diff --git a/scripts/rtc_copy_write_e2e.py b/scripts/rtc_copy_write_e2e.py
index df08697..c9764f3 100644
--- a/scripts/rtc_copy_write_e2e.py
+++ b/scripts/rtc_copy_write_e2e.py
@@ -21,7 +21,6 @@ ROOT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(ROOT)); sys.path.insert(0, str(ROOT / "scripts")); sys.path.insert(0, str(ROOT / "agent" / "src"))
 from dotenv import load_dotenv  # noqa: E402
 
-load_dotenv(ROOT / ".env")
 import fdb  # noqa: E402
 import local_completion as lc  # noqa: E402
 from central.app.operational_state import classify_product_state, summarize_operational_states  # noqa: E402
@@ -79,6 +78,7 @@ def coverage(env, company, ncm_valid, override=None):
 
 
 def main():
+    load_dotenv(ROOT / ".env")            # credentials only when the script runs, never as an import side effect
     guard(COPY)
     service = load_service()
     env = {"FIREBIRD_DATABASE_PATH": COPY, "FB_USER": os.environ["FB_USER"], "FB_PASSWORD": os.environ["FB_PASSWORD"], "FIREBIRD_CLIENT_LIBRARY": os.environ.get("FIREBIRD_CLIENT_LIBRARY")}
diff --git a/tests/test_rtc_copy_write_guard.py b/tests/test_rtc_copy_write_guard.py
index d753b65..5f89bc2 100644
--- a/tests/test_rtc_copy_write_guard.py
+++ b/tests/test_rtc_copy_write_guard.py
@@ -9,10 +9,13 @@ ROOT = Path(__file__).resolve().parents[1]
 
 
 def _load():
+    import os
+    before = dict(os.environ)
     sys.path.insert(0, str(ROOT / "scripts")); sys.path.insert(0, str(ROOT / "agent" / "src"))
     spec = importlib.util.spec_from_file_location("rtc_copy_write_e2e", ROOT / "scripts" / "rtc_copy_write_e2e.py")
     module = importlib.util.module_from_spec(spec)
     spec.loader.exec_module(module)
+    assert dict(os.environ) == before, "importing the E2E script must not change the environment"
     return module