diff --git a/CHANGELOG.md b/CHANGELOG.md
index ebb92a2..ba4b4f8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,7 +10,7 @@ Breaking changes:
 * None.
 
 Other notable changes:
-* `bashy-basics`: New utility function `env-names`.
+* `bashy-basics`: New utility functions `env-clean` and `env-names`.
 
 ### v2.7 -- 2023-10-30
 
diff --git a/scripts/lib/bashy-basics/_setup.sh b/scripts/lib/bashy-basics/_setup.sh
index 40a6028..3c132d8 100644
--- a/scripts/lib/bashy-basics/_setup.sh
+++ b/scripts/lib/bashy-basics/_setup.sh
@@ -61,6 +61,24 @@ function check-json-output-args {
     fi
 }
 
+# Removes from the environment all the variables except for the ones listed.
+# Note that it is probably best to only run this in a subshell, e.g. just before
+# running code that can't be fully trusted with a fuller set of environment
+# variables.
+function env-clean {
+    local allowList=" $* " # Minor cleverness for easier regex matching below.
+
+    local allNames
+    allNames=($(env-names)) || return "$?"
+
+    local n
+    for n in "${allNames[@]}"; do
+        if [[ ! (${allowList} =~ " ${n} ") ]]; then
+            export -n "${n}"
+        fi
+    done
+}
+
 # Prints a list of the names of all defined environment variables.
 function env-names {
     # It turns out that the most straightforward way to get a list of