diff --git a/ci/scripts/common/ensure_env_version.sh b/ci/scripts/common/ensure_env_version.sh
index 0c25d1f..1517c8d 100755
--- a/ci/scripts/common/ensure_env_version.sh
+++ b/ci/scripts/common/ensure_env_version.sh
@@ -4,8 +4,14 @@ set -eu
 echo "[fx-pipeline] rewriting .env.version" >&2
 
 if [ -f ./.env.version ]; then
-  # shellcheck disable=SC1091
-  . ./.env.version || true
+  tmp_env="$(mktemp .env.version.sanitized.XXXXXX)"
+  if grep -E '^[[:alpha:]_][[:alnum:]_]*=' ./.env.version >"$tmp_env" 2>/dev/null; then
+    # shellcheck disable=SC1091
+    . "$tmp_env" || true
+  else
+    echo "[fx-pipeline] ignoring legacy .env.version contents" >&2
+  fi
+  rm -f "$tmp_env"
 fi
 
 if [ -n "${WOODPECKER_COMMIT:-}" ]; then