diff --git a/distroless/private/cacerts.bzl b/distroless/private/cacerts.bzl
index 3bbc7fa..44aded3 100644
--- a/distroless/private/cacerts.bzl
+++ b/distroless/private/cacerts.bzl
@@ -43,7 +43,6 @@ oci_image(
 ```
 """
 
-
 def _cacerts_impl(ctx):
     bsdtar = ctx.toolchains[tar_lib.TOOLCHAIN_TYPE]
 
diff --git a/examples/debian_snapshot/BUILD.bazel b/examples/debian_snapshot/BUILD.bazel
index 4925d72..467bc64 100644
--- a/examples/debian_snapshot/BUILD.bazel
+++ b/examples/debian_snapshot/BUILD.bazel
@@ -88,6 +88,10 @@ oci_image(
         "@platforms//cpu:arm64": "arm64",
         "@platforms//cpu:x86_64": "amd64",
     }),
+    env = {
+        # Required to use the SSL certs from `cacerts()`
+        "SSL_CERT_FILE": "/etc/ssl/certs/ca-certificates.crt",
+    },
     os = "linux",
     tars = [
         ":sh",
@@ -105,10 +109,6 @@ oci_image(
             for package in PACKAGES
         ],
     }),
-    env = {
-        # Required to use the SSL certs from `cacerts()`
-        "SSL_CERT_FILE": "/etc/ssl/certs/ca-certificates.crt",
-    }
 )
 
 oci_load(