diff --git a/tasks/acs-ci-nightly/openshell/README.md b/tasks/acs-ci-nightly/openshell/README.md
index 367249e..34b9a2e 100644
--- a/tasks/acs-ci-nightly/openshell/README.md
+++ b/tasks/acs-ci-nightly/openshell/README.md
@@ -14,8 +14,9 @@ credentials.
 The built-in Google Cloud profile supplies the gateway-managed metadata path
 that gsutil uses. The workflow's Boto configuration enables gsutil's
 `[GoogleCompute]` metadata credential lookup without placing a credential in
-the sandbox. The task policy binds that provider instance only to the
-read-only `test-platform-results-public` endpoints.
+the sandbox, and `GCE_METADATA_ROOT` points legacy gsutil's metadata client at
+OpenShell's loopback emulator. The task policy binds that provider instance
+only to the read-only `test-platform-results-public` endpoints.
 The task also points Google Cloud CLI tools at OpenShell's combined CA bundle
 so `gsutil` verifies the sandbox proxy certificate without disabling TLS.
 
diff --git a/tasks/acs-ci-nightly/workflow/harness.yaml b/tasks/acs-ci-nightly/workflow/harness.yaml
index 9160c0f..7034a50 100644
--- a/tasks/acs-ci-nightly/workflow/harness.yaml
+++ b/tasks/acs-ci-nightly/workflow/harness.yaml
@@ -25,6 +25,7 @@ sandbox:
     CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE: /etc/openshell-tls/ca-bundle.pem
     CURL_CA_BUNDLE: /etc/openshell-tls/ca-bundle.pem
     BOTO_CONFIG: /tmp/openshell-boto.cfg
+    GCE_METADATA_ROOT: 127.0.0.1:8174
 
 source:
   repo: https://github.com/stackrox/acs-triage-agent.git
diff --git a/tasks/acs-ci-nightly/workflow/preflight.yaml b/tasks/acs-ci-nightly/workflow/preflight.yaml
index e0975ac..8e33d5e 100644
--- a/tasks/acs-ci-nightly/workflow/preflight.yaml
+++ b/tasks/acs-ci-nightly/workflow/preflight.yaml
@@ -14,6 +14,7 @@ sandbox:
     CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE: /etc/openshell-tls/ca-bundle.pem
     CURL_CA_BUNDLE: /etc/openshell-tls/ca-bundle.pem
     BOTO_CONFIG: /tmp/openshell-boto.cfg
+    GCE_METADATA_ROOT: 127.0.0.1:8174
 
 payloads:
   - content: |
@@ -45,6 +46,7 @@ agent:
         echo "Jira: GET $JIRA_URL/rest/api/2/myself"
         jira_status=$(curl --silent --show-error --output /dev/null \
           --write-out '%{http_code}' --connect-timeout 10 --max-time 30 \
+          --user "$JIRA_EMAIL:$JIRA_API_TOKEN" \
           "$JIRA_URL/rest/api/2/myself" 2>"$jira_error")
         jira_exit=$?
         if [ "$jira_exit" -ne 0 ]; then