diff --git a/Dockerfile b/Dockerfile
index 04cf89ba..3da4ed33 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -91,7 +91,7 @@ ENV VPNSP=pia \
     WIREGUARD_PUBLIC_KEY= \
     WIREGUARD_ADDRESS= \
     WIREGUARD_ENDPOINT_IP= \
-    WIREGUARD_PORT= \
+    WIREGUARD_ENDPOINT_PORT= \
     WIREGUARD_INTERFACE=wg0 \
     # VPN server filtering
     REGION= \
diff --git a/internal/configuration/custom.go b/internal/configuration/custom.go
index 5bd886c5..45577685 100644
--- a/internal/configuration/custom.go
+++ b/internal/configuration/custom.go
@@ -21,7 +21,7 @@ func (settings *Provider) readCustom(r reader, vpnType string) (err error) {
 	case constants.OpenVPN:
 		return settings.ServerSelection.OpenVPN.readCustom(r)
 	case constants.Wireguard:
-		return settings.ServerSelection.Wireguard.readCustom(r.env)
+		return settings.ServerSelection.Wireguard.readCustom(r)
 	default:
 		return fmt.Errorf("%w: for VPN type %s", errCustomNotSupported, vpnType)
 	}
@@ -56,21 +56,22 @@ func (settings *OpenVPN) readCustom(r reader) (err error) {
 	return nil
 }
 
-func (settings *WireguardSelection) readCustom(env params.Interface) (err error) {
-	settings.PublicKey, err = env.Get("WIREGUARD_PUBLIC_KEY",
+func (settings *WireguardSelection) readCustom(r reader) (err error) {
+	settings.PublicKey, err = r.env.Get("WIREGUARD_PUBLIC_KEY",
 		params.CaseSensitiveValue(), params.Compulsory())
 	if err != nil {
 		return fmt.Errorf("environment variable WIREGUARD_PUBLIC_KEY: %w", err)
 	}
 
-	settings.EndpointIP, err = readWireguardEndpointIP(env)
+	settings.EndpointIP, err = readWireguardEndpointIP(r.env)
 	if err != nil {
 		return err
 	}
 
-	settings.EndpointPort, err = env.Port("WIREGUARD_PORT", params.Compulsory())
+	settings.EndpointPort, err = r.env.Port("WIREGUARD_ENDPOINT_PORT", params.Compulsory(),
+		params.RetroKeys([]string{"WIREGUARD_PORT"}, r.onRetroActive))
 	if err != nil {
-		return fmt.Errorf("environment variable WIREGUARD_PORT: %w", err)
+		return fmt.Errorf("environment variable WIREGUARD_ENDPOINT_PORT: %w", err)
 	}
 
 	return nil
diff --git a/internal/configuration/ivpn_test.go b/internal/configuration/ivpn_test.go
index 6f36d238..6e47c83c 100644
--- a/internal/configuration/ivpn_test.go
+++ b/internal/configuration/ivpn_test.go
@@ -48,6 +48,7 @@ func Test_Provider_readIvpn(t *testing.T) { //nolint:gocognit
 		protocol  singleStringCall
 		ovpnPort  portCall
 		wgPort    portCall
+		wgOldPort portCall
 		settings  Provider
 		err       error
 	}{
@@ -133,7 +134,7 @@ func Test_Provider_readIvpn(t *testing.T) { //nolint:gocognit
 			settings: Provider{
 				Name: constants.Ivpn,
 			},
-			err: errors.New("environment variable WIREGUARD_PORT: dummy test error"),
+			err: errors.New("environment variable WIREGUARD_ENDPOINT_PORT: dummy test error"),
 		},
 		"default settings": {
 			targetIP:  singleStringCall{call: true},
@@ -144,6 +145,7 @@ func Test_Provider_readIvpn(t *testing.T) { //nolint:gocognit
 			protocol:  singleStringCall{call: true},
 			ovpnPort:  portCall{getCall: true, getValue: "0"},
 			wgPort:    portCall{getCall: true, getValue: "0"},
+			wgOldPort: portCall{getCall: true, getValue: "0"},
 			settings: Provider{
 				Name: constants.Ivpn,
 			},
@@ -224,13 +226,21 @@ func Test_Provider_readIvpn(t *testing.T) { //nolint:gocognit
 					Return(testCase.ovpnPort.portValue, testCase.ovpnPort.portErr)
 			}
 			if testCase.wgPort.getCall {
-				env.EXPECT().Get("WIREGUARD_PORT", gomock.Any()).
+				env.EXPECT().Get("WIREGUARD_ENDPOINT_PORT", gomock.Any()).
 					Return(testCase.wgPort.getValue, testCase.wgPort.getErr)
 			}
 			if testCase.wgPort.portCall {
-				env.EXPECT().Port("WIREGUARD_PORT").
+				env.EXPECT().Port("WIREGUARD_ENDPOINT_PORT").
 					Return(testCase.wgPort.portValue, testCase.wgPort.portErr)
 			}
+			if testCase.wgOldPort.getCall {
+				env.EXPECT().Get("WIREGUARD_PORT", gomock.Any()).
+					Return(testCase.wgOldPort.getValue, testCase.wgOldPort.getErr)
+			}
+			if testCase.wgOldPort.portCall {
+				env.EXPECT().Port("WIREGUARD_PORT").
+					Return(testCase.wgOldPort.portValue, testCase.wgOldPort.portErr)
+			}
 
 			r := reader{
 				servers: allServers,
diff --git a/internal/configuration/provider.go b/internal/configuration/provider.go
index b0c9c4e5..37966bd7 100644
--- a/internal/configuration/provider.go
+++ b/internal/configuration/provider.go
@@ -180,11 +180,15 @@ func readOpenVPNCustomPort(env params.Interface, tcp bool,
 
 // note: set allowed to an empty slice to allow all valid ports
 func readWireguardCustomPort(env params.Interface, allowed []uint16) (port uint16, err error) {
-	port, err = readPortOrZero(env, "WIREGUARD_PORT")
+	port, err = readPortOrZero(env, "WIREGUARD_ENDPOINT_PORT")
 	if err != nil {
-		return 0, fmt.Errorf("environment variable WIREGUARD_PORT: %w", err)
+		return 0, fmt.Errorf("environment variable WIREGUARD_ENDPOINT_PORT: %w", err)
 	} else if port == 0 {
-		return 0, nil
+		port, _ = readPortOrZero(env, "WIREGUARD_PORT")
+		if err == nil {
+			return port, nil // 0 or WIREGUARD_PORT value
+		}
+		return 0, nil // default 0
 	}
 
 	if len(allowed) == 0 {
diff --git a/internal/provider/custom/connection.go b/internal/provider/custom/connection.go
index 831e6ff5..362216a0 100644
--- a/internal/provider/custom/connection.go
+++ b/internal/provider/custom/connection.go
@@ -53,7 +53,7 @@ func getWireguardConnection(selection configuration.ServerSelection) (
 	}
 }
 
-// Port found is overridden by custom port set with `PORT` or `WIREGUARD_PORT`.
+// Port found is overridden by custom port set with `PORT` or `WIREGUARD_ENDPOINT_PORT`.
 func getPort(foundPort uint16, selection configuration.ServerSelection) (port uint16) {
 	return utils.GetPort(selection, foundPort, foundPort, foundPort)
 }
diff --git a/maintenance.md b/maintenance.md
index 8aaef98b..014201ab 100644
--- a/maintenance.md
+++ b/maintenance.md
@@ -41,7 +41,7 @@
 - `PROTOCOL` to `OPENVPN_PROTOCOL`
 - `PORT_FORWARDING`
 - Change servers filtering environment variables to plural
-- `WIREGUARD_PORT` to `WIREGUARD_ENDPOINT_PORT`
+- Remove `WIREGUARD_PORT`
 - `WIREGUARD_ADDRESS` to `WIREGUARD_ADDRESSES`
 - Only use `custom` VPNSP for custom OpenVPN configurations
 - `VPNSP` compulsory