diff --git a/lib/utils.js b/lib/utils.js
index 273fca7..0c6ae55 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -371,13 +371,29 @@ function saveAndReplaceDotEnvCredentials (dotenvFile, saveFile, apihost, namespa
   fs.moveSync(dotenvFile, saveFile)
   // Only override needed env vars and preserve other vars in .env
   const env = dotenv.parse(fs.readFileSync(saveFile))
-  env.AIO_RUNTIME_APIHOST = apihost
-  env.AIO_RUNTIME_AUTH = auth
-  env.AIO_RUNTIME_NAMESPACE = namespace
-  // existing AIO__ vars might override above AIO_ vars
-  delete env.AIO__RUNTIME_AUTH
-  delete env.AIO__RUNTIME_NAMESPACE
-  delete env.AIO__RUNTIME_APIHOST
+  const newCredentials = {
+    AIO_RUNTIME_NAMESPACE: namespace,
+    AIO_RUNTIME_AUTH: auth,
+    AIO_RUNTIME_APIHOST: apihost
+  }
+
+  // remove old keys (match by normalized key name)
+  for (const key in env) {
+    const match = key.match(/^AIO_(.+)/i)
+    if (match) {
+      for (const newCredential in newCredentials) {
+        if (newCredential.toLowerCase() === key.toLowerCase()) {
+          delete env[key]
+        }
+      }
+    }
+  }
+
+  // set the new keys
+  for (const key in newCredentials) {
+    env[key] = newCredentials[key]
+  }
+
   const envContent = Object.keys(env).reduce((content, k) => content + `${k}=${env[k]}\n`, '')
 
   fs.writeFileSync(dotenvFile, envContent)
diff --git a/package.json b/package.json
index a1e4c8b..40f1520 100644
--- a/package.json
+++ b/package.json
@@ -54,6 +54,7 @@
   "devDependencies": {
     "@types/hapi__joi": "^16.0.2",
     "@types/jest": "^25.1.0",
+    "eol": "^0.9.1",
     "eslint": "^6.5.1",
     "eslint-config-standard": "^14.1.0",
     "eslint-plugin-import": "^2.18.2",
diff --git a/test/__fixtures__/app-env/my-env.expected b/test/__fixtures__/app-env/my-env.expected
new file mode 100644
index 0000000..6615e87
--- /dev/null
+++ b/test/__fixtures__/app-env/my-env.expected
@@ -0,0 +1,3 @@
+AIO_RUNTIME_NAMESPACE=local-namespace
+AIO_RUNTIME_AUTH=local-auth
+AIO_RUNTIME_APIHOST=local-apihost
diff --git a/test/__fixtures__/app-env/my-env.original b/test/__fixtures__/app-env/my-env.original
new file mode 100644
index 0000000..b479b40
--- /dev/null
+++ b/test/__fixtures__/app-env/my-env.original
@@ -0,0 +1,3 @@
+AIO_runtime_namespace=my-remote-namespace
+AIO_runtime_auth=my-remote-auth
+AIO_runtime_apihost=my-remote-apihost
diff --git a/test/lib/utils.test.js b/test/lib/utils.test.js
index d33d345..8cf9fb0 100644
--- a/test/lib/utils.test.js
+++ b/test/lib/utils.test.js
@@ -10,6 +10,8 @@ OF ANY KIND, either express or implied. See the License for the specific languag
 governing permissions and limitations under the License.
 */
 const { vol } = global.mockFs()
+const fs = require('fs')
+const eol = require('eol')
 
 const utils = require('../../lib/utils')
 let mockResult = jest.fn()
@@ -258,5 +260,31 @@ describe('lib/utils.zip', () => {
   })
 })
 
+test('saveAndReplaceDotEnvCredentials', () => {
+  global.loadFs(vol, 'app-env')
+
+  const localCredentials = {
+    APIHOST: 'local-apihost',
+    NAMESPACE: 'local-namespace',
+    AUTH: 'local-auth'
+  }
+
+  const envFile = 'my-env.original'
+  const envBackupFile = 'my-env.save'
+  const envExpectedOutputFixture = 'my-env.expected'
+
+  expect(
+    () => utils.saveAndReplaceDotEnvCredentials(envFile, envBackupFile, localCredentials.APIHOST, localCredentials.NAMESPACE, localCredentials.AUTH)
+  ).not.toThrowError()
+
+  expect(fs.existsSync(envFile)).toEqual(true)
+  expect(fs.existsSync(envBackupFile)).toEqual(true)
+
+  const envFileContents = fs.readFileSync(envFile).toString()
+  const expectedEnvFileContents = fs.readFileSync(envExpectedOutputFixture).toString()
+
+  expect(eol.auto(envFileContents)).toEqual(eol.auto(expectedEnvFileContents))
+})
+
 // todo test utils independently + mock utils in scripts once it is exposed as a library
 // for now we test most of utils through scripts