Without exporting the variable, envsubst doesn't substitute the variable. This affects SPACK_VERSION in the S3 build cache path. But, because mirrors.yaml is a secret, it doesn't invalidate the cache and only new packages will end up in the new S3 build cache location... :-/