diff --git a/docs/docs/Deployment/deployment-block-custom-components.mdx b/docs/docs/Deployment/deployment-block-custom-components.mdx
index c13a6a0f6e..16ef1563ca 100644
--- a/docs/docs/Deployment/deployment-block-custom-components.mdx
+++ b/docs/docs/Deployment/deployment-block-custom-components.mdx
@@ -21,4 +21,23 @@ This environment variable is a beta feature, and should not be your only safegua
 
 In the event that Langflow could execute untrusted or LLM-generated code, run Langflow in an isolated and containerized execution environment.
 
-For more information, see [Security](/security).
+### Configure a custom component allow-list
+
+`LANGFLOW_ALLOW_CUSTOM_COMPONENTS` works together with optional paths that define which component templates the server loads, and which code hashes are trusted.
+
+Directories listed in the `LANGFLOW_COMPONENTS_PATH` environment variable are loaded as custom components and merged into the server’s template set.
+When `LANGFLOW_ALLOW_CUSTOM_COMPONENTS` is set to `false`, the components in the `LANGFLOW_COMPONENTS_PATH` directory **remain allowed**.
+
+To allow some components while blocking others, include the allowed custom components directory in `LANGFLOW_COMPONENTS_PATH` and set `LANGFLOW_ALLOW_CUSTOM_COMPONENTS` to `false`.
+
+`LANGFLOW_COMPONENTS_INDEX_PATH` points to a prebuilt component index JSON file at a local path or `http://` / `https://` URL.
+This environment variable replaces the default index bundled with the `lfx` package.
+It does **not** import Python modules from a directory on disk.
+To allow-list custom components, use the `LANGFLOW_COMPONENTS_PATH` environment variable.
+
+If both environment variables are set, Langflow builds one combined set of components from the custom index _and_ from `LANGFLOW_COMPONENTS_PATH`. If the same component category name exists in both, `LANGFLOW_COMPONENTS_PATH` replaces that whole category from the custom index.
+
+For more information, see:
+
+* [Environment variables](/environment-variables#visual-editor-and-playground-behavior)
+* [Security](/security)
\ No newline at end of file
diff --git a/docs/docs/Develop/environment-variables.mdx b/docs/docs/Develop/environment-variables.mdx
index e9b77f58fa..3acf554748 100644
--- a/docs/docs/Develop/environment-variables.mdx
+++ b/docs/docs/Develop/environment-variables.mdx
@@ -92,6 +92,7 @@ If it detects a supported environment variable, then it automatically adopts the
     LANGFLOW_BUNDLE_URLS=["https://github.com/user/repo/commit/hash"]
     LANGFLOW_CACHE_TYPE=async
     LANGFLOW_COMPONENTS_PATH=/path/to/components/
+    LANGFLOW_COMPONENTS_INDEX_PATH=/path/to/component_index.json
     LANGFLOW_CONFIG_DIR=/path/to/config/
     LANGFLOW_DATABASE_URL=postgresql://user:password@localhost:5432/langflow
     LANGFLOW_DEV=False
@@ -170,6 +171,7 @@ LANGFLOW_BACKEND_ONLY=False
 LANGFLOW_BUNDLE_URLS=["https://github.com/user/repo/commit/hash"]
 LANGFLOW_CACHE_TYPE=async
 LANGFLOW_COMPONENTS_PATH=/path/to/components/
+LANGFLOW_COMPONENTS_INDEX_PATH=/path/to/component_index.json
 LANGFLOW_CONFIG_DIR=/path/to/config/
 LANGFLOW_DATABASE_URL=postgresql://user:password@localhost:5432/langflow
 LANGFLOW_DEV=False
@@ -215,6 +217,7 @@ Environment="LANGFLOW_BACKEND_ONLY=false"
 Environment="LANGFLOW_BUNDLE_URLS=[\"https://github.com/user/repo/commit/hash\"]"
 Environment="LANGFLOW_CACHE_TYPE=async"
 Environment="LANGFLOW_COMPONENTS_PATH=/path/to/components/"
+Environment="LANGFLOW_COMPONENTS_INDEX_PATH=/path/to/component_index.json"
 Environment="LANGFLOW_CONFIG_DIR=/path/to/config"
 Environment="LANGFLOW_DATABASE_URL=postgresql://user:password@localhost:5432/langflow"
 Environment="LANGFLOW_DEV=false"
@@ -267,6 +270,7 @@ Create or edit the `.vscode/tasks.json` file in your project root.
             "LANGFLOW_BUNDLE_URLS": "[\"https://github.com/user/repo/commit/hash\"]",
             "LANGFLOW_CACHE_TYPE": "async",
             "LANGFLOW_COMPONENTS_PATH": "D:/path/to/components/",
+            "LANGFLOW_COMPONENTS_INDEX_PATH": "D:/path/to/component_index.json",
             "LANGFLOW_CONFIG_DIR": "D:/path/to/config/",
             "LANGFLOW_DATABASE_URL": "postgresql://postgres:password@localhost:5432/langflow",
             "LANGFLOW_DEV": "false",
@@ -433,6 +437,7 @@ See [Telemetry](/contributing-telemetry).
 | `LANGFLOW_AUTO_SAVING_INTERVAL` | Integer | `1000` | Set the auto-save interval in milliseconds if `LANGFLOW_AUTO_SAVING=True`. |
 | `LANGFLOW_BUNDLE_URLS` | List[String] | `[]` | A list of URLs from which to load custom bundles. Supports GitHub URLs. If `LANGFLOW_AUTO_LOGIN=True`, flows from these bundles are loaded into the database. |
 | `LANGFLOW_COMPONENTS_PATH` | String | Not set | Path to a directory containing custom components. Typically used if you have local custom components or you are building a Docker image with custom components. |
+| `LANGFLOW_COMPONENTS_INDEX_PATH` | String | Not set | File path or URL (`http://` or `https://`) to a prebuilt component index JSON file used to populate built-in components in the visual editor. When not set, Langflow uses the included index. Useful for supplying a curated component index, for example in airgapped deployments. For more information, see [Block custom components](../Deployment/deployment-block-custom-components.mdx). |
 | `LANGFLOW_ALLOW_CUSTOM_COMPONENTS` | Boolean | `True` | If `false`, disables custom components and in-editor editing of component code. This feature is in beta. For more information, see [Block custom components](../Deployment/deployment-block-custom-components.mdx). |
 | `LANGFLOW_LOAD_FLOWS_PATH` | String | Not set | Path to a directory containing flow JSON files to be loaded on startup. Typically used when creating a Docker image with prepackaged flows. Requires `LANGFLOW_AUTO_LOGIN=True`. |
 | `LANGFLOW_CREATE_STARTER_PROJECTS` | Boolean | `True` | Whether to create templates during initialization. If `false`, Langflow doesn't create templates, and `LANGFLOW_UPDATE_STARTER_PROJECTS` is treated as `false`. |