diff --git a/ci_tests/gitlab-ci.yaml b/ci_tests/gitlab-ci.yaml
index 4f711e0b624336e46a0b26fab7f138da41dcb1ae..866e633f16bec110a5dbc80f1df573485cfb56d6 100644
--- a/ci_tests/gitlab-ci.yaml
+++ b/ci_tests/gitlab-ci.yaml
@@ -13,6 +13,7 @@ test_basic_grb:
   script:
     - ./ci_tests/run_basic_grb_test.sh
   after_script:
+    - source ci_env.sh
     - ./ci_tests/cleanup_basic_grb_test.sh
   dependencies:
     - get_chart_grb
@@ -34,6 +35,7 @@ test_basic_pg:
   script:
     - ./ci_tests/run_basic_postgres_test.sh
   after_script:
+    - source ci_env.sh
     - ./ci_tests/cleanup_basic_postgres_test.sh
   dependencies:
     - get_chart_grb
diff --git a/helpers/helm_base.yaml b/helpers/helm_base.yaml
index e194d67ef770d91762643bd0b093b2ed51eefc49..e8875ff303b12ecbd52c5b456adcfe922e2be0ea 100644
--- a/helpers/helm_base.yaml
+++ b/helpers/helm_base.yaml
@@ -2,12 +2,16 @@
   extends: .docker_based_job
   image: gitlab.ssec.wisc.edu:5555/cspp_geo/geosphere/gcloud-kubectl-helm/gcloud-kubectl-helm:f850fd5c
   before_script:
-    - export KUBECONFIG="$kubekorner_k3s_config"
-    - export HELM_EXPERIMENTAL_OCI="1"
+    # Write environment variable changes to a separate file that can be sourced in "after_script"
+    # We can't move this to a separate script as it won't be importable from other repositories
+    # using this as a base job
+    - ENV_FILE="ci_env.sh"
+    - echo "export KUBECONFIG=\"$kubekorner_k3s_config\"" >> $ENV_FILE
+    - echo "export HELM_EXPERIMENTAL_OCI=\"1\"" >> $ENV_FILE
     - docker info
     - docker login -u ${CI_REGISTRY_USER} -p ${CI_REGISTRY_PASSWORD} ${CI_REGISTRY}
     - if [[ $CI_COMMIT_TAG =~ ^gamma-test-r[0-9]+_[0-9]+ ]]; then
-        export KUBECONFIG="$GAMMA_GEOSPHERE_TEST_CONFIG";
+        echo "export KUBECONFIG=\"$GAMMA_GEOSPHERE_TEST_CONFIG\"" >> $ENV_FILE;
         kubectl config set-context $(kubectl config current-context) --namespace=${GAMMA_GEOSPHERE_TEST_NAMESPACE};
         kubectl config view --minify;
         kubectl auth can-i --list;
@@ -17,16 +21,16 @@
     # enabling this Cloud Resource Manager API. See admin/GCP_README.md
     # for more information.
     - if [[ $CI_COMMIT_TAG =~ ^gcp-r[0-9]+_[0-9]+ ]]; then
-        export KUBECONFIG="/root/.kube/config";
+        echo "export KUBECONFIG=\"/root/.kube/config\"" >> $ENV_FILE;
         gcloud --verbosity=debug auth activate-service-account "${GEOSPHERE_DEPLOY_GCP_SA_EMAIL}" --key-file="${GEOSPHERE_DEPLOY_GCP_SA_KEY}";
         gcloud --verbosity=debug config set project "${GEOSPHERE_DEPLOY_GCP_PROJECT_NAME}";
         gcloud --verbosity=debug container clusters get-credentials "${GEOSPHERE_DEPLOY_GCP_CLUSTER_NAME}" --zone "${GEOSPHERE_DEPLOY_GCP_ZONE_NAME}";
       fi
     - if [[ $CI_COMMIT_TAG =~ ^aws-r[0-9]+_[0-9]+ ]]; then
-        export KUBECONFIG="/root/.kube/config";
-        export AWS_ACCESS_KEY_ID=$GEOSPHERE_DEPLOY_AWS_ACCESS_KEY_ID;
-        export AWS_SECRET_ACCESS_KEY=$GEOSPHERE_DEPLOY_AWS_SECRET_ACCESS_KEY;
-        export AWS_DEFAULT_REGION=$GEOSPHERE_DEPLOY_AWS_DEFAULT_REGION;
+        echo "export KUBECONFIG=\"/root/.kube/config\"" >> $ENV_FILE;
+        echo "export AWS_ACCESS_KEY_ID=$GEOSPHERE_DEPLOY_AWS_ACCESS_KEY_ID" >> $ENV_FILE;
+        echo "export AWS_SECRET_ACCESS_KEY=$GEOSPHERE_DEPLOY_AWS_SECRET_ACCESS_KEY" >> $ENV_FILE;
+        echo "export AWS_DEFAULT_REGION=$GEOSPHERE_DEPLOY_AWS_DEFAULT_REGION" >> $ENV_FILE;
         aws configure set aws_access_key_id "$AWS_ACCESS_KEY_ID";
         aws configure set aws_secret_access_key "$AWS_SECRET_ACCESS_KEY";
         aws configure set default.region "$AWS_DEFAULT_REGION";
@@ -37,4 +41,5 @@
           kubectl config view --minify;
         fi;
       fi
+    - source $ENV_FILE
     - helm registry login -u ${CI_REGISTRY_USER} -p ${CI_JOB_TOKEN} ${CI_REGISTRY}