diff --git a/internal/remote/firecrest/session_script.sh b/internal/remote/firecrest/session_script.sh
index 162ee4f7..de153177 100644
--- a/internal/remote/firecrest/session_script.sh
+++ b/internal/remote/firecrest/session_script.sh
@@ -9,11 +9,16 @@
 
 set -e -o pipefail
 
+: ${REMOTE_SESSION_IMAGE:?'not set, aborting!'}
+
 : ${ARCH:=$(uname -m)}
 : ${RENKU_PKG:="${HOME}/.renku/${ARCH}/pkg"}
+: ${GIT_PROXY_PORT:=65480}
+: ${GIT_PROXY_HEALTH_PORT:=65481}
 : ${GIT_PROXY_WAIT_SLEEP_SECONDS:=10}
 : ${GIT_PROXY_WAIT_RETRIES:=10}
 : ${RCLONE_VERSION:="1.70.2"}
+: ${WSTUNNEL_PATH_PREFIX:="sessions/my-session/wstunnel"}
 : ${WSTUNNEL_VERSION:="10.5.5"}
 
 case ${ARCH} in
@@ -29,6 +34,11 @@ case ${ARCH} in
         ;;
 esac
 
+: ${SESSION_DIR:="${PWD}"}
+: ${SESSION_WORK_DIR:="${SESSION_DIR}/work"}
+: ${SECRETS_DIR:="${SESSION_DIR}/secrets"}
+: ${LOGS_DIR:="${SESSION_DIR}/logs"}
+
 # Installs rclone
 #
 # Usage:
@@ -72,7 +82,7 @@ function install_rclone() {
 # Installs wstunnel
 #
 # Usage:
-#     wstunnel="$(install_wstunnel $version $gh_arch)"
+#     wstunnel="$(install_wstunnel "$version" "$gh_arch")"
 #     "$wstunnel" --version
 function install_wstunnel() {
     wstunnel_version=${1:?"wstunnel_version: Version missing"}
@@ -97,26 +107,19 @@ function install_wstunnel() {
 
     mkdir -p "${wstunnel_pkg}"
     tmp="$(mktemp -d)"
-    cwd="$(pwd)"
-    cd "${tmp}"
-    curl -Lo "wstunnel.tar.gz" "${wstunnel_url}"
-    tar xf "wstunnel.tar.gz" -C "${wstunnel_pkg}"
-    cd "${cwd}"
+    (# Run in a sub shell to prevent changing the working directory of the caller
+        cd "${tmp}"
+        curl -Lo "wstunnel.tar.gz" "${wstunnel_url}"
+        rm -rf "${wstunnel_pkg}"
+        mkdir -p ${wstunnel_pkg} # the folder has to exist for tar -C
+        tar xf "wstunnel.tar.gz" -C "${wstunnel_pkg}"
+    )
     rm -r "${tmp}"
     chmod a+x "${wstunnel_bin}"
 
     echo "${wstunnel_bin}"
 }
 
-if [ -z "${REMOTE_SESSION_IMAGE}" ]; then
-    echo "REMOTE_SESSION_IMAGE is not set, aborting!"
-    exit 1
-fi
-
-SESSION_DIR="$(pwd)"
-SESSION_WORK_DIR="${SESSION_DIR}/work"
-SECRETS_DIR="${SESSION_DIR}/secrets"
-LOGS_DIR="${SESSION_DIR}/logs"
 echo "SESSION_DIR: ${SESSION_DIR}"
 echo "SESSION_WORK_DIR: ${SESSION_WORK_DIR}"
 
@@ -174,9 +177,6 @@ echo "TODO: setup rclone mounts..."
 # "${rclone}" mount --config "${RCLONE_CONFIG}" --daemon --read-only era5: "${SESSION_WORK_DIR}/era5"
 
 # echo "Starting tunnel..."
-GIT_PROXY_PORT="${GIT_PROXY_PORT:-65480}"
-GIT_PROXY_HEALTH_PORT="${GIT_PROXY_HEALTH_PORT:-65481}"
-WSTUNNEL_PATH_PREFIX="${WSTUNNEL_PATH_PREFIX:-sessions/my-session/wstunnel}"
 echo "wstunnel client \
   -R tcp://0.0.0.0:${RENKU_SESSION_PORT}:localhost:${RENKU_SESSION_PORT} \
   -L tcp://${GIT_PROXY_PORT}:localhost:${GIT_PROXY_PORT} \