diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index c2d461e..e723cf6 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -30,6 +30,9 @@ test_show_highstate_against_upstream_formulas:
 
 test_show_highstate_against_forked_formulas:
   stage: test
+  variables:
+    # TODO: get rid of GIT_SSL_NO_VERIFY as soon as we switch to letsencrypt wildcard certs
+    GIT_SSL_NO_VERIFY: 'true'
   before_script:
     - bin/prepare_test_show_highstate_env.sh
     - bin/get_formulas.py -c -d /srv/formula -s -r opensuse
diff --git a/bin/get_formulas.py b/bin/get_formulas.py
index bde36d1..d7e2bfc 100755
--- a/bin/get_formulas.py
+++ b/bin/get_formulas.py
@@ -24,16 +24,12 @@ def check_open_pull_requests():
                 print('%s is %s' % (pull_request, state))
 
 
-def git(cmd, cwd=None, additional_env=None):
+def git(cmd, cwd=None):
     # pygit2 is not available for python3 in Leap, use plain git instead
 
     import subprocess
 
-    env = os.environ.copy()
-    if additional_env:
-        env.update(additional_env)
-
-    status = subprocess.call(['git'] + cmd, cwd=cwd, env=env)
+    status = subprocess.call(['git'] + cmd, cwd=cwd)
     if status != 0:
         sys.exit(status)
 
@@ -47,8 +43,7 @@ def clone_or_pull(DEST):
         else:
             git(['clone', '-q', url, FULL_PATH])
         git(['remote', 'add', 'opensuse', opensuse_fork_url], cwd=FULL_PATH)
-        # TODO: get rid of GIT_SSL_NO_VERIFY as soon as we switch to letsencrypt wildcard certs
-        git(['fetch', '-q', 'opensuse'], cwd=FULL_PATH, additional_env={'GIT_SSL_NO_VERIFY': 'true'})
+        git(['fetch', '-q', 'opensuse'], cwd=FULL_PATH)
 
     def use_pygit2_to_clone_or_pull_repo():
         import pygit2