diff --git a/scripts/azure-cc/deployment/generate-deployment-artifacts.sh b/scripts/azure-cc/deployment/generate-deployment-artifacts.sh
index ca4b950e4..5c6214243 100644
--- a/scripts/azure-cc/deployment/generate-deployment-artifacts.sh
+++ b/scripts/azure-cc/deployment/generate-deployment-artifacts.sh
@@ -81,12 +81,15 @@ if [[ $? -ne 0 ]]; then
   exit 1
 fi
 
-# Export the policy, update it to turn off allow_environment_variable_dropping, and then insert it into the template
+# Export the policy and insert it into the template.
 # note that the EnclaveId is generated by generate.py on the raw policy, not the base64 version
 POLICY_DIGEST_FILE=azure-cc-operator-digest-$VERSION_NUMBER.txt
 az confcom acipolicygen --approve-wildcards --omit-id --template-file ${OUTPUT_DIR}/operator.json --print-policy > ${INPUT_DIR}/policy.base64
 base64 -di < ${INPUT_DIR}/policy.base64 > ${INPUT_DIR}/generated.rego
-sed -i "s#allow_environment_variable_dropping := true#allow_environment_variable_dropping := false#g" ${INPUT_DIR}/generated.rego
+if ! grep -q "allow_environment_variable_dropping := true" ${INPUT_DIR}/generated.rego; then
+  echo "allow_environment_variable_dropping is not true in the generated policy"
+  exit 1
+fi
 base64 -w0 < ${INPUT_DIR}/generated.rego > ${INPUT_DIR}/generated.rego.base64
 python3 ${SCRIPT_DIR}/generate.py ${INPUT_DIR}/generated.rego > ${MANIFEST_DIR}/${POLICY_DIGEST_FILE}