diff --git a/testing/run_integration_test.sh b/testing/run_integration_test.sh
index a9c84882e32412b5cdbdebee1e65acae1bd57727..f972736e3e210110442c819d4d05a77611e3b9b9 100755
--- a/testing/run_integration_test.sh
+++ b/testing/run_integration_test.sh
@@ -1,5 +1,10 @@
 #!/usr/bin/env bash
 
+set -o allexport
+source "${PYTEST_ENVIRONMENT}"
+set +o allexport
+
+# NOTE: only set -x after sourcing secret values, otherwise they are leaked
 set -u -x
 
 echo "Using bucket:"
@@ -7,7 +12,6 @@ echo $PREPROCESSOR_RESULTS_BUCKET
 
 TEST_RESULT=0
 
-source "${PYTEST_ENVIRONMENT}"
 
 # wait as in registrar_prep.sh, not sure if necessary
 kubectl exec deployment/my-vs-release-registrar -- ./wait-initialized.sh