diff --git a/.github/workflows/publish-server-image.yml b/.github/workflows/publish-server-image.yml
index 0d9d3c5..27477ba 100644
--- a/.github/workflows/publish-server-image.yml
+++ b/.github/workflows/publish-server-image.yml
@@ -186,14 +186,16 @@ jobs:
             context: infra/sandboxes/computer
           - arch: amd64
             runner: [self-hosted, evoo-ci, Linux]
-    env:
-      DOCKER_CONFIG: ${{ runner.temp }}/docker-config
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           persist-credentials: false
       - name: Prepare isolated Docker config directory
-        run: mkdir -p "$DOCKER_CONFIG"
+        run: |
+          set -euo pipefail
+          cfg="${RUNNER_TEMP}/docker-config"
+          mkdir -p "$cfg"
+          echo "DOCKER_CONFIG=${cfg}" >> "$GITHUB_ENV"
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
       - name: Log in to GHCR
         uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
@@ -257,11 +259,13 @@ jobs:
           - name: app
           - name: updater
           - name: computer
-    env:
-      DOCKER_CONFIG: ${{ runner.temp }}/docker-config
     steps:
       - name: Prepare isolated Docker config directory
-        run: mkdir -p "$DOCKER_CONFIG"
+        run: |
+          set -euo pipefail
+          cfg="${RUNNER_TEMP}/docker-config"
+          mkdir -p "$cfg"
+          echo "DOCKER_CONFIG=${cfg}" >> "$GITHUB_ENV"
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
       - name: Log in to GHCR
         uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
diff --git a/infra/updater/src/publish-workflow.test.ts b/infra/updater/src/publish-workflow.test.ts
index a0fedff..9bdaea7 100644
--- a/infra/updater/src/publish-workflow.test.ts
+++ b/infra/updater/src/publish-workflow.test.ts
@@ -63,7 +63,7 @@ describe("server image publish workflow", () => {
   });
 
   it("isolates Docker registry auth per job and deletes handoff tags without imagetools rm", () => {
-    expect(workflowText).toContain("DOCKER_CONFIG: ${{ runner.temp }}/docker-config");
+    expect(workflowText).toContain('echo "DOCKER_CONFIG=${cfg}" >> "$GITHUB_ENV"');
     expect(workflowText).toContain("Prepare isolated Docker config directory");
     expect(workflowText).not.toContain("imagetools rm");
     expect(workflowText).toContain("Delete CI handoff tags");