diff --git a/lib/backup/gitaly_backup.rb b/lib/backup/gitaly_backup.rb
index 53c998efd716dc8ba302a1161c9ec6e918cf0d0c..bb9f45121e9b7efb3c062a5e329a498d075ded2b 100644
--- a/lib/backup/gitaly_backup.rb
+++ b/lib/backup/gitaly_backup.rb
@@ -107,7 +107,11 @@ def build_env
         'SSL_CERT_FILE' => Gitlab::X509::Certificate.default_cert_file,
         'SSL_CERT_DIR' => Gitlab::X509::Certificate.default_cert_dir,
         'GITALY_SERVERS' => gitaly_servers_encoded
-      }.merge(ENV)
+      }.merge(current_env)
+    end
+
+    def current_env
+      ENV
     end
 
     def started?
diff --git a/spec/lib/backup/database_spec.rb b/spec/lib/backup/database_spec.rb
index dd8a4a14531cdfaaa2e20fe9d0cfc94601346db4..e0ca090d96a302c44c55bd103bd7f6f208a6a4ee 100644
--- a/spec/lib/backup/database_spec.rb
+++ b/spec/lib/backup/database_spec.rb
@@ -272,14 +272,13 @@
     end
 
     context 'with PostgreSQL settings defined in the environment' do
-      let(:cmd) { %W[#{Gem.ruby} -e] + ["$stderr.puts ENV.to_h.select { |k, _| k.start_with?('PG') }"] }
       let(:config) { YAML.load_file(File.join(Rails.root, 'config', 'database.yml'))['test'] }
 
       before do
-        stub_const 'ENV', ENV.to_h.merge({
+        stub_env(ENV.to_h.merge({
           'GITLAB_BACKUP_PGHOST' => 'test.example.com',
           'PGPASSWORD' => 'donotchange'
-        })
+        }))
       end
 
       it 'overrides default config values' do
@@ -289,12 +288,13 @@
           expect(Rake::Task['gitlab:db:drop_tables:main']).to receive(:invoke)
         end
 
+        expect(ENV).to receive(:[]=).with('PGHOST', 'test.example.com')
+        expect(ENV).not_to receive(:[]=).with('PGPASSWORD', anything)
+
         subject.restore(backup_dir)
 
-        expect(output).to include(%("PGHOST"=>"test.example.com"))
-        expect(output).to include(%("PGPASSWORD"=>"donotchange"))
-        expect(output).to include(%("PGPORT"=>"#{config['port']}")) if config['port']
-        expect(output).to include(%("PGUSER"=>"#{config['username']}")) if config['username']
+        expect(ENV['PGPORT']).to eq(config['port']) if config['port']
+        expect(ENV['PGUSER']).to eq(config['username']) if config['username']
       end
     end
 
diff --git a/spec/lib/backup/gitaly_backup_spec.rb b/spec/lib/backup/gitaly_backup_spec.rb
index 172fc28dd3e5f700412b9a92364d994572cc490d..40e835e9dc8e276178ff6479fa1382b8ca73ea2a 100644
--- a/spec/lib/backup/gitaly_backup_spec.rb
+++ b/spec/lib/backup/gitaly_backup_spec.rb
@@ -132,11 +132,8 @@
         )
       end
 
-      before do
-        stub_const('ENV', ssl_env)
-      end
-
       it 'passes through SSL envs' do
+        expect(subject).to receive(:current_env).and_return(ssl_env)
         expect(Open3).to receive(:popen2).with(expected_env, anything, 'create', '-path', anything, '-layout', 'pointer', '-id', backup_id).and_call_original
 
         subject.start(:create, destination, backup_id: backup_id)