diff --git a/scripts/test_docker.sh b/scripts/test_docker.sh
index f25b83888c20..c1538b809e32 100755
--- a/scripts/test_docker.sh
+++ b/scripts/test_docker.sh
@@ -1,11 +1,18 @@
 #!/bin/bash
 set -e -x -o pipefail
-hash=$(git rev-parse HEAD || openssl rand -base64 36)
+hash="$(git rev-parse HEAD || openssl rand -base64 36)"
 
-export PG_PASS=$(openssl rand -base64 36 | tr -d '\n')
-export AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')
-export AUTHENTIK_IMAGE="xghcr.io/goauthentik/server"
-export AUTHENTIK_TAG=$(echo $hash | cut -c1-15)
+AUTHENTIK_TAG="$(echo "$hash" | cut -c1-15)" >.env
+
+if [ -f .env ]; then
+    echo "Existing .env file, aborting"
+    exit 1
+fi
+
+echo PG_PASS="$(openssl rand -base64 36 | tr -d '\n')" >.env
+echo AUTHENTIK_SECRET_KEY="$(openssl rand -base64 60 | tr -d '\n')" >>.env
+echo AUTHENTIK_IMAGE="xghcr.io/goauthentik/server" >>.env
+echo AUTHENTIK_TAG="${AUTHENTIK_TAG}" >>.env
 export COMPOSE_PROJECT_NAME="authentik-test-${AUTHENTIK_TAG}"
 
 # Ensure buildx is installed
@@ -14,7 +21,7 @@ docker buildx install
 mkdir -p ./gen-ts-api
 touch .env
 
-docker build -t ${AUTHENTIK_IMAGE}:${AUTHENTIK_TAG} .
+docker build -t "${AUTHENTIK_IMAGE}:${AUTHENTIK_TAG}" .
 docker compose up --no-start
 docker compose start postgresql redis
 docker compose run -u root server test-all