diff --git a/lib/VERSION b/lib/VERSION
index 18b1307..0786c6b 100644
--- a/lib/VERSION
+++ b/lib/VERSION
@@ -1 +1 @@
-3.0.0-alpha.2
+3.0.0-alpha.1
diff --git a/lib/impl/jobPatched.nix b/lib/impl/jobPatched.nix
index c7134fb..9997caa 100644
--- a/lib/impl/jobPatched.nix
+++ b/lib/impl/jobPatched.nix
@@ -11,33 +11,21 @@ in
     pipelineName,
     nixConfig,
   }:
-    (builtins.removeAttrs job ["variables" "cache"])
+    job
     // (optionalAttrs nixConfig.enable (
       (prependToBeforeScript ["source setup_nix_ci \"gitlab-ci:pipeline:${pipelineName}:job-deps:${key}\""] job)
       // (appendToAfterScript ["finalize_nix_ci"] job)
     ))
-    // optionalAttrs nixConfig.enable (
-      (let
-        variables =
-          (filterJobVariables false job)
-          // optionalAttrs nixConfig.enableRunnerCache {
-            NIX_CI_CACHE_STRATEGY = "runner";
-          };
-      in
-        # filter empty variables
-        optionalAttrs (variables != {}) {
-          inherit variables;
-        })
-      // (let
-        cache =
-          (toList (job.cache or []))
-          ++ (optional nixConfig.enableRunnerCache {
-            key = nixConfig.runnerCacheKey;
-            paths = [".nix-cache/"];
-          });
-      in
-        # filter empty cache
-        optionalAttrs (cache != []) {
-          inherit cache;
-        })
-    )
+    // optionalAttrs nixConfig.enable {
+      variables =
+        (filterJobVariables false job)
+        // optionalAttrs nixConfig.enableRunnerCache {
+          NIX_CI_CACHE_STRATEGY = "runner";
+        };
+      cache =
+        (toList (job.cache or []))
+        ++ (optional nixConfig.enableRunnerCache {
+          key = nixConfig.runnerCacheKey;
+          paths = [".nix-cache/"];
+        });
+    }
diff --git a/nix/repo/ci.nix b/nix/repo/ci.nix
index 747c9d8..5e14188 100644
--- a/nix/repo/ci.nix
+++ b/nix/repo/ci.nix
@@ -64,6 +64,10 @@ in
           script = [
             "nix run .#tests -- --junit=junit.xml"
           ];
+          variables = {
+            "SSL_CERT_FILE" = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+            "NIX_SSL_CERT_FILE" = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+          };
           allow_failure = true;
           artifacts = {
             when = "always";
diff --git a/tests/cilib_test.nix b/tests/cilib_test.nix
index 78e99a3..d37da49 100644
--- a/tests/cilib_test.nix
+++ b/tests/cilib_test.nix
@@ -148,7 +148,10 @@
         name = "handle store paths in variables";
         expected = {
           stages = ["test"];
-          test.stage = "test";
+          test = {
+            stage = "test";
+            variables."TEST" = "${pkgs.hello}";
+          };
         };
         actual =
           (mkPipeline {
diff --git a/tests/flake_parts_test.nix b/tests/flake_parts_test.nix
index e998f45..0b11ef2 100644
--- a/tests/flake_parts_test.nix
+++ b/tests/flake_parts_test.nix
@@ -14,8 +14,6 @@
           ''
             ${ntlib.helpers.scriptHelpers}
             ${ntlib.helpers.path (with pkgs; [coreutils nix gnused gnugrep jq])}
-            export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
-            export NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
             repo_path=${../.}
 
             cp ${./fixtures/flake_parts}/* .