diff --git a/pkgs/clan-cli/clan_cli/machines/update.py b/pkgs/clan-cli/clan_cli/machines/update.py
index f8d0fe2e1..dd6d71de2 100644
--- a/pkgs/clan-cli/clan_cli/machines/update.py
+++ b/pkgs/clan-cli/clan_cli/machines/update.py
@@ -1,6 +1,7 @@
 import argparse
 import json
 import logging
+import os
 import shlex
 import sys
 
@@ -32,7 +33,7 @@ def is_path_input(node: dict[str, dict[str, str]]) -> bool:
 
 def upload_sources(machine: Machine, always_upload_source: bool = False) -> str:
     host = machine.build_host
-    env = host.nix_ssh_env()
+    env = host.nix_ssh_env(os.environ.copy())
 
     if not always_upload_source:
         flake_url = (
@@ -119,8 +120,6 @@ def deploy_machine(machines: MachineGroup) -> None:
             machine,
         )
 
-        env = host.nix_ssh_env()
-
         cmd = [
             "nixos-rebuild",
             "switch",
@@ -142,6 +141,7 @@ def deploy_machine(machines: MachineGroup) -> None:
             target_host = f"{target_host.user or 'root'}@{target_host.host}"
             cmd.extend(["--target-host", target_host])
 
+        env = host.nix_ssh_env(None)
         ret = host.run(cmd, extra_env=env, check=False)
         # re-retry switch if the first time fails
         if ret.returncode != 0:
diff --git a/pkgs/clan-cli/clan_cli/ssh/__init__.py b/pkgs/clan-cli/clan_cli/ssh/__init__.py
index 8304bfdd0..27d0a8c47 100644
--- a/pkgs/clan-cli/clan_cli/ssh/__init__.py
+++ b/pkgs/clan-cli/clan_cli/ssh/__init__.py
@@ -513,8 +513,9 @@ class Host:
             timeout=timeout,
         )
 
-    def nix_ssh_env(self) -> dict[str, str]:
-        env = os.environ.copy()
+    def nix_ssh_env(self, env: dict[str, str] | None) -> dict[str, str]:
+        if env is None:
+            env = {}
         env["NIX_SSHOPTS"] = " ".join(self.ssh_cmd_opts())
         return env