diff --git a/.buildkite/scripts/lifecycle/pre_command.sh b/.buildkite/scripts/lifecycle/pre_command.sh
index c14325efaa2a5..c14cb2c578a8a 100755
--- a/.buildkite/scripts/lifecycle/pre_command.sh
+++ b/.buildkite/scripts/lifecycle/pre_command.sh
@@ -145,6 +145,9 @@ export DEPLOY_TAGGER_SLACK_WEBHOOK_URL
 GCS_SA_CDN_QA_KEY="$(vault_get gcs-sa-cdn-qa key)"
 export GCS_SA_CDN_QA_KEY
 
+GCS_SA_CDN_QA_EMAIL="$(vault_get gcs-sa-cdn-qa email)"
+export GCS_SA_CDN_QA_EMAIL
+
 GCS_SA_CDN_QA_BUCKET="$(vault_get gcs-sa-cdn-qa bucket)"
 export GCS_SA_CDN_QA_BUCKET
 
diff --git a/.buildkite/scripts/steps/artifacts/docker_image.sh b/.buildkite/scripts/steps/artifacts/docker_image.sh
index 864bc26805fbb..eefc8b9f7903b 100755
--- a/.buildkite/scripts/steps/artifacts/docker_image.sh
+++ b/.buildkite/scripts/steps/artifacts/docker_image.sh
@@ -95,6 +95,7 @@ CDN_ASSETS_FOLDER=$(mktemp -d)
 tar -xf "kibana-$BASE_VERSION-cdn-assets.tar.gz" -C "$CDN_ASSETS_FOLDER" --strip=1
 
 gsutil -m cp -r "$CDN_ASSETS_FOLDER/*" "gs://$GCS_SA_CDN_QA_BUCKET/$GIT_ABBREV_COMMIT"
+gcloud auth revoke "$GCS_SA_CDN_QA_EMAIL"
 
 echo "--- Upload archives"
 buildkite-agent artifact upload "kibana-$BASE_VERSION-linux-x86_64.tar.gz"