Disable CP in production issue

Hi all, I know that we can disable control panel access in production by using DISABLE_CP=true as an environment variable in .env

Trying to get my head around why this isn't working for our production environment.

Works fine when locally.

I wonder if the fact we're using Envoyer might be the reason because .env isn't where Statamic would expect?