpdateCheck:
+		configContents.Flags.UpdateCheck = &enable
+	}
+	writeConfig(configContents)
+}
+
+func GetFlagDefault(flag string) bool {
+	switch flag {
+	case models.FlagAnalytics:
+		return true
+	case models.FlagEnvWarning:
+		return true
+	case models.FlagUpdateCheck:
+		return true
+	}
+
+	return false
+}
+
+func IsValidFlag(flag string) bool {
+	flags := models.GetFlags()
+	return utils.Contains(flags, flag)
+}
+
+func IsAnalyticsEnabled() bool {
+	return GetFlag(models.FlagAnalytics)
+}
diff --git a/pkg/models/config.go b/pkg/models/config.go
index c7d21b28..5c414315 100644
--- a/pkg/models/config.go
+++ b/pkg/models/config.go
@@ -23,8 +23,9 @@ import (
 type ConfigFile struct {
 	Scoped       map[string]FileScopedOptions `yaml:"scoped"`
 	VersionCheck VersionCheck                 `yaml:"version-check"`
-	Analytics    AnalyticsOptions             `yaml:"analytics"`
+	Analytics    AnalyticsOptions             `yaml:"analytics,omitempty"`
 	TUI          TUIOptions                   `yaml:"tui"`
+	Flags        Flags                        `yaml:"flags,omitempty"`
 }
 
 // FileScopedOptions config options
diff --git a/pkg/configuration/analytics.go b/pkg/models/flags.go
similarity index 53%
rename from pkg/configuration/analytics.go
rename to pkg/models/flags.go
index 791da2c3..d84b529a 100644
--- a/pkg/configuration/analytics.go
+++ b/pkg/models/flags.go
@@ -1,5 +1,5 @@
 /*
-Copyright © 2022 Doppler <support@doppler.com>
+Copyright © 2023 Doppler <support@doppler.com>
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -13,18 +13,26 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 */
-package configuration
+package models
 
-func IsAnalyticsEnabled() bool {
-	return !configContents.Analytics.Disable
+const (
+	FlagAnalytics   string = "analytics"
+	FlagEnvWarning  string = "env-warning"
+	FlagUpdateCheck string = "update-check"
+)
+
+type Flags struct {
+	Analytics   *bool `yaml:"analytics,omitempty"`
+	EnvWarning  *bool `yaml:"env-warning,omitempty"`
+	UpdateCheck *bool `yaml:"update-check,omitempty"`
 }
 
-func EnableAnalytics() {
-	configContents.Analytics.Disable = false
-	writeConfig(configContents)
+var flags = []string{
+	FlagAnalytics,
+	FlagEnvWarning,
+	FlagUpdateCheck,
 }
 
-func DisableAnalytics() {
-	configContents.Analytics.Disable = true
-	writeConfig(configContents)
+func GetFlags() []string {
+	return flags
 }
diff --git a/pkg/models/repo_config.go b/pkg/models/repo_config.go
index 68ede074..9fd8d3d4 100644
--- a/pkg/models/repo_config.go
+++ b/pkg/models/repo_config.go
@@ -27,10 +27,12 @@ type ProjectConfig struct {
 // that only supported a single project and config
 type RepoConfig struct {
 	Setup ProjectConfig `yaml:"setup"`
+	Flags Flags         `yaml:"flags"`
 }
 
 // MultiRepoConfig struct supports doppler.yaml files containing multiple
 // project and config combos
 type MultiRepoConfig struct {
 	Setup []ProjectConfig `yaml:"setup"`
+	Flags Flags           `yaml:"flags"`
 }
diff --git a/pkg/printer/config.go b/pkg/printer/config.go
index e940afca..bd8b35b2 100644
--- a/pkg/printer/config.go
+++ b/pkg/printer/config.go
@@ -18,6 +18,7 @@ package printer
 import (
 	"fmt"
 	"sort"
+	"strconv"
 	"strings"
 
 	"github.com/DopplerHQ/cli/pkg/configuration"
@@ -181,3 +182,38 @@ func ConfigOptionNames(options []string, jsonFlag bool) {
 	}
 	Table([]string{"name"}, rows, TableOptions())
 }
+
+func Flags(flags map[string]bool, jsonFlag bool) {
+	if jsonFlag {
+		JSON(flags)
+		return
+	}
+
+	var rows [][]string
+	for flag, value := range flags {
+		rows = append(rows, []string{flag, strconv.FormatBool(value)})
+	}
+	Table([]string{"flag", "value"}, rows, TableOptions())
+}
+
+func Flag(flag string, value bool, jsonFlag bool, plain bool, copy bool) {
+	if plain || copy {
+		if copy {
+			if err := utils.CopyToClipboard(strconv.FormatBool(value)); err != nil {
+				utils.HandleError(err, "Unable to copy to clipboard")
+			}
+		}
+
+		if plain {
+			fmt.Println(strconv.FormatBool(value))
+			return
+		}
+	}
+
+	if jsonFlag {
+		JSON(map[string]bool{flag: value})
+		return
+	}
+
+	Table([]string{"flag", "value"}, [][]string{{flag, strconv.FormatBool(value)}}, TableOptions())
+}
diff --git a/tests/e2e.sh b/tests/e2e.sh
index 6032c2e9..83137135 100755
--- a/tests/e2e.sh
+++ b/tests/e2e.sh
@@ -9,6 +9,8 @@ export DOPPLER_SCRIPTS_DIR="$DIR/../scripts"
 export DOPPLER_PROJECT="cli"
 export DOPPLER_CONFIG="e2e"
 
+export DOPPLER_ENABLE_VERSION_CHECK=false
+
 # Run tests
 "$DIR/e2e/secrets-download-fallback.sh"
 "$DIR/e2e/secrets-substitute.sh"
@@ -24,6 +26,7 @@ export DOPPLER_CONFIG="e2e"
 "$DIR/e2e/me.sh"
 "$DIR/e2e/global-flags.sh"
 "$DIR/e2e/update.sh"
+"$DIR/e2e/flags.sh"
 
 echo -e "\nAll tests completed successfully!"
 exit 0
diff --git a/tests/e2e/flags.sh b/tests/e2e/flags.sh
new file mode 100755
index 00000000..f2f28d9c
--- /dev/null
+++ b/tests/e2e/flags.sh
@@ -0,0 +1,96 @@
+#!/bin/bash
+
+set -euo pipefail
+
+TEST_NAME="flags"
+TEST_CONFIG_DIR="./temp-config-dir"
+
+cleanup() {
+  exit_code=$?
+  if [ "$exit_code" -ne 0 ]; then
+    echo "ERROR: '$TEST_NAME' tests failed during execution"
+    afterAll || echo "ERROR: Cleanup failed"
+  fi
+
+  exit "$exit_code"
+}
+trap cleanup EXIT
+trap cleanup INT
+
+beforeAll() {
+  echo "INFO: Executing '$TEST_NAME' tests"
+}
+
+beforeEach() {
+  rm -rf $TEST_CONFIG_DIR
+}
+
+afterAll() {
+  echo "INFO: Completed '$TEST_NAME' tests"
+  beforeEach
+}
+
+error() {
+  message=$1
+  echo "$message"
+  exit 1
+}
+
+flags=('analytics' 'env-warning' 'update-check')
+
+beforeAll
+
+beforeEach
+
+# verify defaults
+for flag in "${flags[@]}"; do
+  [[ "$("$DOPPLER_BINARY" configure flags get "$flag" --plain --config-dir=$TEST_CONFIG_DIR)" == 'true' ]] || error "ERROR: incorrect default for $flag"
+done
+
+beforeEach
+
+# verify set/get
+for flag in "${flags[@]}"; do
+  "$DOPPLER_BINARY" configure flags disable "$flag" --config-dir=$TEST_CONFIG_DIR >/dev/null 2>/dev/null
+  [[ "$("$DOPPLER_BINARY" configure flags get "$flag" --plain --config-dir=$TEST_CONFIG_DIR)" == 'false' ]] || error "ERROR: incorrect value for $flag after disabling"
+  "$DOPPLER_BINARY" configure flags enable "$flag" --config-dir=$TEST_CONFIG_DIR >/dev/null 2>/dev/null
+  [[ "$("$DOPPLER_BINARY" configure flags get "$flag" --plain --config-dir=$TEST_CONFIG_DIR)" == 'true' ]] || error "ERROR: incorrect value for $flag after enabling"
+done
+
+# beforeEach
+
+# verify reset
+for flag in "${flags[@]}"; do
+  "$DOPPLER_BINARY" configure flags disable "$flag" --config-dir=$TEST_CONFIG_DIR >/dev/null 2>/dev/null
+  "$DOPPLER_BINARY" configure flags reset -y "$flag" --config-dir=$TEST_CONFIG_DIR >/dev/null 2>/dev/null
+  [[ "$("$DOPPLER_BINARY" configure flags get "$flag" --plain --config-dir=$TEST_CONFIG_DIR)" == 'true' ]] || error "ERROR: incorrect value for $flag after reset"
+done
+
+beforeEach
+
+# verify interoperability between 'flags' command and legacy 'analytics' command
+[[ "$("$DOPPLER_BINARY" configure flags get analytics --plain --config-dir=$TEST_CONFIG_DIR)" == 'true' ]] || error "ERROR: incorrect initial value for analytics"
+"$DOPPLER_BINARY" analytics disable --config-dir=$TEST_CONFIG_DIR >/dev/null 2>&1
+[[ "$("$DOPPLER_BINARY" configure flags get analytics --plain --config-dir=$TEST_CONFIG_DIR)" == 'false' ]] || error "ERROR: incorrect disabled value for analytics"
+"$DOPPLER_BINARY" analytics enable --config-dir=$TEST_CONFIG_DIR >/dev/null 2>&1
+[[ "$("$DOPPLER_BINARY" configure flags get analytics --plain --config-dir=$TEST_CONFIG_DIR)" == 'true' ]] || error "ERROR: incorrect enabled value for analytics"
+
+beforeEach
+
+# parse legacy analytics field from config file
+mkdir ./temp-config-dir
+cat << EOF > ./temp-config-dir/.doppler.yaml
+analytics:
+    disable: true
+EOF
+
+[[ "$("$DOPPLER_BINARY" configure flags get analytics --plain --config-dir=$TEST_CONFIG_DIR)" == 'false' ]] || error "ERROR: incorrect value read when parsing legacy analytics field in config file"
+
+cat << EOF > ./temp-config-dir/.doppler.yaml
+analytics:
+    disable: false
+EOF
+
+[[ "$("$DOPPLER_BINARY" configure flags get analytics --plain --config-dir=$TEST_CONFIG_DIR)" == 'true' ]] || error "ERROR: incorrect value read when parsing legacy analytics field in config file"
+
+afterAll
diff --git a/tests/e2e/install-sh-update-in-place.sh b/tests/e2e/install-sh-update-in-place.sh
index de0c7b73..b148ebf3 100755
--- a/tests/e2e/install-sh-update-in-place.sh
+++ b/tests/e2e/install-sh-update-in-place.sh
@@ -59,8 +59,8 @@ afterAll() {
   fi
 }
 
-md5hash() {
-  md5 -rq $1 || md5sum $1 | awk '{print $1}'
+filehash() {
+  sha256sum "$1" | awk '{print $1}'
 }
 
 ######################################################################
@@ -132,12 +132,12 @@ set +e
 mkdir "$TEMP_INSTALL_DIR"
 touch "$TEMP_INSTALL_DIR/doppler" && chmod +x "$TEMP_INSTALL_DIR/doppler"
 
-empty_hash="$(md5hash "$TEMP_INSTALL_DIR/doppler")"
+empty_hash="$(filehash "$TEMP_INSTALL_DIR/doppler")"
 output="$("$DOPPLER_SCRIPTS_DIR/install.sh" --no-package-manager 2>&1)"
 exit_code=$?
 set -e
 
-updated_hash="$(md5hash "$TEMP_INSTALL_DIR/doppler")"
+updated_hash="$(filehash "$TEMP_INSTALL_DIR/doppler")"
 installed_at="$(command -v doppler || true)"
 
 actual_dir="$(dirname "$installed_at")"
diff --git a/tests/e2e/setup.sh b/tests/e2e/setup.sh
index f97c4548..c14255cb 100755
--- a/tests/e2e/setup.sh
+++ b/tests/e2e/setup.sh
@@ -4,8 +4,8 @@ set -euo pipefail
 
 TEST_NAME="setup file"
 TEST_CONFIG_DIR="./temp-config-dir"
-DOPPLER_PROJECT=""
-DOPPLER_CONFIG=""
+unset DOPPLER_PROJECT
+unset DOPPLER_CONFIG
 
 cleanup() {
   exit_code=$?
@@ -260,4 +260,23 @@ afterEach
 
 ######################################################################
 
+name="test doppler.yaml setup file with flags"
+
+beforeEach
+
+cat << EOF > doppler.yaml
+flags:
+  analytics: false
+  env-warning: false
+  update-check: false
+EOF
+"$DOPPLER_BINARY" setup --config-dir=$TEST_CONFIG_DIR --no-interactive
+[[ "$("$DOPPLER_BINARY" configure flags get analytics --config-dir=$TEST_CONFIG_DIR --plain)" == 'false' ]] || error "ERROR: setup not setting disabled value for analytics"
+[[ "$("$DOPPLER_BINARY" configure flags get env-warning --config-dir=$TEST_CONFIG_DIR --plain)" == 'false' ]] || error "ERROR: setup not setting disabled value for env-warning"
+[[ "$("$DOPPLER_BINARY" configure flags get update-check --config-dir=$TEST_CONFIG_DIR --plain)" == 'false' ]] || error "ERROR: setup not setting disabled value for update-check"
+
+afterEach
+
+######################################################################
+
 afterAll