diff --git a/components/ws-manager/pkg/manager/create.go b/components/ws-manager/pkg/manager/create.go
index cb6c083b402628..87804190581ab3 100644
--- a/components/ws-manager/pkg/manager/create.go
+++ b/components/ws-manager/pkg/manager/create.go
@@ -643,6 +643,11 @@ func setProtectedSecrets(pod *corev1.Pod, req *api.StartWorkspaceRequest) {
 				continue
 			}
 
+			// already sourced from somewhere else
+			if env.ValueFrom != nil {
+				continue
+			}
+
 			env.Value = ""
 			env.ValueFrom = &corev1.EnvVarSource{
 				SecretKeyRef: &corev1.SecretKeySelector{
diff --git a/components/ws-manager/pkg/manager/testdata/cdwp_envvars.golden b/components/ws-manager/pkg/manager/testdata/cdwp_envvars.golden
index 55dedeb25078e9..d776b973b6c5e8 100644
--- a/components/ws-manager/pkg/manager/testdata/cdwp_envvars.golden
+++ b/components/ws-manager/pkg/manager/testdata/cdwp_envvars.golden
@@ -171,8 +171,8 @@
                             "name": "one_from_a_secret",
                             "valueFrom": {
                                 "secretKeyRef": {
-                                    "name": "ws-test",
-                                    "key": "31ba5230e08a8d69893703c936aaf570c76246cac7a2f7d4cfd28b8ab180631b"
+                                    "name": "some-secret",
+                                    "key": "some-key"
                                 }
                             }
                         },
diff --git a/components/ws-manager/pkg/manager/testdata/cdwp_sys_envvars.golden b/components/ws-manager/pkg/manager/testdata/cdwp_sys_envvars.golden
index d33ec049b3bf79..161347cc07842d 100644
--- a/components/ws-manager/pkg/manager/testdata/cdwp_sys_envvars.golden
+++ b/components/ws-manager/pkg/manager/testdata/cdwp_sys_envvars.golden
@@ -175,8 +175,8 @@
                             "name": "one_from_a_secret",
                             "valueFrom": {
                                 "secretKeyRef": {
-                                    "name": "ws-test",
-                                    "key": "31ba5230e08a8d69893703c936aaf570c76246cac7a2f7d4cfd28b8ab180631b"
+                                    "name": "some-secret",
+                                    "key": "some-key"
                                 }
                             }
                         },