diff --git a/.gitlab-ci/container/gitlab-ci.yml b/.gitlab-ci/container/gitlab-ci.yml
index 6c613d6fe34..9b583536622 100644
--- a/.gitlab-ci/container/gitlab-ci.yml
+++ b/.gitlab-ci/container/gitlab-ci.yml
@@ -58,6 +58,12 @@
     - .incorporate-templates-commit
   tags:
     - $FDO_RUNNER_JOB_PRIORITY_TAG_X86_64
+  before_script:
+    - !reference [default, before_script]
+    # Undoing the `eval "$S3_JWT_FILE_SCRIPT"` from the default before_script,
+    # because container_job_trampoline.sh and fdo_cntr_export.sh both need it.
+    - S3_JWT=$(cat "${S3_JWT_FILE}")
+    - export S3_JWT_FILE_SCRIPT="echo -n '${S3_JWT}' > '${S3_JWT_FILE}' && S3_JWT_FILE_SCRIPT= && unset CI_JOB_JWT S3_JWT"
   variables:
     FDO_REPO_SUFFIX: $CI_JOB_NAME
     FDO_DISTRIBUTION_EXEC: 'bash .gitlab-ci/container/container_job_trampoline.sh "${CI_JOB_NAME}"'
@@ -751,6 +757,7 @@ debian/baremetal_arm64_test-vk:
   variables:
     GIT_STRATEGY: fetch # we do actually need the full repository though
     MESA_BASE_IMAGE: None
+  before_script: null  # remove .container before_script as it's unix-only
   script:
     - .\.gitlab-ci\windows\mesa_container.ps1 $CI_REGISTRY $CI_REGISTRY_USER $CI_REGISTRY_PASSWORD $MESA_IMAGE $MESA_UPSTREAM_IMAGE ${DOCKERFILE} ${MESA_BASE_IMAGE}